Data protection

Privacy Policy

in accordance with the Swiss Data Protection Act (DSG) and the EU General Data Protection Regulation (GDPR)

Switzerland’s new Data Protection Act comes into force on 1 September 2023.

We comply with the requirements of the Swiss Data Protection Act and also implement the EU General Data Protection Regulation as follows:

Privacy Policy of FTA AG, Schweiz

Table of Contents                                    

A............... Information applicable across all sales channels. 2

1................Controller and content of this privacy policy. 2

2................Data Protection Officer. 2

3................Your rights. 2

4................Data security. 3

5................How to contact us. 3

6................Use of your data for marketing purposes. 3

6.1............ Centralised data storage and analysis within the CRM system. 3

6.2............ Email marketing and newsletter. 4

7................Disclosure to third parties and third-party access.. 5

8................Transfer of personal data abroad. 5

9................Retention periods. 5

B............   Special notes regarding our website. 6

10............. Log file data. 6

11............. Cookies. 6

12............. Tracking and web analytics tools. 7

12.1.......... General information about tracking. 7

12.2.......... Google Analytics. 7

12.3         Google AdWords Remarketing. 8

12.4         Google AdWords conversion. 8

12.5         Crazy Egg. 9

13............. Social media. 9

13.1.......... Social media profile. 9

13.2.......... Social media plugins. 10

14............. Online advertusubg abd targeting. 11

14.1.......... Google Ads. 11

15............. Sign up for a customer account. 11

16............. Ordering products. 12

17............. Online payment processing . 12

18............. Submitting reviews. 13

C............... Special information regarding our premises. 13

19............. CCTV. 13

20............. Use of our WiFi networkl. 13

21............. Opening a customer account. 14

22............. Purchasing or ordering products in-store. 14

23............. Payment processing. 15

24............. Use of customer services at the shop premises. 15

A.    Information applicable across all sales channels

1.  Controller and content of this privacy policy

We, FTA AG, Switzerland, are the operator of the website www.fta.ch (hereinafter the “Website”) and, unless otherwise stated, are responsible for the data processing activities set out in this privacy policy. Please read the following information so that you are aware of what personal data we collect from you and for what purposes we use it. Our data protection practices are primarily based on the legal requirements of Swiss data protection law, in particular the Federal Act on Data Protection (FADP), as well as the EU GDPR, the provisions of which may apply in specific cases. Please note that the following information is reviewed and amended from time to time. We therefore recommend that you review this privacy policy regularly. Furthermore, for certain data processing activities listed below, other companies are responsible for data protection or share responsibility with us, meaning that in such cases the information provided by these providers is also relevant.

2.  Data Protection Officer

If you have any questions regarding data protection or wish to exercise your rights, please contact our data protection officer by sending an email to the following address:

Mail  FTA AG, Unterentfelden CH

You can contact our EU Data Protection Officer at:

Mail  FTA Fahrzeugtechnik GmbH, Bad Säckingen DE

3.  Your rights

Provided that the legal requirements are met, you, as a data subject, have the following rights:

Right of access: You have the right to request, at any time and free of charge, access to the personal data we hold about you, provided that we are processing it. This allows you to check what personal data we are processing about you and to ensure that we are using it in accordance with applicable data protection regulations

Right to rectification: You have the right to have inaccurate or incomplete personal data rectified and to be informed of the rectification. In such cases, we will inform the recipients of the data concerned of the changes made, unless this is impossible or would involve a disproportionate effort.

Right to erasure: You have the right to have your personal data erased under certain circumstances. In specific cases, particularly where there are statutory retention obligations, the right to erasure may not apply. In such cases, provided certain conditions are met, the data may be blocked instead of being erased.

Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.

Right to data portability: You have the right to receive from us, free of charge, the personal data you have provided to us in a readable format.

Right to object: You may object to data processing at any time, in particular to data processing in connection with direct marketing (e.g. promotional emails).

Right to withdraw consent: You generally have the right to withdraw your consent at any time. However, processing activities carried out in the past on the basis of your consent do not become unlawful as a result of your withdrawal.

Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority, for example regarding the manner in which your personal data is processed.

