Privacy

1. What is this privacy policy about?

The Hieronymus Stationers AG

Sennweidstrasse 35

6312 Steinhausen (hereinafter also "we", "us") obtains and processes personal data relating to you or also other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data".

The "Hieronymus Stationers AG" means the Brand Leadership Management AG and its subsidiaries and group companies.

"Personal data" refers to data relating to specific or identifiable persons, i.e. conclusions about their identity are possible on the basis of the data itself or with corresponding additional data. "Personal data requiring special protection" is a category of personal data that is specially protected by the applicable data protection law. Personal data requiring special protection includes, for example, data revealing racial and ethnic origin, health data, information on religious or philosophical beliefs, biometric data for identification purposes and information on trade union membership. In para. 3 you will find details of the data we process under this privacy policy. "Processing" means any handling of personal data, e.g. obtaining, storing, using, adapting, disclosing and deleting.

In this data protection declaration, we describe what we do with your data when you use https://hieronymus-cp.com (hereinafter «website»), obtain our services or products, are otherwise associated with us under a contract, with communicate with us or otherwise deal with us. Where appropriate, we will notify you by timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, e.g. in consent forms, contract terms, additional privacy statements, forms and notices.

If you transmit or disclose data about other persons such as family members, work colleagues, etc., we assume that you are authorised to do so and that this data is correct. By submitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

This privacy statement is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Data Protection Act ("DSG") and the revised Swiss Data Protection Act ("revDSG"). However, whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for processing your data?

Hieronymus Stationers AG, unless otherwise communicated in individual cases, e.g. in further data protection declarations, on forms or in contracts.

For each data processing operation, there are one or more offices which are responsible for ensuring that the processing complies with the requirements of data protection law. This office is called the data controller. It is responsible, for example, for responding to requests for information (section 11) or to ensure that personal data is secured and not used in an unauthorised manner.

Other bodies may also be jointly responsible for the data processing described in this data protection declaration if they have a say in the purpose or design. All group companies are eligible. If you would like information on the individual persons responsible for a specific data processing, you are welcome to contact us within the framework of the right to information (para. 11) to request information. The Hieronymus Stationers AG remains your primary contact, even if other co-responsible parties exist.

In para. 3, in para. 7 and in para. 12 you will find further information on third parties with whom we cooperate and who are responsible for their processing. If you have any questions or wish to exercise your rights vis-à-vis these third parties, please contact them directly.

A list of third parties to whom we may disclose data about you or who may be jointly responsible for the processing of your data can be found here:

  • Vimeo, (controller)
  • Google (commissioned processors) - GA & Google-Tag-Manager
  • CDN-Akamai (commissioned processors)

You can contact us for your data protection concerns and to exercise your rights in accordance with para. 11 you can reach us as follows:

contact@hieronymus-cp.com

You can reach our data protection officer as follows:

• Data Protection Officer pursuant to Art. 37 et seq. GDPR:

Thilo Noack
SBS-DATA-Protect GmbH / datenschutz@brandleadership.com

3. What data do we process?

We process different categories of data about you. The main categories are as follows:

  • Technical data: When you use our website or other electronic offers (e.g. free WLAN), we collect the IP address of your end device and other technical data to ensure the functionality and security of these offers. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 6 months. In order to ensure the functionality of these offers, we may also assign an individual code to you or your end device (e.g. in the form of a cookie, cf. para. 12). The technical data in itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).
  • Registration data: Certain offers, e.g. of competitions and services (e.g. login areas of our website, newsletter dispatch, free WLAN access, etc.) can only be used with a user account or registration, which can take place directly with us or via our external login service providers. In doing so, you must provide us with certain data and we collect data about the use of the offer or service.
  • Communication data: If you are in contact with us via the contact form, by e-mail, telephone or chat, by letter or via other means of communication, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. If we want or need to establish your identity, e.g. in the case of a request for information submitted by you, a request for media access, etc., we collect data to identify you (e.g. a copy of an identity document). We usually keep this data for 12 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. E-mails in personal mailboxes and written correspondence are generally kept for at least 3 years.
  • Master data: We use the term master data to refer to the basic data that we need, in addition to the contractual data (see below), to process our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information about, for example, your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorisations and consent forms. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters etc.). We receive master data from you yourself (e.g. when making a purchase or as part of a registration), from bodies for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the Internet (websites, social media etc.). We generally keep this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons . For pure marketing and advertising contacts, the period is usually much shorter, usually no more than 2 years since the last contact.
  • Contract data: This is data that arises in connection with the conclusion or processing of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions (e.g. complaints or information about satisfaction, etc.). This also includes health data and information about third parties, e.g. hereditary diseases in the family. We generally collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third party sources (e.g. providers of creditworthiness data) and from publicly accessible sources. We generally keep this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer if this is necessary for reasons of evidence or to comply with legal or contractual requirements or for technical reasons.

