Privacy policy of Magazine zum Globus AG

1. What is this privacy policy about?

Magazine zum Globus AG (hereinafter also "we", "us") collects and processes personal data concerning you or other persons ("third parties"). We use the term "data" here synonymously with "personal data".

The term "personal data" refers to data that relates to a specific or identifiable person, i.e. it is possible to draw conclusions about their identity on the basis of the data itself or with corresponding additional data. "Particularly sensitive personal data" is a category of personal data that enjoys special protection under current data protection law. Personal data requiring special protection includes, for example, health data, information on religious or ideological beliefs, biometric data for identification purposes and information on trade union membership. In section 3 you will find information on the data that we process within the scope of this privacy policy. "Processing" means any handling of personal data, e.g. obtaining, storing, using, adapting, disclosing and deleting.

In this privacy policy, we describe how we process your data in connection with our business activities (retail trade, services such as catering, management and rental of properties, etc.), i.e. what we do with your data when you visit our department stores or our online shop, use our websites, apps and other applications (hereinafter referred to collectively as the "website"), use our products, services and other offers (e.g. create a user account and use our services).(e.g. creating a user account and participating in the Pluscard bonus programme, ordering fashion items or a Cadeau Card, registering for our newsletter or participating in events, competitions, contests and other events, or courses, seminars or training sessions) or otherwise interacting with us, e.g. within the scope of a contract, communicating with us or otherwise dealing with us.

In (and around) our department stores and in the online shop, we also offer products, services and other offers from third parties, i.e. companies or partners with whom we work (in their name or in our name). In this context, data is disclosed to the partners (directly or indirectly, for example via our service providers or our partners' service providers) (see section 8 ) and we may also receive data (see section 4).

If necessary, we will inform you in writing in good time about additional processing activities not mentioned in this privacy policy. We may also inform you separately about the processing of your data, e.g. in declarations of consent, contractual conditions, conditions of participation, additional data protection declarations such as the data protection declaration for job applicants, forms and notices.

If you transmit or disclose data to us about other persons, such as persons living in the same household (to whom you enable the use of your Pluscard with payment function as an additional card, for example), family members, work colleagues, etc., we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed of this data protection declaration.

This privacy policy is based on the Swiss Data Protection Act ("DPA"). It applies both to the processing of data that has already been collected and to data that we will collect in the future.

2. Who is responsible for processing your data?

Magazine zum Globus AG, Schweizergasse 12, 8001 Zurich, is responsible under data protection law for the data processing described in this privacy policy, unless otherwise communicated in individual cases (e.g. in other privacy policies, on forms or in contracts n).

For each data processing operation, there are one or more bodies that are responsible for ensuring that the processing complies with the requirements of data protection law. This body is called the controller. It is responsible, for example, for responding to requests for information (section 12 ) or for ensuring that personal data is secured and not used in an unauthorised manner.

Other bodies may also be jointly responsible for the data processing described in this privacy policy if they are involved in deciding on the purpose or organisation. If you would like information about the individual responsible parties for specific data processing, you are welcome to request information from us within the scope of the right to information (section 12 ). Magazine zum Globus AG remains your primary contact, even if there are other joint controllers.

In sections 3, 4, 8 and 13 you will find further information on third parties with whom we work and who are responsible for their processing. If you have any questions or wish to exercise your rights vis-à-vis these third parties, please contact them directly.

You can contact us for your data protection concerns and to exercise your rights in accordance with section 12 as follows

Magazine zum Globus AG Schweizergasse 12 8001 Zurich E-mail: datenschutz@globus.ch

3. What data do we process?

We process various categories of data about you. The most important categories are as follows:

Technical data: When you use our website or other electronic services (e.g. WLAN), we collect the IP address of your end device and other technical data to ensure the functionality and security of these services. This data also includes logs in which the use of our systems is recorded. To ensure the functionality of these services, we may also assign you or your end device a personalised code (e.g. in the form of a cookie, see section13 ). The technical data itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).

The technical data includes the IP address and information about the operating system of your end device, the date, region and time of use as well as the type of browser you use to access our electronic offers. This can help us to transmit the correct formatting of the website. Although we know from the IP address which provider you are using to access our website (and therefore also the region), we are generally unable to deduce who you are from this. This changes if, for example, you create a user account (and participate in the Pluscard bonus programme), because personal data can then be linked to technical data (e.g. we can see which browser you use to access an account via our website). Examples of technical data include protocols ("logs") that are generated in our systems (e.g. the log of user logins on our website).

Registration data: Certain offers (e.g. participation in the Pluscard bonus programme or competitions) or the use of certain services (e.g. login areas of our website, newsletter dispatch, WLAN access etc.) can only be used with a user account or registration, which can be done directly with us or via an external login service provider, for example. In doing so, you must provide us with certain data and we collect data on the use of the offer or service. Under certain circumstances, we may also transmit registration data to contractual partners or receive such data from them. Registration data may be collected during access controls to certain systems; depending on the control system, biometric data may also be collected.