4.  Data security

We employ appropriate technical and organisational security measures to protect your personal data stored with us against loss and unlawful processing, in particular unauthorised access by third parties. Our employees and the service providers we engage are bound by us to maintain confidentiality and to uphold data protection. Furthermore, these individuals are only granted access to personal data to the extent necessary for the performance of their duties. Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the internet and electronic means of communication always entails certain security risks, and we cannot provide an absolute guarantee for the security of information transmitted in this way.

5. How to contact us

When you contact us via our contact details and channels (e.g. by email, telephone or contact form), your personal data will be processed. We process the data you have provided to us, such as your company name, your name, your role, your email address or telephone number, and the nature of your enquiry. In addition, the time of receipt of the enquiry is recorded. Mandatory fields in contact forms are marked with an asterisk (*).

We process this data solely for the purpose of dealing with your enquiry (e.g. providing information about a product, assisting with contract processing such as product returns, incorporating your feedback into the improvement of our service, etc.). The legal basis for this data processing is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in dealing with your enquiry or, if your enquiry relates to the conclusion or performance of a contract, the necessity for the performance of the necessary measures within the meaning of Article 6(1)(b) of the EU GDPR. 

6.  Use of your data for marketing purposes

6.1  Centralised data storage and analysis in the CRM system

Where it is possible to clearly link the data to you personally, we will store and link the data described in this privacy policy – i.e. in particular your personal details, your contact information, your contract details and your browsing behaviour on our websites – in a central database. This serves the efficient management of customer data and enables us to respond appropriately to your enquiries, as well as facilitating the efficient provision of the services you have requested and the processing of the associated contracts.

The legal basis for this data processing is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in the efficient management of user data.

We analyse this data to tailor our services to your needs and to display and suggest information and offers that are as relevant to you as possible.

We also use methods that predict your potential interests and future orders based on your website usage. The legal basis for this data processing is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in carrying out marketing activities.

6.2  Email marketing und newsletter

When you sign up for our email newsletter (e.g. when you create an account or within your customer account), the following data is collected: email address

Mandatory fields are marked with an asterisk (*) on the registration form.

To prevent misuse and to ensure that the owner of an email address has actually given their consent themselves, we use the so-called double opt-in procedure for registration. After submitting your registration, you will receive an email from us containing a confirmation link. To complete your subscription to the newsletter, you must click on this link. If you do not click on the confirmation link within the specified time frame, your data will be deleted and our newsletter will not be sent to this address. By registering, you consent to the processing of this data in order to receive messages from us about our company, our range of wheels, castors and transport equipment, as well as related products and services. This may include requests to review any of the aforementioned products and services. Collecting your title and name allows us to verify whether the registration can be linked to an existing customer account and to personalise the content of the emails. Linking the registration to a customer account helps us to make the offers and content in the newsletter more relevant to you and better tailored to your potential needs.

We will use your data for sending emails until you withdraw your consent. You may withdraw your consent at any time, in particular via the unsubscribe link included in all our marketing emails. Our marketing emails may contain a so-called web beacon, a 1x1 pixel (tracking pixel) or similar technical tools. A web beacon is an invisible graphic linked to the user ID of the respective newsletter subscriber. For every marketing email sent, we receive information on which addresses have not yet received the email, to which addresses it was sent, and for which addresses delivery failed. It also shows which links you have clicked on. We use this data for statistical purposes and to optimise promotional emails in terms of frequency, timing, structure and content. This enables us to better tailor the information and offers in our emails to the individual interests of the recipients.

The web beacon will be deleted when you delete the email. To prevent the use of web beacons in our marketing emails, please configure your email programme settings so that HTML is not displayed in messages, if this is not already the default setting. You can find information on how to configure this setting in the help sections of your email software.

By subscribing to the newsletter, you also consent to the statistical analysis of user behaviour for the purpose of optimising and tailoring the newsletter. We use the email marketing software ‘MySign CMS’ from MySign (Switzerland). Your data will therefore be stored in a database maintained by MySign (Switzerland), which means that MySign (Switzerland) may access your data where necessary for the provision of the software and to provide support in its use. This consent constitutes our legal basis for processing the data within the meaning of Article 6(1)(a) of the EU GDPR.

