Data Protection - Swiss Automotive Group AG

Last updated: 19.08.2024

1. Identity and contact details of the controller

We, Swiss Automotive Group, as the data controller (the “Controller”, “we", “us", “our”) are committed to protecting your personal data and to being transparent about how your personal data is processed.

2. Purpose of the privacy policy

The purpose of this privacy policy is to inform you about how we process your personal data, in particular about:

The purposes for which we may process your personal data and the legal basis on which we may do so;
The categories of personal data we may process and their sources;
The retention period;
The recipients or categories of recipients to whom we may disclose your personal data and transfers outside the European Economic Area;
Your rights as a data subject and how to exercise those rights.

The information described in this policy covers both your interaction with this website (the “Website”) and other interactions we have or may have with you, independent of your use of the Website. Therefore, this policy is structured by reference to the type of relationship or interaction you have with us. This means that not all processing purposes and the details of those purposes will be relevant to you.

Where we provide you with a specific privacy notice or similar in connection with a particular interaction with you, the information in that document should prevail.

3. If you are a client or potential client (natural person):

Purpose	Legal Basis	Categories of Personal Data and Sources
Negotiate the terms of the relationship with you and enter into the agreement with you.	The processing is necessary for the performance of the agreement with you or to take steps at your request prior to entering into the agreement.	Identity and contact details: your name, surname, address, delivery address, email address, telephone number, internal identification code/number, username, signature, etc. Demographic data: your age, gender, etc. Financial and payment data: your bank account, data necessary for processing payments and fraud prevention, credit/debit card numbers and other related billing information, etc. Purchase/interest in our goods/services: the goods/services you request information about/you purchase, information provided during the contractual relationship with you, your preferences in receiving marketing from us, satisfaction feedback. Other personal data you provide directly to us. Some of the above categories of personal data may be collected from sources other than directly from you: our service providers, other companies in the same group, business partners and publicly available sources, sources provided bysearch tools. Some of the above categories of personal data may also be inferred/derived by us from personal data collected from you/from other sources.
Provide the goods/services you request and manage the aspects of our contractual relationship, communicate with you in relation to all aspects of the goods/services you are interested in/have purchased, provide you with pricing information, deliver the goods/services purchased, issue invoices.
Manage your online account(s) and receive technical notifications and other administrative messages.
Comply with our legal obligations. This includes legal obligations in the tax, accounting, archiving and data protection fields.	The processing is necessary to comply with a legal obligation to which we are subject.
Manage and improve our business operations, create, manage and maintain customer relationship management databases.	The processing is necessary for achieving our legitimate interests consisting in the good development of the contractual relationship with you and of our business.
Maintain records of business activities, budgeting, management, financial and internal reporting, and detect, prevent and respond to actual or potential fraud, illegal activities or intellectual property infringements.
Understand how you use our services, by generating and analysing statistics.	The processing is necessary for achieving our marketing related legitimate interests.
Assess the effectiveness of our events, marketing campaigns.	We rely on your consent where required by law.
Carry out market studies/research.
Send you newsletters and other marketing communications.

4. If you are a representative, a contact person or an employee of a customer or potential customer/contractual partner:

Purpose	Legal Basis	Categories of Personal Data and Sources
Negotiate the terms of the relationship with the organisation you represent and enter the agreement with it.	The processing is necessary for achieving our legitimate interests consisting in the good development of contractual relationship with the organisation you represent and of our business.	Identity and contact details: your name, surname, email address, telephone number, username, signature, organisation you represent, position/role within the organisation, etc. Demographic data: your age, gender, etc. Other personal data you provide directly to us. Some of the above categories of personal data may be collected from sources other than directly from you: our service providers, other companies in the same group, business partners and publicly available sources, sources provided by search tools. Some of the above categories of personal data may also be inferred/derived by us from personal data collected fromyou/from other sources.
Manage the aspects of the contractual relationship with the organisation you represent, communicate with you in relation to all aspects of the goods/services your organisation is interested in/has purchased, provide it with pricing information, deliver the goods/services purchased, issue invoices.
Manage the online account(s) of the organisation you represent and receive technical notifications and other administrative messages.
Comply with our legal obligations. This includes legal obligations in the tax, accounting, archiving and data protection fields.	The processing is necessary to comply with a legal obligation to which we are subject.
Manage and improve our business operations, create, manage, and maintain customer relationship management databases.	The processing is necessary for achieving our legitimate interests consisting in the good development of contractual relationship with you and of our business.
Maintain records of business activities, budgeting, management, financial and internal reporting, and detect, prevent and respond to actual or potential fraud, illegal activities or intellectual property infringements.
Assess the effectiveness of our events, marketing campaigns.
Carry out market studies/research.
Send you newsletters and other marketing communications.

