Privacy Policy

1. General note

In this privacy policy, we, alao AG, describe what we do on our behalf ("alao", "company", "we" or "us") with your data when you visit our website www.alao.ch ("website") and obtain our services offered there, interact with us, communicate with us, have an employment or other contractual relationship with us or otherwise deal with us. This is not an exhaustive description; consent, terms and conditions or similar documents may govern specific matters.

In this privacy statement, "personal data" or "data" means all information relating to an identified or identifiable natural person. "Processing" includes any handling of personal data, regardless of the means and procedures used, in particular the storage, disclosure, acquisition, deletion, storage, modification, destruction and use of personal data.

If you provide us with personal data of other persons (e.g. family members, employees, etc.), we assume that you are authorized to do so and that the data in question is correct. If you provide data about other persons to us, you confirm this. Please also ensure that these persons have been informed about this privacy policy.

This Privacy Policy is designed to meet the requirements of the Swiss Data Protection Act ("DPA").

2. Responsible person / representative

The "data controller" for the data processing activities we describe in this Privacy Policy is the company, unless otherwise indicated in a particular case. If you have any data protection concerns, you can communicate them to us at the following contact address:

Postal address:	alao AG
	Ottikerstrasse 59
	8006 Zurich
Email:	legal@alao.ch

3. Collection and processing of personal data

We primarily process personal data that we receive directly from you in your capacity as a customer, employee, reference or other person or business partner in the course of our business or other legal relationship, or that we collect when you use our website and other applications or when you apply for a job with us.

We process different categories of data about you. The main categories are the following:

Contract data: This is data that arises in connection with the conclusion and execution of a contract, e.g. personal information on name, date of birth and gender, photos, passport copies, IP address or information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing.
Master data: This is the basic data that we need in addition to the contractual data for the processing of our contractual and other business relationships or for marketing and advertising purposes. We process your master data if you are a customer or other business contact or because we want to contact you for our own purposes or the purposes of a contractual partner. We receive master data from you yourself, from entities for which you work or from third parties, such as our contractual partners, sales partners, associations and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.).
Communication Data: When you contact us via the contact form, email, phone or chat, by letter, public forums or other means of communication, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. If we want or need to establish your identity, for example in the case of a request for information made by you, we collect data to identify you. We generally retain this data for 36 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements, or if it is technically required. Emails in personal mailboxes, chats and written correspondence are generally retained for at least 10 years.
Technical data: When you visit our website or use our service, we collect the IP address of your terminal device and other technical data, such as the time of each user action, to ensure the functionality and security of these offerings. This data also includes logs in which the use of our systems is recorded. We generally retain technical data up to 2 months. In order to ensure the functionality of these offers, we may also assign an individual code to you or your end device (e.g. in the form of a cookie, see section 8). The technical data in itself does not allow any conclusions to be drawn about your identity. In the context of registrations or the processing of contracts, however, they can be linked with other data categories (and thus possibly with your person).
Registration data for our newsletter and for promotional offers: If you would like to register on our website to receive our newsletters and/or promotional offers from us, we need your email address as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter or promotional offers. Further data will not be collected. We use this data exclusively for sending the requested information and do not pass it on to third parties.
For applicants:
- Personal information: e.g., first name(s), last name, photograph, employment history, education, degrees, other qualifications or skills, and other typical resume information.
- Communication Data: When you contact us via the contact form, email, phone or chat, by letter, public forums or other means of communication, we collect the data exchanged between you and us, including your contact information and the boundary data of the communication.
- Obtaining references: This is only done with the consent of the applicant. If the applicant provides references in the application, we assume tacit consent.
- Behavioral and preference data: Depending on the relationship we have with you, we try to better tailor our products and offers to you. To do this, we collect and use data about your behavior and preferences. We do this by evaluating information about your behavior in our area that may help us personalize our future interactions with you. We may also supplement this information with information from third parties, including publicly available sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. The data processed for this purpose is partly already known to us (e.g. when you use our services), or we obtain this data by recording your behavior (e.g. how you navigate on our website or the documents you download). We anonymize or delete this data when it is no longer meaningful for the purposes pursued, which may be between 60 seconds and a few weeks (for movement profiles) and between 30 minutes and 14 months (for product and service preferences) depending on the type of data. This period may be longer to the extent necessary for evidentiary reasons or to comply with legal or contractual requirements, or for technical reasons. We describe how tracking works on our website in section 8.
Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data is collected (files, evidence, etc.) that may also relate to you. We may also collect data for health protection reasons (e.g. as part of protection concepts). We may produce videos in which you may be recognizable (esp. by security cameras). We may also collect data on who enters certain buildings when or has corresponding access rights.