Registration data includes the information you provide when you create an account on our website (e.g. username, password, name, email) and register for the Pluscard bonus programme (e.g. name, home address, date of birth, email). However, the registration data also includes the data that we may require from you before you can make use of certain (free) services, such as our WLAN service (e.g. name, e-mail and telephone number), the redemption of vouchers (e.g. name, address, contact details, Pluscard number if applicable, time of redemption) or our newsletter. As part of access controls, we may need to register you with your data (access codes in badges, biometric data for identification) (see the "Other data" category).

Communication data: If you are in contact with us via the contact form, by e-mail, telephone, messenger services or chat, by letter or other means of communication (e.g. posts and comments on our website), we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. If we record or listen in on telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will make you aware of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed if and when such recordings take place, e.g. by a display during the video conference in question. If you do not wish to be recorded, please let us know or end your participation. If you simply do not wish your image to be recorded, please switch off your camera. If we want or need to establish your identity or age, e.g. if you request information, purchase alcoholic products, etc., we will collect data to identify you and/or verify your age (e.g. a copy of an ID card).

Communication data includes your name and contact details, the manner, place and time of communication and, as a rule, its content (i.e. the content of e-mails, letters, chats, telephone notes, etc.). This data may also contain information about third parties. For the purpose of identification/age verification, we may also process your ID number, or a password set by you.

Master data: Master data refers to the basic data that we require in addition to the contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details, Pluscard number and information e.g. about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorisations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you (e.g. when you make a purchase or register), from organisations for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). We may also process health data and information about third parties as part of master data. We may also collect master data from our shareholders and investors.

Master data includes, for example, data such as name, address, email address, telephone number and other contact details, gender, date of birth, nationality, details of associated persons, websites, social media profiles, photos and videos, copies of ID cards; furthermore details about your relationship with us (customer, supplier, visitor, service recipient, etc.), details of your status with us and information about your relationship with us. We also collect information about your relationship with us (customer, supplier, visitor, service recipient, etc.), information about your status with us, allocations, classifications and distribution lists, information about our interactions with you (possibly a history of these with corresponding entries), reports (e.g. from the media) or official documents (e.g. extracts from the commercial register, authorisations, etc.) that relate to you. We collect payment details such as your bank details, account number and card details. Consent or blocking notices are also part of the master data, as is information about third parties, e.g. contact persons, recipients of services, advertising recipients or representatives.

In the case of contact persons and representatives of our customers, suppliers and partners, we process master data such as name and address, information on role, function in the company, qualifications and, if applicable, information on superiors, employees and subordinates and information on interactions with these persons.

Master data is not collected comprehensively for all contacts. Which data we collect in detail depends in particular on the purpose of the processing.

Contract data: This is data that arises in connection with the conclusion or processing of a contract, e.g. information about contracts and the products, services or other offers used (in the case of a purchase, e.g. date, place, time, item, price of a purchase, means of payment and delivery method), as well as data from the run-up to the conclusion of a contract, the information about reactions required or used for processing (e.g. complaints or information about satisfaction, etc.). This may also include health data and information about third parties. We generally collect this data from you, from contractual partners and from third parties involved in the fulfilment of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources.

Contract data includes information about the conclusion of the contract, about your contracts, e.g. type and date of conclusion of the contract, information from the application process (such as an application for our products or services) and information about the contract in question (e.g. its duration) and the processing and administration of the contracts (e.g. information in connection with invoicing, customer service, support with technical matters and the enforcement of contractual claims). Contract data also includes information on defects, complaints and adjustments to a contract, as well as information on customer satisfaction, which we can collect e.g. by means of surveys. Contract data also includes financial data such as information on creditworthiness (i.e. information that allows conclusions to be drawn about the likelihood of claims being settled), reminders and debt collection. We receive some of this data from you (e.g. when you make payments), but also from credit agencies and debt collection agencies and from publicly accessible sources (e.g. a commercial register).

Behavioural and preference data: Depending on the relationship we have with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behaviour and preferences. We do this by evaluating information about your behaviour in our area, and we may also supplement this information with data from third parties, including from publicly accessible sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. if you make use of our services). We can also obtain such data by recording your behaviour (e.g. how you navigate our website).

Behavioural data is information about certain actions, e.g. about your reaction to electronic messages (e.g. whether and when you opened an email) or about your location and about your interaction on our website (items viewed, search terms and results, watch lists, shopping basket ordered and abandoned, sizes, ratings and comments submitted, etc.) or with our social media profiles, or about your participation in the Pluscard bonus programme, competitions, contests and other events, or courses, seminars or training sessions. For example, we may collect your location data when you use our website.

Preference data provides us with information about your needs, which products or services might be of interest to you or when and how you are likely to react to messages from us. We obtain this information from the analysis of existing data, such as behavioural data, so that we can get to know you better, tailor our advice and offers more precisely to you and generally improve our offers. In order to improve the quality of our analyses, we can link this data with other data that we also obtain from third parties such as address dealers, public authorities and publicly accessible sources such as the Internet.

