Terms of Use and Privacy Policy

Copyright
The content and structure of the Wipf AG website are copyright-protected. The reproduction of information or data, especially the duplication of text in whole or in part, or of images, is prohibited without the prior consent of Wipf AG. 

Limitation of liability
Wipf AG reserves the right to amend or complement the pages of this website at any time without prior notification.

Third-party websites
The Wipf AG website may contain links to the websites of other providers. Wipf AG cannot assume liability for the content of websites that are accessible with links of this kind.

Privacy Policy

1. What is this privacy policy about?

Wipf AG (hereinafter also "we", "us") obtains and processes personal data relating to you or also to other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data".

In this Privacy Policy, we describe what we do with your data when you use www.wipf.ch (the "Website"), obtain our services or products, otherwise interact with us under a contract, communicate with us, or otherwise deal with us. Where appropriate, we will notify you by timely written notice of additional processing activities not mentioned in this Privacy Statement. In addition, we may inform you separately about the processing of your data, for example, in consent forms, contract terms, additional privacy statements, forms and notices.

If you transmit or disclose data about other persons, such as family members, work colleagues, etc., we assume that you are authorized to do so and that this data is correct. By submitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Data Protection Act ("DPA") and the revised Swiss Data Protection Act ("revDSG"). However, whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for the processing of your data?

Wipf AG, Industriestrasse 29, 8604 Volketswil, Switzerland (the "Wipf AG") is responsible for the data processing activities of Wipf AG described in this Privacy Policy, unless otherwise communicated in individual cases.

You can contact us for your data protection concerns and to exercise your rights under Section 10 as follows:

Wipf AG
Industriestrasse 29
CH-8604 Volketswil
datenschutzbeauftragter@wipf.ch

3. What data do we process?

We process different categories of data about you. The main categories are as follows:

• Technical Data: When you use our website or other electronic offerings (e.g., free Wi-Fi), we collect the IP address of your terminal device and other technical data to ensure the functionality and security of these offerings. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 6 months. In order to ensure the functionality of these offers, we may also assign an individual code to you or your end device (e.g. in the form of a cookie, see section 11). The technical data in itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).
• Registration data: Certain offers, e.g., of contests and services (e.g., login areas of our website, newsletter delivery, free WLAN access, blog subscription, etc.) can only be used with a user account or registration, which can be made directly with us or via our external login service providers. In doing so, you must provide us with certain data, and we collect data about the use of the offer or service. Registration data may be required for access controls to certain facilities. We generally retain registration data for 12 months after the end of the use of the service or the termination of the user account.
• Communication Data: If you contact us via the contact form, e-mail, telephone, letter or other means of communication, we collect the data exchanged between you and us, including your contact data and the marginal data of the communication. If we record or listen to telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will draw your attention to this fact. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed whether and when such recordings take place, e.g. by a display during the video conference in question. If you do not wish to be recorded, please inform us of this or end your participation. If you simply do not want your image to be recorded, please turn off your camera. If we want or need to establish your identity, e.g. in the case of a request for information, etc., we collect data to identify you (e.g. a copy of an ID card). We usually keep this data for 6 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. E-mails in personal mailboxes and written correspondence are generally retained for at least 10 years. Recordings of (video) conferences are generally retained for 10 years.
• Master Data: We define master data as the basic data that we require, in addition to contractual data (see below), for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information about, for example, your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or are working for one (e.g. as a contact person of the business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you yourself (e.g. when making a purchase or as part of a registration), from bodies for which you work, or from third parties such as our contractual partners, associations and address dealers, and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.). We generally retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is required for reasons of proof or to comply with legal or contractual requirements or if it is technically necessary. For pure marketing and advertising contacts, the period is usually much shorter, usually no more than 2 years since the last contact.
• Contract data: This is data that accrues in connection with the conclusion or processing of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions. We generally collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly available sources. We generally retain this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer insofar as this is necessary for reasons of proof or to comply with legal or contractual requirements or is technically required.
• Behavioral and preference data: Depending on our relationship with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behavior and preferences. We do this by evaluating information about your behavior in our area, and we may also supplement this information with information from third parties - including publicly available sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. when you use our services), or we obtain this data by recording your behavior (e.g. how you navigate on our website). We anonymize or delete this data when it is no longer meaningful for the purposes pursued, which may be between 2-3 weeks and 24 months (for product and service preferences) depending on the nature of the data. This period may be longer to the extent necessary for evidentiary reasons or to comply with legal or contractual requirements, or for technical reasons. We describe how tracking works on our website in Section 11.
• Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data is collected (such as files, evidence, etc.), which may also relate to you. We may also collect data for health protection reasons (e.g. as part of protection concepts). We may receive or produce photos, videos and sound recordings in which you may be recognizable (e.g. at events, through security cameras, etc.). We may also collect data about who enters certain buildings or has corresponding access rights and when (including in the case of access controls, based on registration data or visitor lists, etc.), who participates in events or campaigns and when, or who uses our infrastructure and systems and when. The retention period of this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and usually a few weeks for contact tracing data, to visitor data that is usually kept for 12 months, to reports on events with pictures that can be kept for a few years or longer.