5. If you are a job applicant:

Purpose	Legal Basis	Categories of Personal Data and Sources
Evaluate your application, assess your suitability for the job, communicate with you about the recruitment process and/or your application, make hiring decisions.	The processing is necessary to take steps at your request prior to entering into the agreement and/or for achieving our legitimate interests consisting in the good development of the recruitment.	Identity and contact details: your name, surname, address, email address, telephone number, citizenship, nationality, etc. Demographic data: your age, gender, date of birth, place of birth, etc. employment-related information: employment history, start and leave dates, position/role, work location, disciplinary sanctions/measures data or other data collected in the context of checking compliance with legal requirements, CV information, interview notes and assessments, educational information, professional qualifications, language skills and other relevant skills, background checks, signature, conflict of interest information, background checks data; Other personal data you provide directly to us. Some of the above categories of personal data may be collected from sources other than directly from you: recruitment agencies and other human resources service providers, references, websites offering recruitment services, professional networks, online professional journals, companies in the same group, sources provided by search tools, other contractual partners. Some of the above categories of personal data may also be inferred/derived by us from personal data collected from you/from other sources.
Verify your application by contacting your referees, conducting background checks and conflict checks, if necessary.
Comply with our legal obligations. This includes legal obligations in the employment, archiving and data protection fields.	The processing is necessary to comply with a legal obligation to which we are subject.
Contact you about other job opportunities.	For this purpose we will rely on your consent.

6. If you are a user of our website:

Purpose	Legal Basis	Categories of Personal Data and Sources
Enable access to and use of our Website.	The processing is necessary for achieving our marketing related legitimate interests. We rely on your consent where required by law.	Profile and usage data collected by the use of cookies or similar technologies: your preferences regarding cookies and similar technologies, information about how you use our website, your interests and preferences, the goods/services you viewed or searched for, page response times, download errors, length of visits and website interaction information (scrolling, clicks, and mouse-overs), other technical data collected during your visits to our website, IP address, login data, browser type and version, device type, time zone, etc. Details on the use of cookies and similar technologies are included in the Cookie Policy, available here.
Understand how you use our Website by compiling and analysing statistics, monitoring traffic, and improving the content of the Website (for example, by placing the most popular pages where they are easiest to find).
Online advertising by displaying generic and personalised content.

Purpose

Legal Basis

Categories of Personal Data and Sources

Enable access to and use of our Website.

The processing is necessary for achieving our marketing related legitimate interests.

We rely on your consent where required by law.

Profile and usage data collected by the use of cookies or
similar technologies: your preferences regarding cookies
and similar technologies, information about how you use our website, your interests and preferences, the goods/services you viewed or searched for, page response times, download errors, length of visits and website interaction information (scrolling, clicks, and mouse-overs), other technical data collected during your visits to our website, IP address, login data, browser type and version, device type, time zone, etc.

Details on the use of cookies and similar technologies are included in the Cookie Policy, available here.

Understand how you use our Website by compiling and analysing statistics, monitoring traffic, and improving the content of the Website (for example, by placing the most popular pages where they are easiest to find).

Online advertising by displaying generic and personalised content.

7. For all categories of data subject:

Purpose	Legal Basis	Categories of Personal Data and Sources
Receive and manage whistleblowing reports. This purpose may involve several processing operations, such as: receiving, investigating, and resolving the whistleblowing reports, undertake protective, supportive, and remedial measures following a whistleblowing report.	The processing is necessary to comply with a legal obligation to which we are subject. Where the processing is not necessary to comply with a legal obligation, we may still have a legitimate interest in processing your personal data for the proper development of our business	We may process personal data that you have provided directly to us or that we have collected during or in the context of the relationship/interactions with you as mentioned in the sections above. We may also process: Whistleblowing related data: date and time of a whistleblowing report, channel, and form of submission of a whistleblowing report and the related data, facts alleged in the report, evidence arising from the investigation of the report, measures undertaken, conversation recordings, other personal data provided directly to you. We may collect your personal data from the following sources: the individual acting as whistleblower, facilitator, concerned person, other individuals mentioned in a whistleblowing report or who have or might have knowledge of the facts reported, relevant authorities, public sources (e.g., if the whistleblower chooses to make a public disclosure), third parties (our contractual partners, companies in the same group).
Maintain records of whistleblowing reports and the actions taken to deal with them.
Cooperate with the competent authorities, for example, where a whistleblower has submitted the report via external reporting channels.
Conduct mergers & acquisitions or any other changes in structure or similar transactions.	The processing is necessary to achieve our legitimate interest in carrying out the transaction as effectively as possible. If we are required by law to process your personal data, we will do so in accordance with that law.	We may process personal data that you have provided directly to us or that we have collected during or in the context of the relationship/interactions with you as mentioned in the sections above.
Monitor legal rights and remedies and manage complaints or claims.	The processing is necessary for achieving our legitimate interests consisting of the good development of our business and protecting our rights.
Defend, exercise, or establish the Company’s rights, including in court, if applicable.