Behavioural and preference data can be evaluated on a personal basis (e.g. to show you personalised advertising), but also on a non-personal basis (e.g. for market research or product development). Behavioural and preference data can also be combined with other data (e.g. movement data can be used for contact tracing as part of a health protection concept).

Other data: We also collect data from you in other situations. In connection with official or legal proceedings, for example, data is collected (such as files, evidence, etc.), which may also relate to you. We may also collect data for health protection reasons (e.g. as part of protection concepts). We may receive or produce photos, videos and audio recordings in which you may be recognisable (e.g. at events, through security cameras, etc.). We may also collect data about who enters certain buildings and when, or who has the corresponding access rights (including during access controls, based on registration data or visitor lists, etc.), who takes part in events or campaigns (e.g. competitions) and when, or who uses our infrastructure and systems and when. Finally, we may collect and process data about our shareholders and other investors; in addition to master data, this includes information for the relevant registers, regarding the exercise of their rights and the organisation of events (e.g. general meetings).

Particularly sensitive personal data: The categories of data mentioned in this section 3 may also include particularly sensitive personal data, depending on the circumstances. As a rule, we only process particularly sensitive personal data if it is necessary in connection with our offers, if you have provided us with this data yourself (e.g. if you inform us of allergies and intolerances or health complaints following the consumption or use of a product) or if you have consented to the processing. We may also process particularly sensitive personal data if this is necessary to protect our rights or to comply with (domestic or foreign) laws, if the data in question has been (obviously) publicly disclosed by the data subject or if the law otherwise authorises the processing.

4. Where does the data come from?

You provide us with much of the data mentioned in section3 yourself (e.g. via forms, as part of communication with us, in connection with contracts, when creating a user account, when using the Pluscard, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. as part of binding protection concepts (legal obligations). If you wish to conclude contracts with us or make use of services, you must also provide us with data as part of your contractual obligation in accordance with the relevant contract, in particular master data, contract data and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you may need to provide us with registration data.

If you do not want us to analyse behavioural and preference data (or personal aspects) or make predictions, you can opt out by refraining from creating a user account or logging in, refraining from participating in the Pluscard bonus programme or making your purchases without using the Pluscard (and also not registering for other offers).

We only make certain services available to you if you provide us with registration data (e.g. the Pluscard bonus programme) because we or our contractual partners want to know who is using our services or has accepted an invitation to an event, because it is technically necessary or because we want to communicate with you. If you or a person you represent (e.g. your employer) wishes to conclude or fulfil a contract with us, we must collect corresponding master data, contract data and communication data from you, and we process technical data if you wish to use our website or other electronic offers for this purpose. If you do not provide us with the data required for the conclusion and fulfilment of the contract, you must expect that we will refuse to conclude the contract, that you will commit a breach of contract or that we will not fulfil the contract. Similarly, we will only be able to send you a response to your enquiry if we process the relevant communication data and - if you communicate with us online - technical data where applicable. It is also not possible to use our website without providing us with technical data.

Insofar as this is not inadmissible, we also obtain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, media or the Internet including social media) or receive data from other companies, authorities and other third parties (e.g. service providers such as credit agencies, address dealers, Internet analysis services, etc., contractual partners, authorities, contractual partners and other persons (or the recipients named in section 8 ).

The categories of personal data that we receive about you from third parties include, in particular, information from public registers, information that we learn in connection with official and legal proceedings, information in connection with your professional functions and activities (so that we can, for example to conclude and process transactions with your employer with your help), information about you in correspondence and meetings with third parties, creditworthiness information (insofar as we process transactions with you personally), information about you that people from your environment (family, advisors, legal representatives, etc.) provide to us so that we can conclude or process contracts with you or with your involvement (e.g. references, your address for deliveries, full name, address of your employer). references, your address for deliveries, powers of attorney, information on compliance with legal requirements such as anti-fraud, anti-money laundering, anti-terrorism and export restrictions, information from banks, insurance companies and sales and other contractual partners of ours on the utilisation or provision of services by you (e.g. payments, purchases, etc.), information from the media and the Internet on the use of our products and services (e.g. payment information), information on the use of our products and services by you (e.g. payment information)We may also process personal data from the media and the Internet (where this is appropriate in a specific case, e.g. as part of a job application, marketing/sales, press review, etc.), your address and any interests and other socio-demographic data (in particular for marketing and research) and data in connection with the use of third-party websites and online offers where this use can be attributed to you.

You may also be able to log in to our website using the login of a third-party provider (e.g. Apple, Facebook or Google). In such a case, we receive access to certain data stored with the respective provider, e.g. username, profile picture, date of birth, gender and other details, the scope of which you can usually determine yourself. You will find information on this in the data protection provisions of the respective provider.

5. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for the online area can be found in sections 13 and 14 . These purposes and the underlying objectives represent our legitimate interests and those of third parties where applicable. You will find further information on the legal basis of our processing in section 6.

We process your data for purposes related to communication with you, in particular to respond to enquiries and assert your rights (section12 ) and to contact you in the event of queries. In particular, we use communication data and master data for this purpose and, in connection with offers and services used by you, also registration data.