7.  Disclosure to third parties and third-party access

Without the support of other companies, we would be unable to provide our services in the manner you require. In order for us to use the services of these companies, it is necessary, to a certain extent,

to share your personal data. Such disclosure takes place, in particular,

to the extent necessary to fulfil the contract you have requested, i.e. for example to the logistics or transport companies that deliver the requested products, or to a manufacturer who is to fulfil your warranty claim. In these cases, the legal basis is the necessity for the performance of the contract within the meaning of Article 6(1)(b) of the EU GDPR.

Data is also shared with selected service providers, but only to the extent necessary for the provision of the service. Various third-party service providers are also explicitly mentioned in this privacy policy, for example in the sections on marketing. These include, for example, IT service providers (such as software solution providers), advertising agencies and consultancy firms. The legal basis for this data transfer is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in the procurement of third-party services.

Furthermore, your data may be disclosed, in particular to public authorities, legal advisers or debt collection agencies, if we are legally obliged to do so or if this is necessary to protect our rights, in particular to enforce claims arising from our relationship with you. Data may also be disclosed if another company intends to acquire our company or parts thereof, and such disclosure is necessary to carry out a due diligence review or to complete the transaction. The legal basis for this data transfer is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in safeguarding our rights and fulfilling our obligations, or in the sale of our company.

8.  Transfer of personal data abroad

We are entitled to transfer your personal data to third parties abroad where this is necessary for the purposes of data processing as set out in this privacy policy (see in particular sections 12–14). In doing so, we will, of course, comply with the legal requirements regarding the disclosure of personal data

to third parties. If the country in question does not have an adequate level of data protection, we ensure through contractual arrangements that your data is adequately protected by these companies.

9.  Retention periods

We only store personal data for as long as is necessary to carry out the processing activities described in this privacy policy within the scope of our legitimate interests. In the case of contractual data, storage is required by statutory retention obligations. The requirements obliging us to retain data arise from accounting regulations and tax legislation. Under these regulations, business correspondence, concluded contracts and accounting documents must be retained for up to 10 years. This means that the data may then only be used if this is necessary to fulfil retention obligations or to defend and enforce our legal interests. The data will be deleted as soon as there is no longer any retention obligation or legitimate interest in retaining it.

B. Special notes regarding our website

10.  Log file data

When you visit our website, the servers of our hosting provider, MySign (Switzerland), temporarily record every visit in a log file. The following data is collected automatically and stored by us until it is automatically deleted:

This data is collected and processed for the purpose of enabling the use of our website (establishing a connection), ensuring the long-term security and stability of the system, and for error and

performance analysis, and enables us to optimise our website (see also Section 12 regarding the latter points).

In the event of an attack on the website’s network infrastructure or if there is suspicion of other unauthorised or abusive use of the website, the IP address and other data will be analysed for the purposes of investigation and defence and, where necessary, used in criminal proceedings to identify the users concerned and to take civil and criminal action against them. For the purposes described above, we have a legitimate interest in data processing within the meaning of Article 6(1)(f) of the EU GDPR.

11.  Cookies

Cookies are small text files that your web browser stores on your computer’s hard drive or in its RAM when you visit our website. Cookies are assigned identification numbers that allow your browser to be identified and the information contained in the cookie to be read.

Among other things, cookies help to make your visit to our website easier, more enjoyable and more useful. We use cookies for various purposes that are necessary for the use of the website you have requested, i.e. they are “technically necessary”. For example, we use cookies to identify you as a registered user after you have logged in, so that you do not have to log in again each time you navigate to different subpages.

The shopping basket and ordering functions also rely on the use of cookies. Furthermore, cookies perform other technical functions necessary for the operation of the website, such as load balancing – that is, distributing the website’s traffic load across different web servers to reduce the load on individual servers. Cookies are also used for security purposes, for example to prevent the unauthorised posting of content. Finally, we also use cookies in the context of the design and programming of our website, for example to enable the uploading of scripts or code. The legal basis for this data processing is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in providing a user-friendly and up-to-date website.