8. Provision of personal data

The provision of your personal data for processing that is necessary to perform the agreement with you or to take steps at your request to enter an agreement, or for processing that is necessary to comply with a legal obligation, is mandatory. If we request your personal data in this scenario and you refuse to provide it, you should be aware that we may not be able to enter into an agreement with you or perform all or certain parts of the agreement with you or comply with our legal obligations, which may also affect you.

If you are providing personal data about someone other than yourself, please ensure that the individuals to whom the personal data relate understand how their personal data will be used and that they have given their consent for you to disclose it to us before you provide it, if such consent is required.

9. Retention period

We keep your personal data for as long as necessary for the purposes for which it is processed and as permitted by applicable law.

To comply with a legal obligation, we keep your personal data for the period specified by the relevant law.

For the other purposes, the retention period will be specifically defined for a particular purpose as set out above. Generally, the criteria for determining the applicable retention period for your personal data may include the nature of the personal data and the potential risks of unlawful processing of your personal data.

10. Disclosure and transfer of your personal data

To achieve the purposes described above, we may disclose your personal data to the following categories of recipients:

a. other companies in the same group.
b. governamental and regulatory authorities.
c. providers of human resources services, payment services, IT support, storage and hosting services
d. accountants/tax and legal service providers.
e. agents, consultants, contractors and other third parties providing services.
f. other contractual partners to whom the disclosure of data is necessary for the provision of contractual services.
g. any other person or entity to whom you have requested disclosure.

Some of these recipients are located in countries outside the European Economic Area (third countries), in which context your personal data may be transferred to third countries. To obtain a complete list of all third countries to which your personal data may be transferred (if any) and a copy of the transfer safeguards we have in place, as well as any other information relating to such transfers, please contact us using the details set out in this privacy policy.

11. Your rights

Right of access	Allows you to obtain confirmation as to whether your personal data is being processed by us and, if so, the relevant details of such processing activities, as well as a copy of your personal data.
Right to rectification	Allows you to ask us to rectify inaccurate personal data or to complete incomplete personal data that we process about you.
Right to reasure	Allows you to request the deletion of your personal data in certain cases (for example, when the personal data is no longer necessary for the purposes for which it was collected). Important notice! We may not be able to comply with such requests in all cases, for example, where we are required by law to retain personal data for a certain period, or where the personal data is necessary for a legitimate interest such as the defense of a legal claim.
Right to restriction	Allows you to request us to temporarily suspend the processing of your data in cases provided for by the applicable legislation, for example, for the time necessary to correct the data we process about you, to the extent that you dispute their accuracy.
Right to object	Allows you to object to further processing of your personal data within the conditions and limits set by law. This applies where the processing of your personal data is based on our legitimate interests or the public interest. Important notice! The law requires us to comply with such requests only for direct marketing purposes. In other cases, we will balance our interests and the reasons you give for such request to make a final decision. Therefore, please explain why you object to the processing when you make such a request.
Right to portability	If we process your personal data by automated means, based on your consent or for the conclusion and/or performance of the agreement with you, you have the right to data portability. Thus, you have (i) the right to receive your personal data that you have provided to us directly in a structured, commonly used and machine-readable format, and (ii) the right to request us to transmit this data to another data controller.
Right to withdraw the consent	Allows you to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You may exercise your rights and find out more about the processing of your personal data by sending a request to the following contact details: datenschutz@sag-ag.ch

You may also contact the data protection officer we appointed, by using the following contact details: datenschutz@sag-ag.ch

You also have the right to file a complaint with the competent data protection authority.

12. Changes to the privacy policy

The company reserves the right to make changes and updates to this document to comply with any changes in the law and/or to reflect the way our business processes personal data.

13. Use of cookies and similar technologies

This website uses cookies and similar technologies. Details on the use of cookies and similar technologies are included in the Cookie Policy, available here.