This relates to all purposes in connection with which you and we communicate, whether in customer service or advice, when using the website (including, for example, for any authentication) or for training and quality assurance (e.g. in the area of customer service). We process communication data so that we can communicate with you by email and telephone, messenger services, chat, social media (including posts and comments), letter and fax. Communication with you usually takes place in connection with other processing purposes, e.g. so that we can sell products, provide services or respond to a request for information. Our data processing also serves as proof of the communication and its content.

We process data for the establishment, administration and fulfilment of contractual relationships.

We conclude contracts of all kinds with our business and private customers, with suppliers, subcontractors or other contractual partners, such as partners in projects or with parties in legal disputes. We process master data, contract data and communication data as well as registration data of customers or other persons (to whom, for example, a product, service or other offer is brokered).

As part of the business initiation process, personal data - in particular master data, contract data and communication data - is collected from potential customers or other contractual partners (e.g. in an order form or contract) or results from communication. We also process data in connection with the conclusion of the contract to check creditworthiness and to open the customer relationship. In some cases, this information is checked for compliance with legal requirements.

As part of the processing of contractual relationships, we process data for the administration of the customer relationship, for the provision and collection of contractual services (which also includes the involvement of third parties, such as IT providers, logistics and transport companies, advertising service providers, login service providers, security services, payment service providers, banks, insurance companies or credit agencies or address verifiers, who may in turn provide us with data), for advice and for customer support. The enforcement of legal claims arising from contracts (debt collection, legal proceedings, etc.) is also part of processing, as is accounting, contract termination and public communication.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalised advertising for products and services or other offers from us and third parties, to display them on the website (or our social media profiles) etc. This may, for example, take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) at and may also include free services (e.g. invitations, vouchers, etc.). Finally, we also want to enable our contractual partners to contact our customers and other contractual partners for advertising purposes (see section 8).

For example, we may send you information, advertising and product offers from us and from third parties (e.g. advertising contract partners), as printed matter, electronically or by telephone. For this purpose, we mainly process communication and registration data. Like most companies, we personalise communications so that we can provide you with individual information and offers that meet your needs and interests. To do this, we combine data that we process about you and determine preference data and use this data as the basis for personalisation (see section3 ). We also process data in connection with competitions, prize draws (including notification and publication of winners where applicable) and other events (advertising events, sponsoring events, cultural and sporting events, etc.), or courses, seminars or training sessions.

Relationship management also includes addressing existing customers and their contacts on a personalised basis - where appropriate, based on behavioural and preference data. As part of relationship management, we may also operate a customer relationship management system ("CRM"), in which we store the data on customers, suppliers and other business partners necessary for the relationship management, e.g. about contact persons, relationship history (e.g. about products and services purchased or supplied, interactions, etc.), interests, wishes, marketing measures (newsletters, invitations to events, etc.) and other information.

All this processing is not only important for us to advertise our offers as effectively as possible, but also to personalise and improve our relationships with customers and other third parties, to focus on the most important relationships and to use our resources as efficiently as possible.

We also process your data for market research, to improve and (further) develop our business activities (products, services and other offers).

We endeavour to continuously improve our products and services and other offerings (including our website and branch locations) and to respond quickly to changing needs and interests. We therefore analyse, for example, how you navigate through our website or which products are used by which people or groups of people and in what way, and how new products and services can be designed (and evaluate this data). This gives us an indication of the market acceptance of existing products and services and the market potential of new products and services. In particular, we process master data, behavioural data and preference data, but also communication data, information from customer surveys, polls and studies or other information, e.g. from the media, social media, the internet and other public sources. We may also utilise media monitoring services or carry out media monitoring ourselves and process personal data in order to carry out media work or to understand and react to current developments and trends.

We may use location data, e.g. to draw your attention to interesting offers and products in the vicinity on the basis of your location, to infer your interests from the location data (length of stay) and to inform you which products and services other contractual partners with similar interests have utilised.

We may also process your data for security purposes and for access control.

We are constantly reviewing and improving the appropriate security of our IT and other infrastructure (e.g. buildings). Like all companies, we cannot rule out data security breaches with absolute certainty from, but we do what we can to reduce the risks. We therefore process data e.g. for monitoring, controls, analyses and tests of our networks and IT infrastructures, for system and error checks, for documentation purposes and as part of backup copies. Access controls include controlling access to electronic systems (e.g. logging in to user accounts) as well as physical access control (e.g. building access). For security purposes (preventive and to investigate incidents), we also keep access logs and visitor lists and use surveillance systems (e.g. security cameras). If necessary, we will draw your attention to surveillance systems at the relevant locations by means of appropriate notices.

We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations ("compliance").