4. Purposes of data processing and legal basis

We use the personal data we collect primarily to enter into and process contracts with our customers and business partners, to perform our duties as employees, and to fulfill our legal obligations in Switzerland and abroad.

In addition, we also process personal data of you and other persons, to the extent permitted and to the extent we deem appropriate, for the following purposes in which we (and sometimes third parties) have a corresponding legitimate interest:

Providing, developing and improving our services as well as the website and any other platforms on which we are present;
Communicating with you, in particular to respond to inquiries and assert your rights and to contact you in case of queries;
Communicating with third parties and handling our or their requests;
Fulfillment of our compliance obligations;
Advertising and marketing (including the organization of events), insofar as you have not objected to the use of your data for this purpose, market and opinion research, media monitoring;
Exercise of rights, assertion of legal claims and defense in connection with legal disputes and official proceedings;
Prevention and investigation of crime and other misconduct (e.g., conducting internal investigations, data analysis to combat fraud);
Guarantees of our operations, including the management of our communication systems, our IT, our websites and any other platforms;
Video surveillance to maintain house rights and other measures for IT, building and facility security and to protect our employees and other persons as well as assets belonging to or entrusted to us (such as access controls, visitor lists, network and email scanners);
Purchase and sale of business units, companies or parts of companies and other transactions under company law and related transfers of personal data as well as measures for business management and compliance with legal and regulatory obligations and internal regulations of the company.
Examination of the application documents and the suitability of an applicant;
Drawing up employment contracts and references and - at the employee's request - providing references;
Payment of wages and social benefits;
the keeping of a personnel file;
Internal business communication, including reports on internal meetings and events.

Insofar as you have given us consent to process your personal data for specific purposes, we process your personal data within the scope of and based on this consent, insofar as we have no other legal basis and we require such a basis. Consent given can be revoked at any time, in particular at the address listed under point 2, but this has no effect on data processing that has already taken place.

5. Profiling

"Profiling" refers to the automated processing of personal data of our customers that is carried out in order to analyze personal aspects or make predictions, e.g. the analysis of personal interests, preferences and habits or the prediction of probable behavior. By means of profiling, preference data in particular can be derived

Through profiling, we assess certain of your personal characteristics for the purposes set out in section 4 using your data (section 3) in an automated way in order to draw conclusions about your characteristics, preferences and likely behavior, e.g. your affinity for certain products and services. For this purpose, we may also create profiles, i.e. we may combine behavioral and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your different interests and other characteristics.

Profiling helps us do this, for example,

To provide you with contracts more quickly and precisely tailored to your needs;
To present you our contents and offers according to your needs;
To present you, as far as possible, only with advertisements and offers that are likely to be relevant to you;
To better support you in customer service.

6. Data transfer to third parties

n the course of our business activities and in accordance with the purposes of data processing pursuant to Section 4, we may or must also transfer data to third parties (to the extent such transfer is permitted and we deem it appropriate), either because third parties process such data for us or because they wish to use it for their own purposes. In particular, this involves the following categories of recipients (collectively, the "Recipients"):

Telecommunications providers to whom we broker contracts;
Service providers in Germany and abroad, such as IT providers (e.g. infrastructure providers) or support providers (e.g. call centers);
Accountants, auditors, lawyers and other external consultants from us;
Legal and regulatory authorities, upon request or for the purpose of reporting an actual or suspected violation of applicable laws or regulations.
Domestic and foreign authorities, courts or other parties in potential or ongoing legal proceedings;
Any relevant party for the purpose of preventing, investigating, detecting or prosecuting criminal offenses or enforcing criminal sanctions, including the prevention of threats to public safety;
Acquirers or parties interested in acquiring all or any part of our business or assets;
Other persons: Means other cases where the inclusion of third parties arises from the purposes set forth in Section 4.

When we share data with a recipient, the recipient is subject to binding contractual obligations to (i) process the data only in accordance with our prior instructions and (ii) take measures to protect the confidentiality and security of the data, along with any other requirements under applicable law.