You disclose much of the data mentioned in this section 3 yourself (e.g. via forms, in the course of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, with the exception of individual cases, e.g. in the context of binding protection concepts (legal obligations). If you wish to conclude contracts with us or claim services, you must also provide us with data, in particular master data, contract data and registration data, as part of your contractual obligation in accordance with the relevant contract. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data. In the case of behavioral and preference data, however, you generally have the option of objecting or not giving your consent.

Insofar as this is not inadmissible, we also take data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, the media or the Internet including social media) or receive data from other companies within our group, from public authorities and from other third parties (such as credit agencies, associations, contractual partners, Internet analysis services, etc.).

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for the online area can be found in sections 11 and 12. These purposes or the objectives on which they are based represent legitimate interests of us and, if applicable, of third parties. You will find further information on the legal basis for our processing in section 5.

We process your data for purposes related to communication with you, in particular to respond to inquiries and assert your rights (section 10) and to contact you in the event of queries. For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We retain this data to document our communication with you, for training purposes, for quality assurance and for follow-up inquiries.

We process data for the purpose of establishing, managing and processing contractual relationships.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalized advertising on products and services from us and from third parties. This may take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may also include free benefits (e.g. invitations, vouchers, etc.). You can refuse such contacts at any time (see at the end of this section 4) or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 11).

We also process your data for market research, to improve our services and our operations, and for product development.

We may also process your data for security and access control purposes.

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations ("Compliance").

We also process data for the purposes of our risk management and prudent corporate governance, including business organization and development.

We may process your data for other purposes, such as our internal operations and administration or for training and quality assurance purposes.

5. On what basis do we process your data?

If we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You may revoke your consent at any time with future effect by notifying us in writing (by post) or, where not otherwise specified or agreed, by e-mail; you will find our contact details in Section 2. For revocation of your consent for online tracking, see Section 11. Where you have a user account, revocation or contact with us may also be carried out via the relevant website or other service, if applicable. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent will not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Where we do not ask you for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, so in particular to pursue the purposes and related objectives described above under section 4 and to be able to implement appropriate measures. Our legitimate interests also include compliance with legal requirements, to the extent that this is not already recognized as a legal basis by the applicable data protection law in each case (e.g., in the case of the GDPR, the law in the EEA and Switzerland).

If we receive sensitive data (e.g. health data, information on political, religious or ideological views, or biometric data for identification purposes), we may also process your data based on other legal grounds, e.g. in the event of disputes due to the need for processing for a possible lawsuit or the enforcement or defense of legal claims. In individual cases, other legal grounds may come into play, which we will communicate to you separately where necessary.

6. Who do we disclose your data to?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

- Service providers: we work with service providers in Germany and abroad who process data about you on our behalf or in joint responsibility with us or receive data about you from us in their own responsibility.

- Contractual partners including customers: First of all, this refers to customers (e.g. service recipients) and other contractual partners of ours, because this data transfer results from these contracts. You receive, for example, registration data for issued invitations, etc. If you work for such a contractual partner yourself, we may also transfer data about you to them in this context. Recipients further include contractual partners with whom we cooperate or who advertise on our behalf and to whom we therefore transfer data about you for analysis and marketing purposes (these may in turn be service providers, but also, for example, providers of online advertising).

- Authorities: We may disclose personal data to offices, courts and other authorities in Germany and abroad if we are legally obliged or authorized to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us under their own responsibility.

- Other persons: This refers to other cases where the involvement of third parties arises from the purposes set out in section 4, e.g. service recipients, media and associations in which we participate or if you are part of one of our publications.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

7. Do your personal data also end up abroad?

As explained in section 6, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore also be processed in Europe; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exception. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have given your consent or if it is a matter of data that you have made generally accessible and you have not objected to its processing.

