Cookie Information

1. What is this about?

This Cookie Information tells you how and why we use log data, cookies, similar technologies and third-party services when you use our website and our customer area (together, the "website"), and how we process personal data and other data in doing so.

Further information on how we handle your personal data is available in our Privacy Policy. Unless this Cookie Information provides otherwise, the Privacy Policy applies in addition.

2. Who is responsible?

The controller within the meaning of the Data Protection Act for the processing of personal data under this Cookie Information is:

Anida AG, Förrlibuckstrasse 189, 8005 Zurich, privacy@anidalab.ch

References to "Anida", "we" or "us" are references to the controller named above. Where we are a joint controller with a third-party provider for individual processing activities, we say so below.

3. What is log data?

Every connection to a web server necessarily results in certain information being logged and stored in what are known as log files. This includes, for example:

• the IP address of your device;
• the date and time of access;
• the name and URL of the data retrieved and the website from which the access took place (referrer URL);
• the browser type and version and other information transmitted by the browser (e.g. operating system, geographical origin, language setting);
• information about your internet service provider.

We process this data to ensure a smooth connection and convenient use of our website and to evaluate system security and stability. In the event of attacks on our IT infrastructure or other potentially unlawful or abusive use, we may evaluate the log data together with other data we hold in order to investigate and defend against such use, and use it in proceedings for identification and for civil and criminal action. Log data arises regardless of your cookie choice; its processing is based on our legitimate interest in the secure operation of our website. We generally keep log data for six months.

4. What are cookies and similar technologies?

Cookies are usually small text files that your browser creates automatically and stores on your device (computer, tablet, smartphone etc.) when you visit our website. Cookies contain an identifier (ID) that allows us to distinguish individual visitors from one another, generally without identifying them. Session cookies store your entries while you navigate within the website; they are deleted at the latest when you close your browser. Persistent cookies remain stored for a certain period after the browser is closed — generally between a few days and two years — and serve to recognise you on a later visit.

Cookies may be set by us (first-party cookies) or by third-party providers whose functions we use on our website (third-party cookies). Similar technologies include, for example, pixel tags (invisible images or program code loaded from a server, transmitting certain information to the server's operator), fingerprints (information about the configuration of your device and browser that makes it distinguishable from others) and other technologies for storing data in the browser (e.g. "web storage", i.e. local storage and session storage).

5. What types of cookies and similar technologies do we use?

• Necessary cookies. Necessary cookies are required so that our website and its functions can be used. They ensure, for example, that you stay logged in, that your entries are retained when you move between pages and that your cookie choice is stored. We use these cookies on the basis of our legitimate interest in operating our website; they cannot be disabled.
• Analytics cookies. Analytics cookies collect information about how our website is used and enable us to carry out evaluations, e.g. which pages are visited most often and how visitors move around the website. These cookies serve to optimise our website and improve usability.
• Functional cookies. Functional cookies allow us to provide enhanced functions and show you personalised content, e.g. by storing information you have already provided such as your language choice. This category also includes embedded third-party content (see section 7 below).
• Marketing cookies. Marketing cookies help us and our advertising partners to address you on our website and on third-party websites and platforms with advertising for products or services that may be of interest to you, and to measure the effectiveness of our advertising.

We only use analytics, functional and marketing cookies where you have given us your consent. You can withdraw your consent at any time with effect for the future (section 10 below).

Overview of the cookies and storage technologies we use

Necessary (no consent required, needed for operation):

• anida_session – Anida, cookie – keeps you logged in and preserves your entries across page changes – 30 days;
• anida.consent – Anida, local storage – stores your cookie choice and its version so that we do not ask you again – 12 months;
• anida.nl – Anida, local storage – remembers that you closed the newsletter notice – 30 days;
• anida.promo.seen, anida_after_login, anida_account_draft – Anida, session storage – remember a notice already shown, the page to return to after login, and an unsaved form draft – until you close your browser;
• _GRECAPTCHA – Google, cookie – spam protection for our forms (see section 7 below) – 6 months;
• __stripe_mid, __stripe_sid – Stripe, cookie – fraud prevention during payment; only set when you open a payment – 1 year and 30 minutes respectively.

Analytics and marketing (only with your consent): cookies and similar technologies from Google Analytics, Hotjar and Meta, as described in section 6. If you have not consented, these services are not loaded and set no cookies.

6. How do we use other companies' cookies and similar technologies?

The cookies and similar technologies we use come partly from us and partly from third-party providers whose functions we use. Such providers may also be located outside Switzerland and the European Economic Area (EEA) (see section 9 below).

Third-party providers may record the use of our website and combine those records with information from other websites. The behaviour of individuals can therefore be traced across several websites and devices. The provider in question can often also use this data for its own purposes, e.g. for personalised advertising. If you are registered with the provider, it may attribute the usage data to your account. This processing takes place under the responsibility of the respective provider and in accordance with its own privacy provisions.

Google Analytics

We use Google Analytics 4, an analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (together "Google"). Using cookies and similar technologies, Google collects information about your behaviour on our website and about the device used, e.g. pages visited, time spent, source of the visit, operating system and browser. We have configured the service so that your IP address is truncated within Switzerland or the EEA before being transmitted to the USA.

