Privacy Policy

1. What is this privacy policy about?

MedBioGen AG (also referred to as “we” or “us”) collects and processes personal data relating to you or to other individuals (so-called “third parties”). We use the term “data” here interchangeably with “personal data”.

In this privacy policy we describe what we do with your data when you use www.medbiogen.com, other websites of ours or our apps (collectively the “website”), obtain our services or products, are otherwise connected with us under a contract, communicate with us or otherwise deal with us. Where appropriate, we will inform you in good time and in writing about additional processing activities not mentioned in this privacy policy. In addition, we may inform you separately about the processing of your data, for example in consent declarations, contractual terms, additional privacy notices, forms and notices.

This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation (“GDPR”) and the Swiss Data Protection Act (“DSG”). Whether and to what extent these laws apply, however, depends on the individual case.

2. Who is responsible for processing your data?

MedBioGen AG, Roosstrasse 53, 8832 Wollerau, Switzerland is the controller under data protection law for the processing described in this privacy policy, unless communicated otherwise in an individual case.

You can reach us regarding data protection matters and to exercise your rights under section 11 as follows:

MedBioGen AG Data Protection
Roosstrasse 53
8832 Wollerau
Switzerland
datenschutz@medbiogen.com

3. Which data do we process?

We process various categories of data about you. The most important categories are the following:

Technical data

When you use our website or other electronic offerings, we collect the IP address of your device and other technical data in order to ensure the functionality and security of these offerings. This data also includes logs recording the use of our systems. As a rule we retain technical data for 6 months. In order to ensure the functionality of these offerings, we may also assign an individual code to you or to your device. Technical data in itself generally does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the performance of contracts, it may be linked with other categories of data (and thus potentially with you personally).

Registration data

Certain offerings and services can only be used with a user account or registration, which may take place directly with us or via our external login service providers. You must provide us with certain data for this purpose, and we collect data about the use of the offering or service. As a rule we retain registration data for 12 months after the end of use of the service or the closure of the user account.

Communication data

When you are in contact with us via the contact form, by email, telephone, letter or other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. Where we wish or need to establish your identity, we collect data to identify you (for example a copy of an identity document). As a rule we retain this data for 12 months from the last exchange with you. This period may be longer where necessary for evidentiary reasons, to comply with legal or contractual requirements, or for technical reasons. Emails in personal mailboxes and written correspondence are generally retained for at least 10 years.

Master data

By master data we mean the basic data which, alongside contract data (see below), we require to handle our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information about your role and function, your bank details, your date of birth or the customer history. We process your master data if you are a customer or other business contact, or act for one (for example as the contact person of a business partner), or because we wish to approach you for our own purposes or those of a contractual partner (for example in the context of marketing and advertising). We obtain master data from you (for example on a purchase or during registration), from entities you act for, or from third parties such as our contractual partners, associations and address traders, and from publicly accessible sources such as public registers or the internet. As a rule we retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer where necessary for evidentiary reasons, to comply with legal or contractual requirements, or for technical reasons. For purely marketing and advertising contacts the period is normally considerably shorter, usually no more than 2 years since the last contact.

Contract data

This is data arising in connection with the conclusion or performance of a contract, for example details of contracts and of the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for performance, and information about responses. We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (for example providers of credit data) and from publicly accessible sources. As a rule we retain this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer where necessary for evidentiary reasons, to comply with legal or contractual requirements, or for technical reasons.

Much of the data referred to in this section 3 is provided to us by you (for example via forms, in the course of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases. If you wish to conclude contracts with us or claim services, you must also provide us with data under your contractual obligation in accordance with the relevant contract, in particular master data, contract data and registration data. When using our website, the processing of technical data is unavoidable.

Insofar as this is permissible, we also obtain data from publicly accessible sources or receive data from authorities and other third parties.

4. For which purposes do we process your data?

We process your data for the purposes explained below. These purposes and the underlying objectives constitute legitimate interests of ours and, where applicable, of third parties.

We process your data for purposes connected with communicating with you, in particular to respond to enquiries, to enable you to assert your rights, and to contact you if we have questions. For this we use in particular communication data and master data and, in connection with offerings and services you use, also registration data. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for follow-up enquiries.

We also process data for, among other things, entering into, administering and performing contractual relationships, for marketing purposes and relationship management, for market research, to improve our services and our operations, for product development, to comply with laws, instructions and recommendations of authorities and internal regulations (compliance), and for further purposes, for example in the context of our internal processes and administration.