Please also note that data exchanged via the Internet is often routed via third countries. Your data may therefore end up abroad even if the sender and recipient are in the same country.

8. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. You will find further information on the respective storage and processing periods for the individual data categories in section 3 and for the cookie categories in section 11. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our normal processes.

9. How do we protect your data?

We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to protect it against the risks of loss, accidental loss or alteration, unauthorized disclosure or access.

10. What rights do you have?

Under certain circumstances, applicable data protection law grants you the right to object to the processing of your data, in particular for the purposes of direct marketing, profiling for direct advertising and other legitimate interests in processing.

To help you control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

- The right to request information from us as to whether and which of your data we are processing;

- the right to have us correct data if it is inaccurate;

- the right to demand that we delete data;

- the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;

- the right to withdraw consent, insofar as our processing is based on your consent;

- The right to obtain, on request, further information necessary for the exercise of these rights;

If you wish to exercise any of the above rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by email; you will find our contact details in section 2. In order for us to rule out abuse, we must identify you (e.g. with a copy of your ID card, unless otherwise possible).

Please note that these rights are subject to conditions, exceptions or restrictions under applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please inform us or our data protection officer (section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to complain to the data protection supervisory authority in your country. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. The supervisory authority of the United Kingdom can be reached here: https://ico.org.uk/global/contact-us/. The Swiss supervisory authority can be reached here: https://www.edoeb.admin.ch/edoeb/de/home/der-edoeb/kontakt/adresse.html.

12. Do we use online tracking techniques?

We use a variety of technologies on our website that allow us and third parties we engage to recognize you when you use our site and, in some circumstances, to track you across multiple visits. In this section, we inform you about them.

In essence, this is so that we can distinguish access by you (via your system) from access by other users, so that we can ensure the functionality of the website and carry out evaluations and personalizations. We do not want to infer your identity, even if we can, as far as we or third parties engaged by us can identify you by combination with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognized as an individual visitor each time you visit the site, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called "cookie").

We use such techniques on our website and allow certain third parties to do so as well. You can program your browser to block, deceive, or delete existing cookies from certain cookies or alternative techniques. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the heading "Privacy") or on the websites of the third parties that we list below.

The following cookies are distinguished (techniques with comparable functionalities such as fin-gerprinting are included here):

- Necessary cookies: Some cookies are necessary for the functioning of the website as such or certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not function. Other cookies are necessary to enable the server to store decisions or entries made by you beyond one session (i.e. one visit to the website) if you request this function (e.g. language selected, consent given, automatic login function, etc.). These cookies have an expiration date of up to 24 months.

- Performance cookies: In order to optimize our website and corresponding offers and better adapt them to the needs of users, we use coo-kies to record and analyze the use of our website, possibly even beyond the session. We do this through the use of third-party analytics services. We have listed these below. Performance cookies also have an expiration date of up to 24 months. Details can be found on the websites of the third-party providers.

We currently use offers from the following service providers and advertising partners (insofar as they use data from you or cookies set on your computer for advertising purposes):

- Google Analytics: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both "Google"). Google uses performance cookies (see above) to track the behavior of visitors to our website (duration, frequency of pages viewed, geographical origin of access, etc.) and creates reports for us on this basis about the use of our website. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and thus cannot be traced. We have switched off the "Data forwarding" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these individuals. If you agree to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (in particular usage data for the website and app, device information and individual IDs) to the USA and other countries. Information on the data protection of Google Analytics can be found here https://support.google.com/analytics/answer/6004245 and if you have a Google account, you can find further information on processing by Google here https://policies.google.com/technologies/partner-sites?hl=de.

12. What data do we process on our pages on social networks?

We may operate pages and other online presences ("fan pages", "channels", "profiles", etc.) on social networks and other platforms operated by third parties and collect the data about you described in section 3 and below. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g., when you communicate with us, comment on our content or visit our presence). At the same time, the Platforms evaluate your use of our online presences and link this data with other data about you known to the Platforms (e.g., about your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g., to personalize advertising) and to control their platforms (e.g., what content they show you).

We currently operate the following social media platforms:

- Facebook: https://www.facebook.com/people/Wipf-AG/100063909138656

- Linkedin: https://ch.linkedin.com/company/wipf-ag

- Instagram: https://www.instagram.com/wipf_ag/

- Youtube: https://www.youtube.com/@wipfagflexibleverpackungen4451

13. Can this privacy policy be changed?

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

Last update: September 1, 2023