Many of the measures described in this para. 3 you disclose to us yourself (e.g. via forms, in the course of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. within the framework of binding protection concepts (legal obligations ). If you wish to conclude contracts with us or claim services, you must also provide us with data, in particular master data, contract data and registration data, as part of your contractual obligation under the relevant contract. When using our website, the processing of technical data is unavoidable.

4. For what purposes do we process your data?

We process your data for the purposes we explain below. Further information for the online area can be found in para. 12 and 13. These purposes or the underlying objectives represent legitimate interests of us and, if applicable, of third parties. You will find further information on the legal basis for our processing in section 5. 5.

We process your data for purposes related to communication with you, in particular to respond to enquiries and to assert your rights (para. 11) and to contact you in the event of queries. For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We keep this data to document our communication with you, for training purposes, for quality assurance and for enquiries.

We process data for the purpose of establishing, managing and processing contractual relationships.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalised advertising on products and services from us and from third parties (e.g. from advertising contractual partners). This may take the form of e.g. newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions etc.) and may also include free benefits (e.g. invitations, vouchers etc.). You can refuse such contacts at any time (see at the end of this section). 4) or refuse or revoke your consent to be contacted for advertising purposes.

We continue to process your data for market research, to improve our services and operations and for product development.

We may also process your data for security and access control purposes.

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations ("Compliance").

We also process data for the purposes of our risk management and as part of prudent corporate governance, including operational organisation and corporate development .

We may process your data for other purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes.

These other purposes include, for example, training and educational purposes, administrative purposes (such as the management of master data, accounting and data archiving and the testing, management and ongoing improvement of IT infrastructure), the protection of our rights (e.g. to enforce claims in or out of court and before authorities at home and abroad or to defend ourselves against claims, for example by preserving evidence, legal clarifications and participation in legal or official proceedings) and the evaluation and improvement of internal processes. We may use recordings of (video) conferences for training and quality assurance purposes. The protection of other legitimate interests is also one of the other purposes that cannot be named exhaustively.

5. On what basis do we process your data?

Insofar as we ask for your consent for certain processing (e.g. for the processing of particularly sensitive personal data, for marketing mailings, for the creation of personalised movement profiles and for advertising control and behavioural analysis on the website), we will inform you separately about the corresponding purposes of the processing. You can withdraw your consent at any time with future effect by written notification (by post) or, where not otherwise stated or agreed, by e-mail to us; you will find our contact details in para. 2. For the revocation of your consent for online tracking, see para. 12. Where you have a user account, revocation or contacting us may also be possible via the relevant website or other service. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purposes to which you originally consented unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Where we do not ask for your consent to process your personal data, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, in particular in order to fulfil the obligations set out in section 4 above. 4 and related objectives described above and to be able to take appropriate action. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognised as a legal basis by the respective applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and in Switzerland). However, this also includes the marketing of our products and services, the interest in better understanding our markets and in managing and further developing our company, including operations, safely and efficiently.

6. Profiling and automated individual decisions

We do not use profiling and automated individual decisions.

7. Who do we disclose your data to?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise in order to protect our legitimate interests and the other interests set out in section 4. 4 we also transfer your personal data to third parties, in particular to the following categories of recipients:

  • Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or in joint responsibility with us or who receive data about you from us in their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurance companies, debt collection companies, credit agencies or address checkers). For information on the service providers used for the website, see section 12. 12.
  • Contractual partners: Contractual partners of ours if this data transfer results from contracts. The recipients also include contractual partners with whom we cooperate or who advertise on our behalf and to whom we therefore transmit data about you for analysis and marketing purposes (these may in turn be service providers, but also e.g. sponsors and providers of online advertising). We require these partners to send you advertising or to play it out based on your data only if you have consented to this (for the online area, cf. para. 12).
  • Authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

We reserve the right to make these disclosures even if they concern secret data (unless we have expressly agreed with you that we will not disclose this data to certain third parties, unless we would be legally obliged to do so). Notwithstanding the above, your data will continue to be subject to adequate data protection even after disclosure in Switzerland and the rest of Europe. For disclosure in other countries, the provisions of para. 8. If you do not wish certain data to be disclosed, please let us know so that we can check whether and to what extent we can accommodate you (section 2). 2).

