Privacy policy

1. What is this privacy notice about?

1st Log AG (hereinafter also “we”, “us”) obtains and processes personal data concerning you or other persons (so-called “third parties”). We use the term “data” here synonymously with “personal data”.

In this privacy notice, we describe what we do with your data when you use https://www.1st-log.com/, https://jobs.1st-log.com/ and our apps (hereinafter collectively “website”), obtain our services or products, are otherwise connected with us under a contract, communicate with us or otherwise deal with us. Where appropriate, we will inform you by timely written notice of additional processing activities not mentioned in this privacy notice. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contract terms, additional privacy notices, forms and notices.

If you transmit or disclose to us data about other persons, such as family members, work colleagues etc., we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also make sure that these third parties have been informed about this privacy notice.

This privacy notice is designed to meet the requirements of the EU General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection (“FADP”). However, whether and to what extent these laws apply depends on the individual case.

2. Who is responsible for processing your data?

The controller under data protection law for the data processing by 1st-log described in this privacy notice is 1st Log AG, In der Euelwies 22, CH-8408 Winterthur (“1st-log”), unless otherwise communicated in individual cases, e.g. in further privacy notices, on forms or in contracts.

You can reach us for your data protection concerns and to exercise your rights under Section 11 as follows:

1st Log AG, In der Euelwies 22, CH-8408 Winterthur

info@1st-log.com

We have appointed the following additional bodies:

Data protection representative in the EU pursuant to Art. 27 GDPR:

SIDD Datenschutz Deutschland UG (haftungsbeschränkt), Schellingstr. 109a, 80798 München

You can also contact these bodies with data protection concerns.

3. What data do we process?

We process various categories of data about you. The most important categories are the following:

Technical data: When you use our website or other electronic offerings, we collect the IP address of your device and other technical data in order to ensure the functionality and security of these offerings. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 12 months. In order to ensure the functionality of these offerings, we may also assign an individual code to you or your device (e.g. in the form of a cookie, see Section 12). The technical data as such does not, in principle, allow any conclusions to be drawn about your identity. In the context of user accounts, registrations, access controls or the performance of contracts, however, it may be linked to other categories of data (and thus possibly to your person).

Registration data: Certain offerings and services (e.g. login areas of our website, newsletter mailings, etc.) can only be used with a user account or a registration, which can be made directly with us or via our external login service providers. In doing so, you must provide us with certain data, and we collect data about the use of the offering or service. Registration data may be generated in connection with access controls to certain facilities; depending on the control system, this may include biometric data. We generally retain registration data for 12 months after the end of the use of the service or the closure of the user account.

Communication data: When you are in contact with us via the contact form, by email, telephone or chat, by letter or by other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. If we record or listen in on telephone calls or video conferences, e.g. for training and quality assurance purposes, we will specifically draw your attention to this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed whether and when such recordings take place, e.g. by a notice during the video conference in question. If you do not want to be recorded, please let us know or end your participation. If we want or need to establish your identity, e.g. in the case of a request for information you have made, a request for media access etc., we collect data to identify you (e.g. a copy of an identity document). We generally retain this data for 12 months from the last exchange with you. This period may be longer where this is necessary for reasons of evidence or to comply with legal or contractual requirements, or where it is technically required. Emails in personal mailboxes and written correspondence are generally retained for at least 10 years. Recordings of (video) conferences are generally retained for 24 months. Chats are generally retained for 2 years.

Master data: Master data is the basic data that, in addition to contract data (see below), we need to handle our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your bank details, your date of birth, the customer history, powers of attorney, signing authorisations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of a business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g. in the context of marketing and advertising, with invitations to events, with vouchers, with newsletters etc.). We receive master data from you yourself (e.g. when you make a purchase or register), from bodies for which you work, or from third parties such as our contractual partners, associations and address brokers, and from publicly accessible sources such as public registers or the internet (websites, social media etc.). We generally retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer where this is necessary for reasons of evidence or to comply with legal or contractual requirements, or where it is technically required. For purely marketing and advertising contacts, the period is usually much shorter, generally no more than 2 years since the last contact.

Contract data: This is data that arises in connection with the conclusion or performance of a contract, e.g. information about contracts and the services to be provided or already provided, as well as data from the run-up to the conclusion of a contract, the information required or used for its performance, and information about reactions (e.g. complaints or information on satisfaction etc.). We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (e.g. providers of credit rating data) and from publicly accessible sources. We generally retain this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer where this is necessary for reasons of evidence or to comply with legal or contractual requirements, or where it is technically required.