This includes, for example, the implementation of health and safety concepts or the legally regulated fight against money laundering and terrorist financing. In certain cases, we may be obliged to make certain enquiries about customers ("Know Your Customer") or to submit reports to authorities. The fulfilment of disclosure, information or reporting obligations, e.g. in connection with supervisory and tax obligations, also requires or entails data processing, e.g. the fulfilment of archiving obligations and the prevention, detection and clarification of criminal offences and other violations. This also includes the receipt and processing of complaints and other reports, the monitoring of communications, internal investigations or the disclosure of documents to an authority if we have sufficient reason to do so or are legally obliged to do so. Your personal data may also be processed in the event of external investigations, e.g. by a law enforcement or supervisory authority or an authorised private body. We also process data to support our shareholders and other investors and fulfil our obligations in this regard. For all these purposes, we process in particular your master data, your contract data and communication data, but possibly also behavioural data and data from the category of other data. The legal obligations may relate to Swiss law, but also to foreign regulations to which we are subject, as well as self-regulation, industry standards, our own corporate governance and official instructions and requests.

We also process data for the purposes of our risk management and as part of prudent corporate governance, including business organisation and corporate development.

For these purposes, we process master data, contract data, registration data and technical data in particular, but also behavioural and communication data, for example. For example, we need to monitor our debtors and creditors as part of our financial management, and we need to avoid falling victim to offences and abuses, which may require the evaluation of data for corresponding patterns. We may also carry out profiling and create and process profiles for these purposes and to protect you and us from criminal or abusive activities (see also section 7). As part of the planning of our resources and organisation of our operations, we must evaluate and process data on the use of our services and other offers or exchange information with others (e.g. outsourcing partners), which may also include your data. The same applies to services provided to us by third parties. As part of our corporate development, we may sell businesses, parts of businesses or companies to others or acquire them from others (whereby we may also be sold) or enter into partnerships (or similar), which may also lead to the exchange and processing of data (including from you, e.g. as a customer or supplier or as a supplier representative).

We may process your data for other purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes.

These additional purposes include, for example, training and education purposes, administrative purposes (such as the management of master data, accounting and data archiving and the testing, management and ongoing improvement of IT infrastructure), the protection of our rights (e.g. to enforce claims in court, in or out of court and before authorities in Switzerland and abroad or to defend ourselves against claims, for example by preserving evidence, conducting legal investigations and participating in court or official proceedings) and the evaluation and improvement of internal processes. We may use recordings of (video) conferences for training and quality assurance purposes. The protection of other legitimate interests is also one of the other purposes, which cannot be listed exhaustively.

6. On what basis do we process your data?

If you have given us your consent to process your personal data for marketing purposes (e.g. sending personalised advertising in the form of newsletters and other electronic and automated messages (or contacts), except when we advertise certain products etc. to existing customers), we process your personal data within the scope of and based on this consent, unless we have another legal basis and require consent. Consent that has been granted can be revoked at any time. However, a revocation has no effect on data processing that has already taken place and on data processing for which we can (also) rely on another basis.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or fulfilment of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in this, in particular to pursue the purposes and associated objectives described above under section 5 and to be able to implement corresponding measures. Our legitimate interests also include compliance with statutory provisions, insofar as this is not already recognised as a legal basis under data protection law. However, this also includes the marketing of our products and services, the interest in better understanding our markets and the safe and efficient management and further development of our company, including its operations.

Unless we ask you separately for your consent to contact you for marketing purposes, you may opt out of such contact at any time. You can usually unsubscribe from newsletters and other electronic communications via an unsubscribe link integrated into the communication.

If we receive particularly sensitive personal data (e.g. health data, information on political, religious or ideological views or biometric data for identification purposes), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the necessity of processing for any legal proceedings or the enforcement of or defence against legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately if necessary.

7. What applies to profiling and automated individual decisions?

We may automatically evaluate certain of your personal characteristics for the purposes specified in section 5 using your data (section 3 ) ("profiling") if we wish to determine preference data , but also to identify risks of misuse and security risks, to carry out statistical analyses or for operational planning purposes. For the same purposes, we can also create profiles, i.e. we can combine behavioural and preference data, but also master and contract data and technical data assigned to you in order to better understand you as a person with your different interests and other characteristics. We can also create anonymous and personalised movement profiles of you.

If you are a customer of ours (and participate in our Pluscard bonus programme, for example), we can use "profiling" to determine which other products you are likely to be interested in based on your purchases. However, we may also use this to check your creditworthiness before offering you a purchase on account. For your protection, an automated analysis of data can also check the likelihood of a particular transaction being fraudulent. This allows us to stop the transaction for clarification. This is to be distinguished from "profiles". This refers to the linking of various data in order to gain information about key aspects of your personality (e.g. what you like or how you behave in certain situations) from the totality of this data. Profiles can also be used for marketing and security purposes, for example.

We can use anonymous movement profiles in a non-personalised way, for example to make recommendations to our contractual partners on how to avoid rush hour. For personalised movement profiles, we can use personal data, for example, to draw attention to interesting offers and products in your vicinity, to infer your interests from the position data (dwell time) and to inform you which products and services other contractual partners with similar interests have used or, for example, where health-related protection concepts specify contact tracing.