8. Does your personal data also end up abroad?

As described in para. 7 we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore be processed in Europe as well as in the USA; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj? ), insofar as it is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have consented or if it is a matter of data that you have made generally accessible and you have not objected to its processing.

Please also note that data exchanged via the internet is often routed via third countries. Your data can therefore end up abroad even if the sender and recipient are in the same country.

9. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. Further information on the respective storage and processing duration can be found under the individual data categories in section 3. 3 or for the cookie categories in para. 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymise your data after the storage or processing period has expired as part of our normal processes.

10. How do we protect your data?

We take reasonable security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to protect against the risks of loss, accidental alteration, unauthorised disclosure or access.

11. What rights do you have?

Applicable data protection law grants you the right to object to the processing of your data in certain circumstances, in particular for direct marketing, direct marketing profiling and other legitimate processing interests.

To help you control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

  • The right to request information from us as to whether and which of your data we are processing;
  • the right to have us correct data if it is inaccurate;
  • the right to request the deletion of data;
  • the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
  • the right to withdraw consent insofar as our processing is based on your consent;
  • the right to obtain, on request, further information necessary for the exercise of these rights;

If you wish to exercise any of the above rights against us (or against any of our group companies) , please contact us in writing, at our premises or, unless otherwise stated or agreed, by email; our contact details are set out in Clause. 2. In order for us to be able to exclude any misuse, we must identify you (e.g. with a copy of your identity card, if this is not otherwise possible).

You also have these rights vis-à-vis other bodies that cooperate with us on their own responsibility - please contact them directly if you wish to exercise rights in connection with their processing. You can find details of our important cooperation partners and service providers in section 7. 7Further information can be found in para. 12.

Please note that conditions, exceptions or restrictions apply to these rights under applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us or our data protection officer know (para. 2). In particular, if you are in the EEA, the UK or Switzerland, you also have the right to complain to the data protection supervisory authority in your country. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. You can reach the UK supervisory authority here: https://ico.org.uk/global/contact-us/. You can reach the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/de/home/der-edoeb/kontakt/adresse.html.

12. Do we use online tracking and online advertising techniques?

We use various technologies on our website that enable us and third parties we have engaged to recognise you when you use our website and, in some circumstances, to track you across multiple visits. We inform you about this in this section.

In essence, this is so that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the website and carry out evaluations and personalisations. In doing so, we do not want to infer your identity, even if we can do so insofar as we or third parties engaged by us can identify you through a combination with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognised as an individual visitor each time you access the site, for example by our server (or the servers of the third parties) assigning you or your browser a specific identification number (so-called "cookie").

We use such techniques on our website and allow certain third parties to do so as well. However, depending on the purpose of these techniques, we may ask for your consent before they are used. You can programme your browser to block or deceive certain cookies or alternative techniques, or to delete existing cookies. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the keyword "data protection") or on the websites of the third parties that we list below.

A distinction is made between the following cookies (techniques with comparable functions such as fingerprinting are included here):

  • Necessary cookies: Some cookies are necessary for the website to function as such or for certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond one session (i.e. one visit to the website) if you use this function (e.g. language selected, consent given, the function for automatic login etc.). These cookies have an expiry date of up to 24 months.
  • Performance cookies: In order to optimise our website and corresponding offers and to better adapt them to the needs of users, we use cookies to record and analyse the use of our website, possibly even beyond the session. We do this through the use of third-party analytics services. We have listed these below. Before we use such cookies, we ask for your consent. You can revoke this at any time via the cookie settings here [link]. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.
  • Marketing cookies: We and our advertising partners have an interest in targeting advertising, i.e. displaying it only to those we want to target. We have listed our advertising partners below. For this purpose, we and our advertising partners - if you consent - also use cookies that can be used to record the content accessed or contracts concluded. This allows us and our advertising partners to display advertisements that we think you may be interested in on our website, but also on other websites that display advertisements from us or our advertising partners. These cookies have an expiry date of between a few days and 12 months depending on the situation. If you consent to the use of these cookies, you will be shown appropriate advertising. If you do not consent to these cookies, you will not see less advertising, but simply any other advertising.