7. Transmission of data abroad

Your data is primarily located on servers within the EU, but may also be processed or accessed from abroad, especially if we involve service providers for the fulfillment of our services as well as sales and marketing. When using cookies from third parties (see section 8), data may also end up in countries outside the EU. If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the respective current standard contractual clauses of the European Commission, which we adapt to Swiss law), insofar as the recipient is not already subject to a legally recognized set of rules for ensuring data protection and we cannot rely on an exemption provision.

8. Cookies, tracking and other technologies related to the use of our website

On our alao.ch website, we use various technologies that allow us and third parties we engage to recognize you when you use the website and, in some circumstances, to track you across multiple visits.

In particular, we use cookies ("cookies"). These are small text files that make it possible to store specific information related to the user on the user's terminal device while the user is using the website. Cookies make it possible, in particular, to determine the frequency of use and number of users of the pages, to analyze behavior patterns of page use, but also to make our offer more customer-friendly.

Most of the cookies we use are so-called "session cookies", which are automatically deleted after the end of your visit. Certain cookies remain stored beyond the end of a browser session and can be accessed again when you visit the site again.

Necessary cookies are necessary for the functioning of the website, the chat function and our services as a whole or for certain functions. If you block them, the website may not work. Other cookies are necessary for the server to store decisions or entries made by you beyond one session (i.e. one visit to the website), if you request this function (e.g. selected language, given consent, the function for an automatic login, etc.). These cookies remain stored beyond your visit (so-called "permanent cookies") and have an expiration date of up to 6 months.
Performance cookies are used to optimize our website and corresponding offers and to better adapt them to the needs of the users. These cookies analyze the use of our website. This is also done through the use of third-party analytics services. Performance cookies also have an expiration date of up to 14 months

The provider of our website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and version;
Operating system used;
Referrer URL;
Host name of the accessing computer;
Time of the server request.

This data cannot be assigned to specific persons. A combination of this data with other data sources is not made. However, we reserve the right to check this data retrospectively if we become aware of specific indications of illegal use.

The website operates or depends on third parties. These third parties have the possibility to collect personal data from you as well. Again, in most cases, browser settings can be changed to protect yourself should such collection be undesirable. Furthermore, for performance cookies used for performance and reach measurement or for advertising, a general objection ("opt-out") is possible for numerous services via AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

9. Duration of the retention of personal data

We process your data for as long as our processing purposes, the legal retention periods and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. You will find further information on the respective storage and processing periods for the individual data categories in section 3 and for the cookie categories in section 8. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our normal processes.

10. Data security

We take reasonable security measures to maintain the confidentiality, integrity and availability of your personal information, to protect it against unauthorized or unlawful processing, and to protect against the risks of loss, accidental alteration, unauthorized disclosure or access.

However, we are not responsible or liable for the security of your data during transmission via email. Any such transmission is at your own risk and you are responsible for ensuring that any personal data you send to us via email is transmitted securely. We also require our contractors to take appropriate security measures. However, security risks cannot be completely ruled out in general; residual risks are unavoidable.

11. Your rights

To help you control the processing of your personal data, you have the following rights in connection with our data processing:

the right to request information from us as to whether and what data we are processing from you;
the right to have us correct data if it is inaccurate;
the right to request the deletion of data;
the right to demand that we hand over certain personal data in a standard electronic format or transfer it to another responsible party; this only applies to data which you have disclosed to us and which we process automatically with your consent or for the conclusion or execution of a contract with you;
the right to withdraw consent, insofar as our processing is based on your consent.

If you wish to exercise the aforementioned rights, you can contact us at the address given in section 2. The exercise of these rights usually requires that you can clearly prove your identity (e.g. by a copy of an identification document, if your identity is not apparent or can not be proven in any other way). If the exercise of certain rights involves costs for you, we will inform you in advance.

Please note that these rights are subject to conditions, exceptions or limitations under applicable data protection law. We reserve the right to assert or enforce such conditions, exceptions or limitations, for example, to protect third parties or trade secrets or if we are required to retain or process certain data or need the data to assert claims.

You also have the right to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

12. Changes

We may amend this privacy policy at any time without unilateral notice. The data protection declaration is not part of the contract. The current version published on our website applies.

Version: 29 August 2023