Most web browsers accept cookies automatically. However, when you visit our website, we ask for your consent to the use of cookies that are not technically necessary, particularly in the case of third-party cookies used for marketing purposes. You can select your preferred settings using the relevant buttons in the cookie banner. Details regarding the individual

Information about cookies, related services and data processing can be found in the cookie banner and in the following sections of this privacy policy.

You may also be able to configure your browser so that no cookies are stored on your computer or so that a notification always appears when you receive a new cookie.

Disabling cookies may mean that you are unable to use all the features of our website.

12.  Tracking and web analytics tools

12.1  General information about tracking

In order to tailor our website to your needs and to continuously optimise it, we use the web analytics services listed below. In this context, pseudonymised user profiles are created and cookies are used (please also refer to section 11). The information generated by the cookie

regarding your use of this website is generally transmitted to a server of the service provider, together with the log file data listed in Section 10, where it is stored and processed. This may also involve transmission to servers abroad, e.g. in the USA (see Section 8, in particular regarding the safeguards in place).

Through the processing of the data, we receive, among other things, the following information:

On our behalf, the provider will use this information to analyse the use of the website, to compile reports for us on website activity, and to provide further services related to website and internet usage for the purposes of market research and the tailored design of these web pages. For these processing activities, we and the provider may, to a certain extent, be regarded as joint controllers under data protection law.

The legal basis for this data processing using the tools listed below is your consent within the meaning of Article 6(1)(a) of the EU GDPR. You may withdraw your consent at any time or object to the processing by rejecting or disabling the relevant cookies in your web browser settings (see Section 11) or by making use of the service-specific options described below.

For the further processing of data by the respective provider as the data controller (sole controller), in particular any onward transfer of this information to third parties such as public authorities on the basis of national legal provisions, please refer to the provider’s respective privacy policy.

12.2  Google Analytics

We use the web analytics service Google Analytics provided by Google Ireland Limited (Gordon House, Barrow St, Dublin 4, D04 E5W5, Ireland) or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) (‘Google’).

In doing so, the data described regarding the use of the website may be transferred to the servers of Google LLC in the EU and/or the USA for the processing purposes explained (see section 12.1).

The IP address may be truncated within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area prior to transmission by activating IP anonymisation (“anonymizeIP”) on this website. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. Users can prevent the collection of data generated by the cookie and relating to the user’s use of the website (including the IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available via the following link http://tools.google.com/dlpage/gaoptout?hl=de.

You can find further information on data protection at Google hier.

When data is collected in Google Analytics 4, IP addresses are not logged or stored.

In Analytics, all IP addresses collected from users in the EU are deleted before they are recorded via EU domains and servers. Analytics does not provide precise location data.

Instead, the following metadata is derived from IP addresses: ‘City’ (and the derived latitude and longitude of the city), ‘Continent’, ‘Country’, ‘Region’, ‘Subcontinent’ (and the ID-based equivalents).

For access originating from the EU, IP address data is used solely to derive location data and is deleted immediately afterwards. It is not logged, is not accessible, and is not used for any other purposes. When collecting metrics in Analytics, all IP lookups are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing.

12.3 Google AdWords Remarketing

We use Google Remarketing Tags. These are services provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter “Google”). Google uses cookies (see section 4) which are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website (including your IP address) is transmitted to a Google server in the USA and stored there. Google then truncates the IP address by the last three digits, meaning that a unique identification of the IP address is no longer possible. Google complies with the data protection provisions of the “US Safe Harbour” Agreement and is registered with the US Department of Commerce’s “Safe Harbour” programme. Google will use this information to evaluate your use of the website, to compile reports on website activity for the website operators and to provide other services relating to website and internet usage.

Google may also transfer this information to third parties where required to do so by law, or where such third parties process the data on Google’s behalf. Third-party advertisers, including Google, display adverts on websites across the internet. Third-party advertisers, including Google, use stored cookies to display adverts based on a user’s previous visits to this website. Google will not associate your IP address with any other data held by Google. You may object to the collection and storage of data at any time with future effect. You can disable the use of cookies by Google by visiting the page to disable Google advertising.