Behavioural and preference data: Depending on our relationship with you, we try to get to know you and to tailor our products, services and offerings better to you. For this purpose, we collect and use data about your behaviour (website) and your preferences (if, for example, you tell us that you are interested in a service). We anonymise or delete this data when it is no longer meaningful for the purposes pursued, after 24 months. This period may be longer where this is necessary for reasons of evidence or to comply with legal or contractual requirements, or where it is technically required. We describe how tracking works on our website in Section 12.

Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data arises (such as files, evidence etc.) that may also relate to you. We may also collect data for reasons of health protection (e.g. as part of protection concepts). We may receive or produce photos, videos and sound recordings in which you may be identifiable (e.g. at events, through security cameras etc.). We may also collect data about who enters certain buildings when, or has corresponding access rights (including in access controls, based on registration data or visitor lists etc.), who participates in events or campaigns (e.g. competitions) when, or who uses our infrastructure and systems when. The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras, and generally a few weeks for data for contact tracing, through visitor data, which is generally retained for 3 months, up to reports on events with pictures, which may be retained for a few years or longer.

You provide us with much of the data mentioned in this Section 3 yourself (e.g. via forms, in the course of communicating with us, in connection with contracts, when using the website etc.). You are not obliged to do so, subject to individual cases, e.g. in the context of binding protection concepts (legal obligations). If you wish to conclude contracts with us or use services, you must also provide us with data as part of your contractual obligation under the relevant contract, in particular master, contract and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data. With regard to behavioural and preference data, however, you generally have the option to object or not to give your consent.

Where this is not unlawful, we also take data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, the media or the internet including social media) or receive data from authorities and from other third parties (such as credit agencies, address brokers, associations, contractual partners, internet analytics services etc.).

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for the online area can be found in Sections 12 and 13. These purposes and the objectives underlying them represent legitimate interests of ours and, where applicable, of third parties. You will find further information on the legal bases of our processing in Section 5.

We process your data for purposes related to communicating with you, in particular to respond to enquiries and to the exercise of your rights (Section 11), and to contact you in the event of queries. For this purpose, we use in particular communication data and master data and, in connection with offerings and services you use, also registration data. We retain this data to document our communication with you, for training purposes, for quality assurance and for follow-up enquiries.

We process data for the establishment, administration and performance of contractual relationships.

We process data for marketing purposes and relationship management, e.g. to send our customers and other contractual partners personalised advertising for products and services from us and from third parties (e.g. from advertising partners). This may take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have your contact information, but also in the context of individual marketing campaigns (e.g. events, competitions etc.), and may also include free services (e.g. invitations, vouchers etc.). You can refuse such contacts at any time (see the end of this Section 4) or refuse or withdraw your consent to being contacted for advertising purposes. With your consent, we can target our online advertising on the internet more specifically to you (see Section 12).

We further process your data for market research, to improve our services and our operations, and for product development.

We may also process your data for security purposes and for access control.

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations (“compliance”).

We also process data for the purposes of our risk management and as part of prudent corporate governance, including business organisation and corporate development.

We may process your data for further purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes.

5. On what basis do we process your data?

Where we ask for your consent for certain processing (e.g. for the processing of sensitive personal data, for marketing mailings, for the creation of personalised movement profiles and for advertising management and behavioural analysis on the website), we will inform you separately about the corresponding purposes of the processing. You can withdraw your consent at any time with effect for the future by written notice (by post) or, unless otherwise stated or agreed, by email to us; you will find our contact details in Section 2. For the withdrawal of your consent to online tracking, see Section 12. Where you have a user account, a withdrawal or contact with us may also be possible via the relevant website or other service. As soon as we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or with the entity you represent), or that we or third parties have a legitimate interest in it, in particular in order to pursue the purposes described above in Section 4 and the related objectives and to be able to carry out corresponding measures. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognised as a legal basis by the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and in Switzerland). This also includes the marketing of our products and services, the interest in better understanding our markets and in managing and developing our company, including its operations, safely and efficiently.

If we receive sensitive data (e.g. health data, information on political, religious or philosophical views, or biometric data for identification purposes), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes because the processing is necessary for possible litigation or for the enforcement or defence of legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately where necessary.