5. On what basis do we process your data?

Where we ask for your consent for particular processing, we inform you separately about the relevant purposes of the processing. You may withdraw your consent at any time with effect for the future by written notice (by post) or, unless otherwise stated or agreed, by email; our contact details can be found in section 2. Regarding the withdrawal of your consent to online tracking, see section 12. Where you have a user account, withdrawal or contact with us may also be possible via the relevant website or other service. As soon as we have received notice of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or with the entity you represent), or that we or third parties have a legitimate interest in it, in particular in order to pursue the purposes and associated objectives described in section 4 above and to be able to carry out corresponding measures. Our legitimate interests also include compliance with legal requirements, insofar as this is not already recognised as a legal basis by the applicable data protection law.

In individual cases other legal grounds may apply, which we will communicate to you separately where necessary.

6. What applies to profiling and automated individual decisions?

Where we ask for your consent for particular processing, we inform you separately about the relevant purposes of the processing. You may withdraw your consent at any time with effect for the future by written notice (by post) or, unless otherwise stated or agreed, by email; our contact details can be found in section 2. Regarding the withdrawal of your consent to online tracking, see section 12. Where you have a user account, withdrawal or contact with us may also be possible via the relevant website or other service. As soon as we have received notice of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or with the entity you represent), or that we or third parties have a legitimate interest in it, in particular in order to pursue the purposes and associated objectives described in section 4 above and to be able to carry out corresponding measures. Our legitimate interests also include compliance with legal requirements, insofar as this is not already recognised as a legal basis by the applicable data protection law.

In individual cases other legal grounds may apply, which we will communicate to you separately where necessary.

7. To whom do we disclose your data?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests and the further purposes listed in section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

• Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us, or who receive data about you from us under their own responsibility.
• Authorities: We may pass personal data to public offices, courts and other authorities in Switzerland and abroad where we are legally obliged or entitled to do so, or where this appears necessary to safeguard our interests.
• Contractual partners including customers: This means first of all our customers (for example recipients of services) and our other contractual partners, because this data transfer arises from those contracts. If you yourself act for such a contractual partner, we may also transfer data about you to them in this context. Recipients also include contractual partners with whom we cooperate.
• Other persons: This means other cases where the involvement of third parties follows from the purposes set out in section 4.

All of these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the processing by certain third parties (for example IT providers), but not that of other third parties (for example authorities, banks, etc.).

8. Is your personal data transferred abroad?

As explained in section 7, we also disclose data to other entities. These are not located solely in Switzerland. Your data may therefore also be processed in Europe; in exceptional cases also in any country in the world.

Where a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with applicable data protection (for this we use the revised standard contractual clauses of the European Commission, available here), unless the recipient is already subject to a legally recognised set of rules ensuring data protection and we cannot rely on an exception. An exception may apply in particular to legal proceedings abroad, but also in cases of overriding public interest or where the performance of a contract requires such disclosure, where you have consented, or where the data concerned is data you have made generally accessible and whose processing you have not objected to.

Please also note that data exchanged over the internet is frequently routed via third countries. Your data may therefore also reach other countries even if the sender and recipient are in the same country.

9. How long do we process your data?

We process your data for as long as our processing purposes, statutory retention periods and our legitimate interests in processing for documentation and evidentiary purposes require, or for as long as storage is technically necessary. Further information on the respective storage and processing periods can be found with the individual data categories in section 3 and with the cookie categories in section 12. Unless legal or contractual obligations prevent it, we delete or anonymise your data after the storage or processing period has expired, as part of our normal processes.

10. How do we protect your data?

We take appropriate security measures to preserve the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing, and to counter the risks of loss, unintentional alteration, unwanted disclosure or unauthorised access.

11. What rights do you have?

To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

• The right to request information from us as to whether and which data we process about you;
• the right to have data corrected if it is inaccurate;
• the right to request the deletion of data;
• the right to request from us the release of certain personal data in a common electronic format or its transfer to another controller;
• the right to withdraw consent, insofar as our processing is based on your consent;
• the right to receive, on request, further information required to exercise these rights;
• the right, in the case of automated individual decisions (section 6), to state your point of view and to request that the decision be reviewed by a natural person.

If you wish to exercise the above rights in relation to us, please contact us in writing, in person at our premises or, unless otherwise stated or agreed, by email; our contact details can be found in section 2. So that we can rule out misuse, we must identify you (for example by means of a copy of an identity document, where this is not possible by other means).

