Wyss Zurich Foundation, Pfingstweidstrasse 10 in 8005 Zurich operates the website www.wysszurich-foundation.ch (hereinafter referred to as «we»). On this website you can find information about our organization, use our online services and contact us. In this privacy policy, we inform you in a transparent and understandable way about what data we collect via our website and how we handle this data.

• What data is collected on our website;
• Under what circumstances we process your data and for what purpose;
• How long we store your data;
• When disclosure to third parties is permitted;
• How we process your data («individual data processing operations»);
• When and how you can object to data processing;
• What rights you have and how you can assert then.

3.1 What is personal data?

Personal data is any information that relates to an identified or identifiable natural person. This includes, for example, name, address, date of birth, e-mail address, postal address, telephone number, etc. Data about personal preferences such as leisure activities or memberships also count as personal data.

3.2 What are personal data requiring special protection?

Data about religious, ideological, political or trade union views or activities; data about health and, where applicable, information about administrative or criminal prosecutions and sanctions, as well as data about social assistance measures, are considered to be particularly sensitive personal data. Where necessary and appropriate, we may request and process sensitive personal data. In this case, their processing is subject to stricter confidentiality.

3.3 What is the processing of personal data?

Processing is any handling of personal data, regardless of the means and procedures used, in particular the acquisition, storage, retention, use, modification, disclosure, archiving, deletion or destruction of data.

3.4 What is the disclosure of personal data?

This is the transmission or making available of personal data, e.g. publication or disclosure to third parties.

If you have any questions or concerns about the protection of your data by us, you can contact us at any time by e-mail at office@wysszurich-foundation.ch. Responsible for the data processing that takes place via this website is:
Wyss Zurich Foundation
Anja Witte
Pfingstweidstrasse 10
8005 Zurich

We may change this privacy policy at any time. The changes will be published on www.wysszurich-foundation.ch, you will not be informed separately.

6.1 What data do we collect from you and from whom do we receive this data?

First and foremost, we process personal data that you submit to us or that we collect when operating our website. We may also receive personal data about you from third parties. This may include the following categories:

• Personal master data (name, address, birth data, etc.);
• Contact data (mobile number, email address, etc.);
• Financial data (e.g. bank account details);
• Online identifiers (e.g. cookie dientifier, IP addresses);
• Location and traffic data;
• Sound and image recordings;
• Data requiring special protection (e.g. biometric data or information about your health).

6.2 Under what conditions do we process your data?

We process your data in good faith and in accordance with the purposes set out in this data protection policy. In doing so, we ensure transparent and proportionate processing. If, in exceptional cases, we are unable to comply with these principles, the data processing may still be lawful because there is a justification. The following are possible grounds for justification:

• Your consent;
• The execution of a contract or pre-contractual measures;
• our legitimate interests, unless your interests are overridden.

6.3 How can you revoke your consent?

If you have given us consent to process your personal data for certain purposes, we will process your data within the scope of this consent unless we have another justification. You can revoke your granted consent at any time by sending an e-mail to the address given in the imprint. Data processing that has already taken place is not affected by this.

6.4 In which cases can we pass on your data to third parties?

Principle
We may need to use the services of third parties or affiliated companies and commission them to process your data. We contractually ensure that third parties and affiliated companies comply with the requirements of data protection. We may also be required to disclose your data to authorities. We will only disclose your personal data if:

• you have given your consent;
• this is necessary for the fulfillment of the contract or the implementation of pre-contractual measures as well as for the enforcement of our rights;
• there is a legal obligation to do so;
• we have a legitimate interest in doing so and your interests to the contrary do not outweigh ours.

Transfer abroad
Under certain circumstances, your personal data may be transferred to companies abroad as part of the order processing. These companies are obligated to data protection to the same extent as we ourselves are. The transfer may take place worldwide. If the level of data protection does not correspond to that in the EEA area, we carry out a prior risk assessment and ensure contractually that the same level of protection is guaranteed as in the EEA area (for example, by means of the new standard contractual clauses of the EU Commission or other measures prescribed by law). If our risk assessment is negative, we will take additional technical measures to protect your data.

6.5 How long do we keep your data?

We store personal data only for as long as is necessary to fulfill the individual purposes for which the data was collected. Data that we store when you visit our website is kept for twelve months. An exception is made for analytics and tracking data, which may be kept longer. We store contract data for longer, as we are obliged to do so by legal regulations. In particular, we must retain business communications, concluded contracts and accounting records for up to 10 years. If we no longer need such data from you to perform the services, the data will be blocked and we will only use it for accounting and tax purposes.

6.6 How do we protect your data?

We will keep your data secure and take all reasonable steps to protect your data from loss, access, misuse or alteration. Our contractors and employees who have access to your data are required to comply with data protection laws. In some cases, it will be necessary for us to pass on your requests to companies affiliated with us. In these cases, too, your data will be treated confidentially. Within our website, we use the SSL (Secure Socket Layer) procedure in conjunction with the highest encryption level supported by your browser.

6.7 What are your rights?

Right to information
You can request information about the data we have stored about you at any time. We ask that you send your request for information together with a proof of identity to office@wysszurich-foundation.ch. You also have the right to receive your data in a commonly used file format if we process your data automatically and if

• you have given your consent for us to process this data; or
• you have disclosed data in connection with the conclusion or performance of a contract.

We may restrict or refuse to provide information or data if this conflicts with our legal obligations, legitimate own or public interests or the interests of a third party. The processing of your request is subject to the statutory processing period of 30 days. However, we may extend this period due to a high volume of requests, for legal or technical reasons, or because we need more detailed information from you. You will be informed of the extension of the deadline in good time, at least in text form.