However, please note that in this case you may not be able to use all the functions of this website to their full extent. By using this website, you consent to the processing of data collected about you by Google in the manner and for the purposes set out above.

12.4 Google AdWords Conversion

We also use Google Conversion Tracking to collect statistical data on the use of our website and to analyse this data with a view to optimising the services we offer you. Google AdWords places a cookie

(see section 4) are placed on your computer if you have arrived at our website via a Google advert. These cookies expire after 30 days and are not used to identify you personally. If the user visits certain pages on the AdWords customer’s website and the cookie has not yet expired, Google and the customer can recognise that the user clicked on the advert and was redirected to that page. Each AdWords customer receives a different cookie. Cookies cannot therefore be tracked across the websites of AdWords customers. The information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking.

AdWords customers are informed of the total number of users who clicked on their advert and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that could be used to personally identify users. If you do not wish to participate in the tracking process, you can also refuse the setting of the cookie required for this – for example, via a browser setting that generally disables the automatic setting of cookies. You can also disable cookies for conversion tracking by configuring your browser to block cookies from the domain “www.googleadservices.com”. Google’s privacy policy on conversion tracking can be found here.

12.5  Crazy Egg

We also use the analytics service provided by Crazy Egg Inc. (16220 E. Ridgeview Lane, La Mirada, CA 9063, USA) on our website. Crazy Egg is a tool for analysing user behaviour. Crazy Egg enables us to measure and evaluate the behaviour of visitors to our website (e.g. mouse movements in the form of ‘heatmaps’, clicks, scroll depth, etc.).

For this purpose, Crazy Egg places cookies (see section 4) on visitors’ devices and may store data from visitors such as browser information, operating system, time spent on the site and IP address, etc.

You can prevent this data processing by Crazy Egg by disabling the use of cookies in your web browser settings and deleting any cookies that are already active. Another way to prevent data processing by Crazy Egg is to enable the “Do Not Track” function in your browser. You can find out how to set this up here.

13.  Social media

13.1  Social media profile

In future, our website may include links to our profiles on the social media platforms listed below.

If you click on the social media icons, you will be automatically redirected to our profile on the relevant platform. This establishes a direct connection between your browser and the server

of the relevant social media platform. As a result, the platform receives information that you have visited our website using your IP address and clicked on the link.

If you click on a link to a social media platform whilst logged into your account on that platform, the content of our website may be linked to your profile, meaning that the

platform can directly associate your visit to our website with your account. If you wish to prevent this, you should log out before clicking on the relevant links. A link between your visit to our website and your user account will be established in any case if, after clicking the link, you log in to the relevant network. The respective provider is the data controller under data protection law for the associated data processing. Please therefore refer to the information on the network’s website.

Your consent, within the meaning of Article 6(1)(a) of the EU GDPR, forms the legal basis for the data processing described.

13.2  Social media plugins

In future, social plugins from the providers listed below may be used on our website:

These social plugins are used to make it easier for you to share content from our website. They help us to increase the visibility of our content on social media and thus contribute to more effective marketing.

The plugins are disabled by default on our websites and therefore do not send any data to social networks simply by visiting our website. To enhance data protection, we have integrated the plugins in such a way that a connection to the networks’ servers is not established automatically. Only when you activate the plugins and thereby give your consent to the transfer and further processing of data by the social network providers does your browser establish a direct connection to the servers of the respective social network.

The content of the plugin is transmitted directly from the social network to your browser and integrated into the website by your browser. This means that the relevant provider is informed that your browser has accessed the relevant page of our website, even if you do not have an account with that social network or are not currently

logged in to it. This information (including your IP address) is transmitted directly from your browser to a server belonging to the provider (usually in the USA) and stored there.

We have no control over the scope of the data collected by the provider via the plugin; however, from a data protection perspective, we may be regarded as joint controllers with the providers to a certain extent.