Please note that conditions, exceptions or restrictions apply to these rights under the applicable data protection law (for example to protect third parties or trade secrets). We will inform you accordingly where relevant.

If you do not agree with how we handle your rights or with our data protection practices, please let us know (section 2). If you are located in the EEA, the United Kingdom or Switzerland in particular, you also have the right to lodge a complaint with the data protection supervisory authority of your country. A list of the authorities in the EEA can be found here. The United Kingdom supervisory authority can be reached here. The Swiss supervisory authority can be reached here.

12. Do we use online tracking and online advertising techniques?

On our website we use various techniques by which we and third parties engaged by us can recognise you during your use and, in some circumstances, track you across several visits. In this section we inform you about this.

Essentially, the point is that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the website and carry out evaluations and personalisation. In doing so we do not intend to establish your identity, even where we could, insofar as we or third parties engaged by us can identify you by combining this with registration data. Even without registration data, however, the techniques used are designed so that you are recognised as an individual visitor on each page view, for example by our server (or the servers of third parties) assigning you or your browser a particular identification number (a so-called “cookie”).

We use such techniques on our website and permit certain third parties to do so as well. You can configure your browser to block or spoof certain cookies or alternative techniques, or to delete existing cookies. You can also extend your browser with software that blocks tracking by certain third parties. Further information can be found on the help pages of your browser (usually under “privacy”) or on the websites of the third parties listed below.

The following cookies are distinguished (techniques with comparable functions, such as fingerprinting, are included here):

Necessary cookies

Some cookies are necessary for the functioning of the website as such or for particular functions. They ensure, for example, that you can move between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies exist only temporarily (“session cookies”). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries you have made beyond a single session (i.e. one visit to the website), if you use that function (for example the chosen language, consent given, the automatic login function, etc.). These cookies have an expiry date of up to 24 months.

Performance cookies

In order to optimise our website and related offerings and to tailor them better to users’ needs, we use cookies to record and analyse the use of our website, in some circumstances also beyond the session. We do this by using analytics services from third-party providers. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.

Marketing cookies

We and our advertising partners have an interest in targeting advertising precisely, i.e. showing it as far as possible only to those we wish to address. For this purpose, we and our advertising partners – if you consent – also use cookies with which the content accessed or contracts concluded can be recorded. This enables us and our advertising partners to display advertising which we can assume is of interest to you, on our website but also on other websites which display advertising from us or our advertising partners. Depending on the situation, these cookies have an expiry period of a few days up to 12 months. If you consent to the use of these cookies, corresponding advertising will be shown to you. If you do not consent to these cookies, you will not see less advertising, but simply other advertising.

In addition to marketing cookies, we use further techniques to manage online advertising on other websites and thereby reduce wastage. For example, we may transfer the email addresses of our users, customers and other persons to whom we wish to show advertising to operators of advertising platforms (for example social media). If those persons are registered there with the same email address (which the advertising platforms determine by comparison), the operators show the advertising placed by us to those persons in a targeted manner. The operators do not thereby receive personal email addresses of persons not already known to them. For known email addresses, however, they learn that those persons are connected with us and which content they have accessed.

We may also embed further third-party offerings on our website, in particular from social media providers. These offerings are deactivated by default. As soon as you activate them (for example by clicking a switch), the relevant providers can determine that you are on our website. If you have an account with the social media provider, they can attribute this information to you and thus track your use of online offerings. These social media providers process this data under their own responsibility.

Services currently in use

The service providers and advertising partners whose offerings we currently use (insofar as they use cookies) are: none. This website currently embeds no analytics or statistics services (such as Google Analytics), no advertising networks, no social media plug-ins and no other third-party services. The performance and marketing cookies described above are not being set at present; those sections describe how we would proceed should we introduce such techniques in future — in which case we would ask for your consent beforehand.

The only cookies actually set are necessary ones:

• Cookie consent — stores your choice in the cookie notice so that it does not reappear on every page view. Lifetime up to 365 days.
• Language selection — stores whether you are viewing the German or the English version of this website. Lifetime up to 12 months.

Fonts, images and videos on this website are served exclusively from our own server. No connection to content delivery networks, font services or other third parties is made when the page is loaded.

13. Can this privacy policy be amended?

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version in each case.

Last updated: 1 June 2023