6. What applies to profiling and automated individual decisions?

We may automatically evaluate certain of your personal characteristics for the purposes stated in Section 4 on the basis of your data (Section 3) (“profiling”) if we want to determine preference data, but also in order to detect risks of misuse and security risks, to carry out statistical analyses or for operational planning purposes. For the same purposes, we may also create profiles, i.e. we may combine behavioural and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your various interests and other characteristics.

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or of profiling. Where these may produce legal effects or significant disadvantages for you, we generally provide for a manual review.

7. Who do we disclose your data to?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests and the other purposes listed in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us, or who receive data about you from us under their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurers, debt collection agencies, credit agencies or address verification providers). This may also include health data. For the service providers used for the website, see Section 12. Our key service providers in the IT area are Microsoft, OVH and Hetzner.

Contractual partners including customers: This refers first of all to our customers (e.g. service recipients) and other contractual partners, because this transfer of data results from these contracts. If you yourself work for such a contractual partner, we may also transfer data about you to that partner in this context. Recipients also include contractual partners with whom we cooperate or who advertise for us and to whom we therefore transfer data about you for analysis and marketing purposes (these may in turn be service recipients, but also, for example, sponsors and providers of online advertising). We require these partners to send you advertising or display advertising based on your data only if you have consented to this (for the online area, see Section 12).

Authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. This may also include health data. The authorities process data about you that they receive from us under their own responsibility.

Other persons: This refers to other cases where the involvement of third parties results from the purposes set out in Section 4, e.g. service recipients, media and associations in which we participate, or if you are part of one of our publications.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the processing by certain third parties (e.g. IT providers), but not that of other third parties (e.g. authorities, banks etc.).

We also allow certain third parties to collect personal data from you on our website and at our events (e.g. media photographers, providers of tools that we have integrated into our website etc.). Insofar as we are not involved in a decisive way in these data collections, these third parties are solely responsible for them. For concerns and to exercise your data protection rights, please contact these third parties directly. See Section 12 for the website.

8. Does your personal data also go abroad?

As explained in Section 7, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore be processed both in Europe and in the USA; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless the recipient is already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption. An exemption may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interest, or if the performance of a contract requires such disclosure, if you have consented, or if the data concerned has been made generally accessible by you and you have not objected to its processing.

Please also note that data exchanged via the internet is often routed through third countries. Your data may therefore also go abroad even if the sender and recipient are located in the same country.

9. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require, or as long as storage is technically necessary. Further information on the respective storage and processing periods can be found under the individual data categories in Section 3 and under the cookie categories in Section 12. Unless legal or contractual obligations prevent this, we delete or anonymise your data after the storage or processing period has expired as part of our usual processes.

10. How do we protect your data?

We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counter the risks of loss, accidental alteration, unwanted disclosure or unauthorised access.

11. What rights do you have?

Under certain circumstances, the applicable data protection law grants you the right to object to the processing of your data, in particular processing for the purposes of direct marketing, profiling carried out for direct advertising and other legitimate interests in the processing.

To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

• The right to request information from us as to whether and which data we process about you;
• the right to have us correct data if it is inaccurate;
• the right to request the erasure of data;
• the right to request that we hand over certain personal data in a commonly used electronic format or transfer it to another controller;
• the right to withdraw consent, insofar as our processing is based on your consent;
• the right to receive, on request, further information necessary to exercise these rights;
• the right, in the case of automated individual decisions (Section 6), to express your point of view and to request that the decision be reviewed by a natural person.

If you wish to exercise the above rights against us, please contact us in writing, in person at our premises or, unless otherwise stated or agreed, by email; you will find our contact details in Section 2. In order to rule out misuse, we must identify you (e.g. with a copy of your identity document, unless this is possible in another way).

Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly where applicable.

If you do not agree with the way we handle your rights or data protection, please let us know (Section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority of your country. A list of the authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. You can reach the supervisory authority of the United Kingdom here: https://ico.org.uk/global/contact-us/. You can reach the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/de/home/der-edoeb/kontakt/adresse.html.

12. Do we use online tracking and online advertising techniques?

On our website, we use various techniques with which we and third parties engaged by us can recognise you during your use and, under certain circumstances, also track you across several visits. We inform you about this in this section.

Essentially, this is about us being able to distinguish your access (via your system) from the access of other users, so that we can ensure the functionality of the website and carry out analyses and personalisations. We do not intend to infer your identity, even if we can do so, insofar as we or third parties engaged by us can identify you by combining the data with registration data. Even without registration data, however, the techniques used are designed in such a way that you are recognised as an individual visitor each time you access a page, for example by our server (or the servers of the third parties) assigning a specific identification number to you or your browser (a so-called “cookie”).