If you are logged in to the social network, it can link your visit to our website directly to your user account. If you interact with the plugins, the relevant information is also transmitted directly to the provider’s server and stored there. The information (e.g. that you like one of our products) may also be published on the social network and, in some cases, shared with others

displayed to users of the social network. The social network provider may use this information for the purpose of displaying advertisements and tailoring the respective

service. To this end, usage, interest and relationship profiles may be created, e.g. to evaluate your use of our website in relation to the advertisements displayed to you on the social network, to inform other users about your activities on our website, and to provide further services associated with the use of the social network. Please refer directly to the privacy policies of the respective providers for information on the purpose and scope of data collection, as well as the further processing and use of data by the social network providers, and your rights in this regard and the settings available to protect your privacy.

If you do not want the social network provider to link the data collected via our website to your user account, you must log out of the social network before activating the plugins. Your consent within the meaning of Article 6(1)(a) of the EU GDPR forms the legal basis for the data processing described. You may withdraw your consent at any time by notifying the plugin provider of your withdrawal in accordance with the instructions in their privacy policy.

14.  Online advertising and targeting

14.1  Google Ads    

This website uses the online advertising services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). To this end, Google uses cookies, such as the so-called DoubleClick cookie, which enable your browser to be recognised when you visit other websites. The information generated by the cookies regarding your visit to these websites (including your IP address) is transmitted to a Google server in the USA and stored there (please also refer to Section 8). Further information on data protection at Google can be found here. The legal basis for this data processing is your consent within the meaning of Article 6(1)(a) of the EU GDPR. You may withdraw your consent at any time by

rejecting or disabling the relevant cookies in your web browser settings (see Section 11 for further details). Further options for blocking advertising can be found here.

15.  Sign up for a customer account

If you create a customer account on our website, we will collect the following data; mandatory fields in the relevant form are marked with an asterisk (*):

We use your personal details to verify your identity and check that you meet the registration requirements. Your email address and password serve as your login details, thereby ensuring that the correct person is using the website under the details you have provided. We also require your email address to verify and confirm the opening of your account, and for future communications with you necessary for the fulfilment of the contract. In addition, this data is stored in your customer account for future contract conclusions. For this purpose, we also allow you to store further details in your account (e.g. your preferred payment method). We also use the data to provide an overview of the products ordered and services purchased (see in particular Sections 16 and 21) and to offer a simple way to manage your personal data, to administer our website and the contractual relationships, i.e. for the establishment, content, processing and amendment of the contracts concluded with you via your customer account.

We process information regarding your language and gender in order to display offers on the website that are tailored as closely as possible to your profile and personal needs, to collect and analyse statistics on the offers selected, and thereby to optimise our suggestions and offers. The legal basis for processing your data for the aforementioned purpose is your consent in accordance with Article 6(1)(a) of the EU GDPR. You may withdraw your consent at any time by removing the details from your customer account or deleting your customer account, or by requesting that we delete it. To prevent misuse, you must always treat your login details as confidential and should close the browser window once you have finished communicating with us, particularly if you share the computer with others.

16.  Ordering products

If you wish to order products or book services on the website, we require certain information in order to process the contract. If you do not log in using your customer account (see section 15), we will collect the following information, depending on the product or service; mandatory fields in the relevant form are marked with an asterisk (*):

We use this data to verify your identity before concluding a contract. We also require your email address to confirm your order and for any future communication with you required for the fulfilment of the contract. We store your data together with the order details (e.g. date and time, order number, etc.), the details of the services ordered/booked (e.g. description, price and features of the product; “product data”), the payment details (e.g. chosen payment method, confirmation of payment and date and time; see also Section 17) and details regarding the processing and fulfilment of the contract (e.g. return of products, use of service or warranty provisions, etc.) in our CRM database (see Section 6.1) so that we can ensure correct order processing and contract fulfilment. To the extent necessary for the performance of the contract, we will also pass on the required information to any third-party service providers (e.g. transport companies). The legal basis for this data processing is the performance of the contract with you pursuant to Article 6(1)(b) of the EU GDPR.

The provision of data not marked as mandatory is voluntary. We process this data in order to tailor our services as closely as possible to your personal needs, to facilitate the processing of contracts, to contact you via an alternative communication channel where necessary for the purpose of fulfilling the contract, or for statistical recording and analysis to optimise our services. The legal basis for this data processing is your consent within the meaning of Article 6(1)(a) of the EU GDPR. You may withdraw your consent at any time by notifying us.