In addition to marketing cookies, we use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we can transmit the email addresses of our users, customers and other persons to whom we want to display advertising to the operators of advertising platforms (e.g. social media). If these persons are registered there with the same e-mail address (which the advertising platforms determine through a comparison), the operators show the advertising placed by us to these persons in a targeted manner. The operators do not receive personal e-mail addresses of persons who are not already known. In the case of known email addresses, however, they learn that these persons are in contact with us and which content they have accessed.

We may also integrate further third-party offers on our website, in particular from social media providers. These offers are deactivated by default. As soon as you activate them (e.g. by clicking a button), the corresponding providers can determine that you are on our website. If you have an account with the social media provider, they can assign this information to you and thus track your use of online offers. These social media providers process this data on their own responsibility.

We currently use offers from the following service providers and advertising contract partners (insofar as they use data from you or cookies set on your computer for advertising purposes):

  • Google Analytics: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both "Google"). Google uses performance cookies (see above) to track the behaviour of visitors to our website (duration, frequency of pages viewed, geographical origin of access, etc.) and compiles reports for us on the use of our website on this basis. We have configured the service in such a way that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and thus cannot be traced. We have switched off the "Data sharing" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these individuals. If you consent to the use of Google Analytics, you explicitly agree to such processing, which also includes the transfer of personal data (in particular usage data for the website and app, device information and individual IDs) to the USA and other countries. Information on the data protection of Google Analytics can be found here https://support.google.com/analytics/answer/6004245 and if you have a Google account, you can find further details on processing by Google here https://policies.google.com/technologies/partner-sites?hl=de.
  • We embed videos through a video hoster. The video hosting provider on Vimeo is: Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA. A connection is established to the Vimeo servers. The Vimeo server is informed which of our pages you have visited. Vimeo also obtains your IP address. This also applies if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the USA. If you are logged into your Vimeo account, you enable Vimeo to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your Vimeo account. Further information on data protection can be found in the Vimeo information at: https://vimeo.com/features/video-privacy.

13. What data do we process on our social network pages?

  • Facebook: Here we operate the site https://www.facebook.com/hieronymus.cp The responsible body for operating the platform for users from Europe is Facebook Ireland Ltd, Dublin, Ireland. Their data protection information can be found at www.facebook.com/policy. Some of your data will be transferred to the USA. You can object to advertising here: https://www.facebook.com/settings?tab=ads. With regard to the data collected and processed when visiting our site for the creation of "Page Insights", we are jointly responsible with Facebook Ireland Ltd, Dublin, Ireland. As part of Page Insights, statistics are compiled about what visitors do on our site (comment on posts, share content, etc.). This is described at https://www.facebook.com/legal/terms/information_about_page_insights_data. It helps us understand how our site is used and how we can improve it. We only receive anonymous, aggregated data. We have regulated our responsibilities regarding data protection in accordance with the information on https://www.facebook.com/legal/terms/page_controller_addendum.
  • We maintain a page on the Instagram platform which can be accessed via a link on our website. The provider of the platform is Meta Platforms Ireland Limited, Hanover Reach, 5-7 Hanover Quay, Dublin 2, Ireland.

When you visit our Instagram page, Instagram collects, among other things, your IP address and other information that is present on your PC in the form of cookies. This information is used to provide us, as operators of the Instagram pages, with statistical information about the use of the Instagram page.The data collected about you in this context is processed by Instagram Inc. and may be transferred to countries outside the European Union. What information Instagram receives and how it is used is described in general terms by the provider Meta Platforms in its privacy policy. There you will also find information on how to contact Instagram and on the settings options for advertisements. The privacy policy is available at the following link: https://help.instagram.com/519522125107875. In which way Instagram uses the data from the visit of Instagram pages for its own purposes, to what extent activities on the Instagram page are assigned to individual users, how long Instagram stores this data and whether data from a visit of the Instagram page is passed on to third parties, is not conclusively and clearly stated by Instagram and is not known to us.When accessing an Instagram page, the IP address assigned to your end device is transmitted to Instagram. According to Instagram, this IP address is anonymised (for "German" IP addresses) and deleted after 90 days. Instagram also stores information about its users' end devices (for example, as part of the "login notification" function); this may enable Instagram to assign IP addresses to individual users. If you are currently logged in to Instagram as a user, a cookie with your Instagram identifier is located on your end device. This enables Instagram to track that you have visited this page and how you have used it. This also applies to all other Instagram pages. We, as the provider of the information service, do not collect or process any further data from your use of our service.

14. Can this privacy policy be changed?

This Privacy Policy does not form part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

Last updated: 31.8.2023