In both cases, we pay attention to the proportionality and reliability of the results and take measures to prevent misuse of these profiles or profiling. If these can have legal consequences or significant disadvantages for you, we always provide for a manual review.

In certain situations, for reasons of efficiency and consistency of decision-making processes, it may be necessary for us to automate discretionary decisions concerning you with legal effects or potentially significant disadvantages ("automated individual decisions"). In this case, we will inform you accordingly and take the measures required under applicable law.

An example of an automated individual decision is the automatic acceptance of an order by an online shop. Pure if-then decisions are not meant (e.g. when the computer allows you to access your user account after checking your password), but discretionary decisions (e.g. the decision to conclude a contract). We will inform you on a case-by-case basis if an automated decision leads to negative legal consequences or a comparable significant impairment for you. If you do not agree with the result of such a decision, you will be able to communicate with a person who will review the decision.

8. Who do we disclose your data to?

In connection with our contracts, the website, our services, products and other offers, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in section 5 , we also transfer your personal data to third parties, in particular to the following categories of recipients:

Service providers: we work with service providers in Switzerland and abroad who process data about you on our behalf or (where applicable) under joint responsibility with us or who receive data about you from us under their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, security companies, payment service providers, banks, insurance companies, debt collection companies, credit reference agencies or address verifiers). This may also include health data. We work together with the credit and business information agencies CRIF AG (Zurich) and Intrum AG (Schwerzenbach) (which receive data from us to check your identity and creditworthiness): The service providers in the area of creditworthiness/credit assessment include the credit agencies CRIF AG (Zurich) and Intrum AG (Schwerzenbach) as well as the payment service provider CembraPay AG (Zurich). We are also a member of the Association for the Management of a Central Office for Credit Information (ZEK) (Zurich) and the Association for the Management of an Information Centre for Consumer Credit (IKO) (Zurich) and work with them accordingly.

In order to provide our products and services efficiently and to enable us to concentrate on our core competences, we obtain services from third parties in numerous areas. These services include IT services, the dispatch of information, marketing, sales, communication and printing services, building management, security and cleaning, the organisation and staging of events and receptions, debt collection, credit agencies, address verifiers (e.g. to update address databases when relocating), anti-fraud measures and services from consulting firms, lawyers, banks, insurers and telecommunications companies. We provide these service providers with the data required for their services, which may also relate to you. These service providers may also use such data for their own purposes or, under certain circumstances, process it as independent controllers for their own legitimate interests, e.g. data on how their services are used and other data that arises in connection with the use of their services (e.g. for statistical evaluations or for billing), information on outstanding receivables and your payment history in the case of credit agencies or (if applicable) anonymised information to improve the services. . Service providers provide information about their independent data processing in their own data protection declarations at . You can find more information on how Microsoft processes data here: https://privacy.microsoft.com/de-de/privacystatement; for the use of Microsoft Teams in particular here https://docs.microsoft.com/de-de/microsoftteams/teams-privacy.

Contractual partners including customers: This initially refers to our customers and other contractual partners because this data transfer arises from these contracts. For example, you receive registration data for vouchers issued and redeemed, invitations, etc. If you work for such a contractual partner yourself, we may also transmit data about you to them in this context. This may also include health data. Recipients also include contractual partners with whom we cooperate or who advertise for us and to whom we therefore transmit data about you for analysis and marketing purposes (these may also be sponsors and providers of online advertising, for example).

If you act as an employee for a company with which we have concluded a contract, the fulfilment of this contract may result in us informing the company, for example, how you have used our services. Cooperation and advertising contract partners may receive selected master, contract, behavioural and preference data from us so that they can carry out evaluations in their area (e.g. about the number of our customers who have viewed their advertising) and also use data for advertising purposes (including targeting you). For example, advertising contract partners should be able to communicate with suitable other customers of ours and send them advertising.

Public authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or authorised to do so or if this appears necessary to protect our interests. This may also include health data. The authorities process data about you that they receive from us under their own responsibility.

Use cases include criminal investigations, police measures (e.g. health protection concepts, combating violence, etc.), regulatory requirements and investigations, legal proceedings, reporting obligations and pre- and extrajudicial proceedings as well as statutory information and co-operation obligations. Data may also be disclosed if we wish to obtain information from public authorities, e.g. to justify an interest in obtaining information or because we need to say about whom we require information (e.g. from a register).

Other persons: This refers to other cases where the inclusion of third parties arises from the purposes in accordance with section 5 , e.g. recipients of services, media and associations in which we are involved or if you are part of one of our publications.