17. Online payment processing

If you purchase services or products on our website that are subject to a charge, depending on the product or service and your chosen payment method – in addition to the information specified in clause 16 – you will be required to provide further details, such as your credit card details or your login details for your payment service provider. This information, as well as the fact that you have purchased a service from us for the relevant amount and at the relevant time, will be forwarded to the respective payment service providers (e.g. payment solution providers, credit card issuers and credit card acquirers). Please always also take note of the information provided by the respective company, in particular the privacy policy and the terms and conditions.

The legal basis for this transfer is the performance of a contract pursuant to Article 6(1)(b) of the EU GDPR.

 In order to prevent payment defaults, the necessary data – in particular your personal details – may also be passed on to a credit reference agency for an automated assessment of your creditworthiness. As part of this process, the credit reference agency may assign you a so-called score. This is an estimate of the future risk of default, e.g. expressed as a percentage. The score is calculated using mathematical and statistical methods and incorporates data from other sources held by the credit reference agency. We reserve the right, based on the information received, not to offer you the “invoice” payment method. The legal basis for this data processing is our legitimate interest under Article 6(1)(f) of the EU GDPR in preventing payment defaults.

18.  Submitting reviews

To help other users make purchasing decisions and to support our quality management (particularly the handling of negative feedback), you have the option on our website to rate products you have ordered. The data processed and published on the website is the data you have provided to us, i.e. in addition to your rating and the time it was submitted, this may also include any comments you have attached to your rating or the name you have provided. The legal basis for the processing of this data is your consent within the meaning of Article 6(1)(a) of the EU GDPR.

We reserve the right to delete unlawful reviews and, if we suspect any such activity, to contact you and ask you to provide a statement. The legal basis for this processing is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in providing the comment and review function and in preventing misuse of these features.

C. Special information regarding our premises

19.  CCTV

To prevent misuse and to take action against unlawful behaviour (in particular theft and damage to property), the entrance area and the publicly accessible areas of our premises are monitored by CCTV cameras. The footage is only viewed if there is suspicion of unlawful behaviour. Otherwise, the recordings are automatically deleted after 72 hours.t.

We use a service provider to operate the video surveillance system; this provider may have access to the data to the extent necessary for the operation of the system. Should suspicions of unlawful conduct be substantiated, the data may then be passed on to advisory firms (in particular our law firm) and authorities to the extent necessary to enforce claims or to report the matter. The legal basis is our legitimate interest within the meaning of Article 6(1)(f) of the EU GDPR in protecting our property and safeguarding and enforcing our rights.

20.  Use of our Wi-Fi network

In our shop, you can use the WiFi network operated by FTA Switzerland free of charge. In doing so, you will be transmitting the following data to FTA (Switzerland):

In addition to the data set out above, the time, date and device used are recorded each time the WiFi network is accessed. The legal basis for this processing is your consent within the meaning of Article 6(1)(a) of the EU GDPR.

The customer may revoke their registration at any time by notifying us. FTA AG (Switzerland) must comply with the legal obligations of the Federal Act on the Surveillance of Postal and Telecommunications Traffic (BÜPF) and the associated ordinance. Provided the legal requirements are met, the WiFi operator must monitor internet usage and data traffic on behalf of the competent authority. The WiFi operator may also be required to disclose the customer’s contact, usage and metadata to the authorised authorities. Contact, usage and metadata are stored on a personal basis for 6 months and then deleted. The legal basis for this processing is our legitimate interest, within the meaning of Article 6(1)(f) of the EU GDPR, in providing a Wi-Fi network in compliance with the applicable legal provisions.

21.  Opening a customer account

When you open a customer account at our shop, we collect the following information:

We use this data to open your customer account. We collect your email address and telephone number for future communication with you that is necessary for the fulfilment of the contract. In addition, this data, as well as data relating to the purchase of products and the procurement of services (see Section 16), is stored under a customer number in your customer account so that we can provide you with an overview of your data at your request and to enable future linking with data from other channels. Your account and the stored data will also be linked to your online account (see Section 15) in this respect, provided that the personal details are identical. The legal basis for processing your data for the aforementioned purpose is your consent in accordance with Article 6(1)(a) of the EU GDPR. You may withdraw your consent at any time by requesting that we delete the data.