We use such techniques on our website and allow certain third parties to do so as well. Depending on the purpose of these techniques, however, we ask for your consent before they are used. You can also extend your browser with software that blocks tracking by certain third parties. Further information on this can be found on the help pages of your browser (usually under the keyword “privacy”) or on the websites of the third parties listed below.

The following cookies are distinguished (techniques that work in a comparable way, such as fingerprinting, are also included here):

Necessary cookies: Some cookies are necessary for the functioning of the website as such or for certain functions. For example, they ensure that you can move between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies exist only temporarily (“session cookies”). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries you have made beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, consent given, the function for automatic login etc.). These cookies have an expiry date of up to 24 months.

Performance cookies: In order to optimise our website and related offerings and to better adapt them to the needs of users, we use cookies to record and analyse the use of our website, possibly also beyond the session. We do this by using analytics services from third-party providers, which we have listed below. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.

Marketing cookies: We and our advertising partners have an interest in targeting advertising at specific audiences, i.e. displaying it as far as possible only to those we want to address. We have listed our advertising partners below. For this purpose, we and our advertising partners – if you consent – also use cookies with which the content accessed or the contracts concluded can be recorded. This enables us and our advertising partners to display advertising that we can assume will interest you, on our website but also on other websites that display advertising from us or our advertising partners. Depending on the situation, these cookies have an expiry period of a few days up to 12 months. If you consent to the use of these cookies, you will be shown corresponding advertising. If you do not consent to these cookies, you will not see less advertising, but simply any other advertising.

We may also integrate further third-party offerings on our website, in particular from social media providers. These offerings are deactivated by default. As soon as you activate them (e.g. by clicking a switch), the corresponding providers can determine that you are on our website. If you have an account with the social media provider, it can assign this information to you and thus track your use of online offerings. These social media providers process this data under their own responsibility.

We currently use offerings from the following service providers and advertising partners (insofar as they use data from you or cookies set on your device for advertising management):

Google Analytics: Google Ireland (based in Ireland) is the provider of the “Google Analytics” service and acts as our processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Using performance cookies (see above), Google tracks the behaviour of visitors to our website (duration, frequency of pages accessed, geographical origin of access etc.) and on this basis prepares reports for us on the use of our website. We have configured the service so that the IP addresses of visitors are truncated by Google in Europe before being forwarded to the USA and therefore cannot be traced back. We have switched off the “data sharing” and “Signals” settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google may draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these persons. If you consent to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (in particular usage data for the website and app, device information and individual IDs) to the USA and other countries. Information on data protection at Google Analytics can be found here https://support.google.com/analytics/answer/6004245, and if you have a Google account, you can find further information on processing by Google here https://policies.google.com/technologies/partner-sites?hl=de.

13. What data do we process on our pages in social networks?

We may operate pages and other online presences (“fan pages”, “channels”, “profiles” etc.) on social networks and other platforms operated by third parties and collect there the data about you described in Section 3 and below. We receive this data from you and from the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presences and link this data with other data about you known to the platforms (e.g. about your behaviour and your preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to manage their platforms (e.g. which content they show you).

We process this data for the purposes described in Section 4, in particular for communication, for marketing purposes (including advertising on these platforms, see Section 12) and for market research. Information on the corresponding legal bases can be found in Section 5. We may ourselves disseminate content published by you (e.g. comments on an announcement) (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the terms of use (e.g. inappropriate comments).

For further information on the processing by the operators of the platforms, please refer to the privacy notices of the platforms. There you will also find out in which countries they process your data, which rights of access, erasure and other data subject rights you have, and how you can exercise them or obtain further information. We currently use the following platforms:

Instagram: We operate the following page here: https://www.instagram.com/1stlog_ag/. For users from Europe, the entity responsible for operating the platform is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Its privacy notice is available at https://privacycenter.instagram.com/policy/. Some of your data is transferred to the USA in the process. With regard to the data collected and processed when you visit our page for the creation of “Instagram Insights”, we are jointly responsible with Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. As part of Page Insights, statistics are created about what visitors do on our page (commenting on posts, sharing content, etc.). We have regulated our responsibilities regarding data protection in accordance with the information at www.facebook.com/legal/terms/page_controller_addendum.

14. Can this privacy notice be changed?

This privacy notice is not part of a contract with you. We may amend this privacy notice at any time. The version published on this website is the current version.

Last updated: 15 January 2024