Other recipients are, for example, delivery recipients or third-party payees specified by you, other third parties also in the context of agency relationships (e.g. if we send your data to your lawyer or your bank) or persons involved in official or court proceedings. If we work with the media and send them material (e.g. photos), you may also be affected by this under certain circumstances. The same applies to the publication of content (e.g. photos, interviews, quotes, etc.) on our website or in other publications. As part of our corporate development, we may sell or acquire businesses, parts of businesses, assets or companies or enter into partnerships, which may also result in the disclosure of data (including your data, e.g. as a customer or supplier or as a supplier representative) to the persons involved in these transactions. In the course of communication with our competitors, industry organisations, associations and other bodies, data may also be exchanged that also concerns you.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We may (e.g. contractually) restrict the processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

We reserve the right to disclose this data even if it concerns confidential data (unless we have expressly agreed with you that we will not disclose this data to certain third parties, unless we are legally obliged to do so). Irrespective of this, your data will generally continue to be subject to appropriate data protection even after disclosure in Switzerland and the rest of Europe. The provisions of section9 apply to disclosures to other countries.

In many cases, the disclosure of even secret data is necessary in order to fulfil contracts or provide other services. Confidentiality agreements do not generally exclude such data disclosures, nor do they exclude disclosure to service providers. However, depending on the sensitivity of the data and other circumstances, we ensure that these third parties handle the data appropriately. We cannot comply with your objection to the disclosure of data if the data disclosure in question is necessary for our activities.

We also allow certain third parties to collect personal data from you on our website and at our events (e.g. media photographers, providers of tools that we have integrated on our website, etc.). Insofar as we are not decisively involved in this data collection, these third parties are solely responsible for it. If you have any concerns and wish to assert your data protection rights, please contact these third parties directly.

9. Is your personal data also transferred abroad?

As explained in section8 , we also disclose data to other organisations. These are not only located in Switzerland. Your data may therefore be processed (or transmitted or made accessible) in Europe (e.g. by service providers in Germany, France, Ireland and Italy) as well as in the USA and other countries worldwide (in any country in the world).

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection law (we generally use the revised standard contractual clauses of the European Commission, , which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj? ), unless the recipient is already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption clause. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the fulfilment of a contract requires such disclosure, if you have given your consent or if the data in question has been made generally accessible by you and you have not objected to its processing.

Many countries outside Switzerland, the EU and the EEA do not currently have laws that guarantee an adequate level of data protection from the perspective of the FADP. The contractual precautions mentioned above can partially compensate for this weaker or missing legal protection. However, contractual precautions cannot eliminate all risks (in particular from state access abroad). You should be aware of these residual risks, even if the risk may be low in individual cases.

Please also note that data exchanged via the Internet is often routed via third countries. Your data may therefore be sent abroad even if the sender and recipient are in the same country.

10. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. If there are no legal or contractual obligations to the contrary, we delete or anonymise your data after the storage or processing period has expired as part of our normal processes.

Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in the event of legal claims, discrepancies, IT and infrastructure security purposes and proof of good corporate governance and compliance. Retention may be required for technical reasons if certain data cannot be separated from other data and we therefore need to retain it with this data (e.g. in the case of backups or document management systems).

11. How do we protect your data?

We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counteract the risks of loss, unintentional alteration, unwanted disclosure or unauthorised access.

Security measures of a technical and organisational nature may include, for example, measures such as the encryption and pseudonymisation of data, logging, access restrictions, the storage of backup copies, instructions to our employees, confidentiality agreements and controls. We can protect your data transmitted via our website in transit using suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our contract processors to take appropriate security measures. However, security risks cannot be completely ruled out; residual risks are unavoidable.

12. What rights do you have?

To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing:

• The right to request information from us as to whether we are processing your data and, if so, which data;

• the right to have us correct data if it is incorrect;

• the right, under certain circumstances, to request that we hand over certain personal data in a commonly used electronic format or transfer it to another controller

• the right to withdraw consent with effect for the future, insofar as our processing is based on your consent

• the right to object to the processing of your data

• the right to express your point of view on automated individual decision-making (section7 ) and to request that the decision be reviewed by a natural person.

If you wish to exercise the above rights against us, please contact us in writing or, unless otherwise stated or agreed, by email; our contact details can be found at7 . In order for us to rule out misuse, we must identify you (e.g. with a copy of your ID, if this is not otherwise possible).

You also have these rights vis-à-vis other organisations that work with us on their own responsibility - please contact them directly if you wish to exercise rights in connection with their processing.

Please note that these rights are subject to conditions, exceptions or restrictions (e.g. to protect third parties or business secrets). We will inform you accordingly if necessary.

In particular, we may need to further process and store your personal data in order to fulfil a contract with you, to protect our own legitimate interests, such as the assertion, exercise or defence of legal claims, or to comply with legal obligations. To the extent permitted by law, in particular to protect the rights and freedoms of other data subjects and to protect legitimate interests, we may therefore refuse a data subject's request in whole or in part (e.g. by blacking out certain content that concerns third parties or our business secrets).

If you do not agree with our handling of your rights or data protection, please let us know (section2 ). You are also free to lodge a complaint with the competent supervisory authority. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

13. Do we use online tracking and online advertising technologies?

We use various technologies on our website with which we and third parties engaged by us can recognise you when you use our website and, under certain circumstances, track you over several visits. We will inform you about this in this section.