22.  Purchasing or ordering products in-store

In our shop, you can usually purchase products without providing your name; however, in this case, please note the section on payment processing (see Section 23). Upon request, you will receive a paper receipt, which you should keep and present when making use of after-sales services (see Section 24). However, you may also purchase products by providing your customer account details.

In this case, please also refer to the section on opening a customer account (see Section 21)

When you purchase or order certain products, we require your name and various other details in order to process the contract. Depending on the product or service, we collect the following data; mandatory fields in forms are marked with an asterisk (*):

We use this data to verify your identity before entering into a contract. We also require your email address for future communications with you that are necessary for the fulfilment of the contract. We store your data together with the order details (e.g. date and time, order number, etc.), the details of

the services ordered/booked (e.g. description, price and features of the product; “product data”), the payment details (e.g. chosen payment method, confirmation of payment and date; see also Section 17) and details regarding the processing and fulfilment of the contract (e.g. return of products, use of service or warranty provisions, etc.) in our CRM database (see Section 6.1) so that we can ensure correct order processing and contract fulfilment.

Where necessary for the performance of the contract, we will also pass on the required information to any third-party service providers (e.g. transport companies). The legal basis for this data processing is the performance of the contract with you in accordance with Article 6(1)(b) of the EU GDPR.

The provision of data not marked as mandatory is voluntary. We process this data to tailor our services as closely as possible to your personal needs, to facilitate the processing of contracts, to contact you via an alternative communication channel where necessary for the performance of the contract, or for statistical recording and analysis to optimise our services. The legal basis for this data processing is your consent within the meaning of Article 6(1)(a) of the EU GDPR. You may withdraw your consent at any time by notifying us.

23.  Payment processing

When you purchase products in our shop using electronic payment methods, the processing of personal data is required. By using the payment terminals, you transmit the information stored on your payment method, such as the cardholder’s name and the card number, to the relevant payment service providers (e.g. payment solution providers, credit card issuers and credit card acquirers). These parties also receive information that the payment method was used in our premises, the amount and the time of the transaction. Conversely, we only receive confirmation of the payment amount at the relevant time, which we can link to the relevant receipt number, or a notification that the transaction was not possible or was cancelled. Please always also take note of the information provided by the respective company, in particular the privacy policy and the terms and conditions. The legal basis for this transfer lies in the performance of the contract with you in accordance with Article 6(1)(b) of the EU GDPR.

24.  Use of customer services at the shop premises

At our shop, you can make use of a range of customer services which may require the processing of personal data. This applies, for example, to the collection of an ordered product, the return of products in exercise of a right of return or a warranty claim, the lodging of a complaint regarding a service, etc. In such cases, we collect the following data – depending on the product concerned or the service requested – with mandatory fields in forms marked with an asterisk (*):

We use this data to verify your identity. We also require your email address for the communication with you necessary to provide customer service. We store this data, together with the details, timing and content of the requested service, in our CRM database (see section 6.1) so that we can ensure the requested service is processed correctly. To the extent necessary for the performance of the contract, we will also pass on the required information to any third-party service providers (e.g. transport companies) or other third parties involved (e.g. manufacturers in the event of a claim under the manufacturer’s warranty).

The legal basis for this data processing is our legitimate interest within the meaning of Article 6(1)(f) of the EU GDPR in addressing your enquiry or, if your enquiry relates to the performance of a contract with you, the necessity of carrying out the necessary contractual measures within the meaning of Article 6(1)(b) of the EU GDPR.

This privacy policy is currently in force.

Last updated: 11 May 2023

It may become necessary to amend this privacy policy as a result of further developments to our website and the services offered through it, or due to changes in legal or regulatory requirements. You can view and print the current version of the privacy policy at any time on our website at www.fta.ch. You will find the link to the privacy policy in the footer under ‘Privacy Policy’.