Deletion and correction
You have the option to request deletion or correction of your data at any time. We can reject the request if legal regulations oblige us to keep the data longer or unchanged, or if a permissible circumstance conflicts with your request. Please note that the exercise of your rights may, under certain circumstances, conflict with contractual agreements and may have corresponding effects on the performance of the contract (e.g. premature termination of the contract or cost consequences).

Legal recourse
If you are affected by the processing of personal data, you have the right to enforce your rights in court or to file a report with the competent supervisory authority. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner: https://www.edoeb.admin.ch

7.1 Provision of the website and creation of log files

What information do we receive and how do we use it?
By visiting our website, certain data is automatically stored on our servers or on servers of services and products that we obtain and / or have installed, for system administration purposes, for statistical or backup purposes or for tracking purposes. These are:

• the name of your internet service provider;
• your IP address (under certain circumstances);
• the version of your browser software;
• the operating system of the computer used to access URL;
• the date and time of access;
• the website from which you are visiting URL;
• the search words you used to find URL.

Why may we process this data?
This data cannot be assigned to a specific person and there is no merging of this data with other data sources. The log files are stored to guarantee the functionality of the website and to ensure the security of our information technology systems. This is our legitimate interest.

How can you prevent data collection?
The data is only stored for as long as is necessary to achieve the purpose for which it was collected. Accordingly, the data is deleted after the end of each session. The storage of log files is absolutely necessary for the operation of the website, so you have no possibility to object to this.

7.2 Tracking pixel

How do tracking pixels work?
We may use tracking pixels on our website. Tracking pixels are also referred to as web beacons. Tracking pixels - also from third parties whose services we use - are small, usually invisible images that are automatically retrieved when you visit our website. Tracking pixels can be used to collect the same information as server log files. We use them for the same purposes as log files - you cannot prevent data collection.

7.3 Contact

What information do we receive and how do we use it?
You have the option to contact us by email. If you contact us by e-mail, the following data is processed:

• Email address;
• Content, subject and date of your email;
• Contact data (e.g. name, telephone number, address, if applicable) and information provided by you.

Why may we process this data?
Why may we process this data? Your information will be stored by us for the purpose of processing the request and in case of follow-up questions. The justification are pre-contractual measures or our legitimate interests in the completion of the request.

Security Note
We would like to point out that emails can be read or changed unauthorized and unnoticed on the transmission path. Due to the spam filter, emails may be rejected if they are identified as spam by certain characteristics.

7.4 Success and reach measurements

How does success and reach measurement work?
Our notifications and communications may contain web links or tracking pixels that record whether an individual communication was opened and which web links were clicked on. Such web links and tracking pixels may also track the use of notifications and communications on a personal basis.

Why may we process this data?
We need this statistical recording of usage for performance and reach measurement in order to be able to offer notifications and communications effectively and in a user-friendly manner based on the needs and reading habits of the recipients, as well as permanently, securely and reliably.

7.5 Cookies

How do cookies work?
Our website uses cookies. Cookies are data records that are stored on the operating system of your device with the help of the browser when you access our website. Cookies do not harm your computer and do not contain viruses.

What information do we receive and how do we use it?
Most of the cookies we use are so-called "session cookies". They are automatically deleted after the end of your visit. Other cookies remain stored on your end user device until you delete them. These cookies allow us to recognize your browser on your next visit. This allows us to save certain settings (such as language settings or location information) so that you do not have to re-enter them the next time you visit the website.

Why may we use cookies?
We use cookies so that we can make our website more user-friendly, effective and secure. The use of cookies and the processing of your data in this regard is based on our legitimate interests in the aforementioned purposes.

How can you prevent data collection via cookies?
Cookies are stored on your computer. You therefore have full control over the use of cookies. You can delete them completely or disable or restrict the transfer by changing the settings in your browser. If cookies are deactivated for our website, it may no longer be possible to fully use all the functions of the website.

7.6 Google Analytics

How does Google Analytics work?
We use Google Analytics, a service provided by Google Ireland Ltd, Google Building Gordon House, Barrow St, Dublin 4, Ireland and Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA; both together "Google", where Google Ireland Ltd is responsible for processing personal data. Google uses cookies that are stored on your device and enable an analysis of your website usage. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States.

Why may we use Google Analytics?
Google evaluates the collected data on our behalf so that we can get a picture of visits and user behavior on our website. This allows us to improve our services and website content as well as design.

How can you prevent Google Analytics from collecting your data?
You can prevent the storage of cookies by adjusting the settings in your browser accordingly (see our comments on cookies). You can deactivate Google Analytics by downloading and installing the Google browser add-on: https://tools.google.com/dlpage/gaoptout

7.7 Fonts.com

We use Fonts.com API services to enable our website to display content with fonts from Fonts.com. The provider is Monotype Imaging Holdings Inc, 600 Unicorn Park Drive, Woburn, Massachusetts 01801 USA. When you visit this website, your browser loads the required fonts directly from Fonts.com so that they can be displayed correctly on your end user device. This enables Monotype to know that your IP address has been used to access this website. According to Monotype, no cookies are stored when the fonts are provided.

The privacy policy for tracking web fonts from Monotype can be found here: https://www.monotype.com/legal/privacy-policy/web-font-tracking-privacy-policy

7.8 Polyfill

We use API services provided by Polyfill.io. We use this data to ensure the full functionality of our website. In doing so, functions that are not supported by your browser are transmitted from our servers to polyfill.io, which in turn sends a so-called polyfill to your browser to replace the unsupported function. The provider is The Financial Times Limited, 1 Southwark Bridge, SE1 9HL London, United Kingdom (hereinafter: polyfill.io).

For more information on the handling of transmitted data, please see the privacy policy of polyfill.io: https://polyfill.io/v3/privacy-policy