Essentially, this is so that we can distinguish between your access (via your system) and access by other users, so that we can ensure the functionality of the website and carry out analyses and personalisation. We do not want to draw any conclusions about your identity, even if we can, if we or third parties engaged by us can identify you by combining this with registration data. However, even without registration data, the technologies used are designed in such a way that you are recognised as an individual visitor each time you access a page, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called "cookie").

Cookies are individual codes (e.g. a serial number) that our server or a server of our service providers or contractual partners transmits to your system when you connect to our website and that your system (browser, mobile) receives and stores until the programmed expiry date. Each time you access our website again, your system transmits these codes to our server or the server of the third party. This allows you to be recognised, even if your identity is unknown.

Whenever you access a server (e.g. when using a website or because an image is visibly or invisibly integrated in an e-mail), your visits can therefore be "tracked". If we integrate offers from a contractual partner or provider of an analysis tool on our website, they can track you in the same way, even if you cannot be identified in individual cases.

We use such techniques on our website and allow certain third parties to do the same. You can programme your browser to block or deceive certain cookies or alternative technologies or to delete existing cookies. You can also add software to your browser that blocks tracking by certain third parties. Further information on this can be found on the help pages of your browser (usually under the heading "Data protection") or on the websites of the third parties (see below).

For example, a distinction is made between the following cookies (technologies with similar functions such as fingerprinting are also included here):

Necessary cookies: Some cookies are necessary for the functioning of the website as such or certain functions. They ensure, for example, that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, function for automatic log-in, shopping basket, etc.).

Performance cookies: We use cookies to record and analyse the use of our website, possibly even beyond the session, in order to optimise our website and corresponding offers and to better tailor them to the needs of users. We may also do this by using third-party analytics services.

Marketing cookies: We and our (advertising) contractual partners have an interest in targeting advertising precisely, i.e. only displaying it to those we want to address. For this purpose, we and our contractual partners may also use cookies that can be used to record the content accessed or contracts concluded. This enables us and our contractual partners to display adverts that we can assume are of interest to you on our website, but also on other websites that display adverts from us or our contractual partners. Without these cookies, you will not see fewer adverts, but simply any other adverts.

In addition to marketing cookies, we may use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we can transmit the email addresses of our users, customers and other people to whom we want to show adverts to operators of advertising platforms (e.g. social media). If these people are registered there with the same email address (which the advertising platforms determine by means of a comparison), the operators will display the adverts we have placed to these people in a targeted manner. The operators do not receive personal email addresses of people who are not already known. In the case of known e-mail addresses, however, they will learn that these people are in contact with us and what content they have accessed.

We can also integrate other third-party offers on our website, in particular from social media providers. If these offers are activated, the corresponding providers can recognise that you are on our website. If you have an account with the social media provider, they can assign this information to you and thus track your use of online services. These social media providers process this data on their own responsibility.

We currently use Google Analytics, for example. Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our processor. Google Ireland relies on Google LLC (based in the USA) as its processor (both "Google"). Google uses performance cookies (see above) to track the behaviour of visitors to our website (duration, frequency of pages accessed, geographical origin of access, etc.) and compiles reports for us on the use of our website on this basis. Although we can assume that the information we share with Google is not personal data for Google, it is possible, , that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these persons. You can find information on Google Analytics data protection here https://support.google.com/analytics/answer/6004245 and if you have a Google account, you can find more information on processing by Google here https://policies.google.com/technologies/partner-sites?hl= de.

14. What data do we process on our pages in social networks?

We may operate pages and other online presences ("fan pages", "channels", "profiles", etc.) on social networks and other platforms operated by third parties and collect the data about you described in section3 and below. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presence and link this data with other data about you known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to control their platforms (e.g. which content they display to you).

We receive data about you when you communicate with us via online presences or view our content on the relevant platforms, visit our online presences or are active on them (e.g. publish content, make comments). These platforms also collect technical data, registration data, communication data, behavioural data and preference data from you or about you (for the terms, see section3 ). These platforms regularly statistically analyse the way in which you interact with us, how you use our online presences, our content or other parts of the platform (what you view, comment on, "like", share, etc.) and link this data with other information about you (e.g. information about your age and gender and other demographic information). In this way, they also create profiles about you and statistics on the use of our online presences. They use this data and profiles to show you our or other advertising and other content on the platform in a personalised way and to control the behaviour of the platform, but also for market and user research and to provide us and others with information about you and the use of our online presence. We can partially control the analyses that these platforms create regarding the use of our online presence.

We process this data for the purposes described in section5 , in particular for communication, marketing purposes (including advertising on these platforms, see section13 ) and market research. You will find information on the relevant legal bases in section6 . We may redistribute content published by you (e.g. comments on an announcement) ourselves (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

For further information on the processing of the platform operators, please refer to the privacy policies of the platforms. There you can also find out in which countries they process your data, what rights of access, erasure and other rights of data subjects you have and how you can exercise these or obtain further information.

15. Can this privacy policy be amended?

This privacy policy is not part of a contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

16. Which language version of this policy prevails?

In the event of any inconsistency or conflict between the English and German versions of this privacy policy, the German version shall prevail.

Last updated: 16 May 2025