Google produces reports for us and acts in that respect as our processor; we have concluded a corresponding agreement with Google. Google also processes certain data for its own purposes and under its own responsibility and may link it to any Google account you may have. Further information is available at support.google.com/analytics/answer/6004245 and in Google's privacy policy at policies.google.com/privacy.

Hotjar

We use Hotjar, an analytics service of Hotjar Ltd., Dragonara Business Centre, 5th floor, Dragonara Road, Paceville, St Julian's STJ 3141, Malta. Hotjar records how our website is used (e.g. mouse movements, clicks, scrolling behaviour, page views) and provides us with the evaluations as heatmaps and session recordings. We use these evaluations to improve the usability of our website. The cookies set by Hotjar are first-party cookies.

Hotjar acts as our processor; we have concluded a corresponding agreement with Hotjar. Entries in form fields are not recorded. Hotjar is not loaded at all in the customer area, and the health questionnaire is technically excluded from recording, so that no health information can be captured. You can object to processing by Hotjar in general via Hotjar's website (hotjar.com/policies/do-not-track). Further information is available in Hotjar's privacy policy at hotjar.com/legal/policies/privacy.

Meta pixel and Custom Audiences

We use the "Meta pixel" and similar technologies of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta"). This allows us to show our advertisements on Meta's platforms (e.g. Facebook, Instagram) and in the Audience Network specifically to people who have shown an interest in us or whose characteristics match those of our visitors (known as "Custom Audiences"). It also allows us to understand whether you reached our website after clicking on an advertisement and which actions you take there (known as "conversion measurement").

We are joint controllers with Meta for the collection and transmission of data via the Meta pixel; we have concluded the "Controller Addendum" with Meta (facebook.com/legal/controller_addendum). You can address access requests and other matters relating to this joint controllership directly to Meta. Meta's further processing of the data takes place under its sole responsibility; information about this is available in Meta's privacy policy at facebook.com/privacy/policy and in the advertising settings at facebook.com/ads/settings.

The Meta pixel is loaded only on the pages of our public site; it is not loaded in the customer area. It does not capture form entries.

7. Which third-party services do we embed on our website?

We embed individual third-party functions on our website. These are loaded directly from the respective provider's server when the relevant page is opened. In doing so, the provider necessarily receives your IP address and further technical information (e.g. browser type, operating system, referrer URL), regardless of whether cookies are set. Without this transmission the function cannot be provided. The provider may also process this information for its own purposes; if you are logged in with them, they may attribute the request to your account.

Fonts and the program libraries and style sheets we use are served from our own servers; no data is transmitted to third parties in the process.

We currently embed in particular the following services:

• Spam protection: Google reCAPTCHA of Google Ireland Limited, to distinguish between entries made by humans and automated access on forms and in the customer area. To do so, reCAPTCHA collects information about your device and your usage behaviour. The service is necessary for the secure operation of our website and is used on the basis of our legitimate interest; it is only loaded once you begin working with a form. Privacy policy: policies.google.com/privacy;
• Payment processing: Stripe of Stripe Technology Europe Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland, and Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA. When you open a payment, the payment form is loaded from Stripe; in doing so Stripe collects information about your device and usage behaviour for fraud prevention and sets its own cookies. The service is necessary to process your payment. Privacy policy: stripe.com/privacy;
• Address autocomplete: Google Maps Platform (Places) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the customer area this service suggests matching addresses as you enter one. It is loaded only in the customer area and only with your consent to functional cookies; without consent you can enter your address manually. Privacy policy: policies.google.com/privacy.

8. Where do we process your data?

Our website, including the customer area, is operated on the infrastructure of Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland, in the Zurich cloud region (europe-west6). The content of our website and the data in your customer account are therefore stored on servers in Switzerland. Google acts in that respect as our processor and may only process the data as we ourselves would be permitted to; we have concluded a corresponding agreement with Google. Access from abroad for support and maintenance purposes cannot be ruled out.

9. Why and how do we transfer data abroad?

In connection with the services described above, personal data may be disclosed in particular to the following countries:

• Ireland and Malta (EEA) – Google Ireland Limited, Google Cloud EMEA Limited, Meta Platforms Ireland Limited, Hotjar Ltd., Stripe Technology Europe Limited;
• United States of America – Google LLC, Meta Platforms, Inc. and Stripe, Inc. as group companies of the aforementioned providers.

The European Economic Area is listed in Annex 1 to the Data Protection Ordinance as an area with adequate data protection. For disclosure to the United States, which does not guarantee data protection comparable to Swiss law, we rely on the standard data protection clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), on the Swiss-U.S. Data Privacy Framework where the respective recipient is certified, or on your consent.

10. How can you disable cookies and similar technologies?

You can withdraw your consent at any time with effect for the future and adjust your choice: open cookie settings. Withdrawal has no effect on processing that has already taken place.

You can also configure your browser so that it does not automatically accept cookies and similar technologies, or so that it deletes existing cookies and other data stored in the browser. You can also extend your browser with additional software (known as "add-ons" or "plug-ins") that prevents tracking by certain third parties. You will generally find further information in your browser's help pages under "privacy". Please note that partially or fully disabling cookies may mean you cannot use all functions of our website.

The following provider-specific options are also available:

• Google Analytics: browser add-on to opt out at tools.google.com/dlpage/gaoptout;
• Hotjar: do-not-track function at hotjar.com/policies/do-not-track;
• Meta: advertising settings at facebook.com/ads/settings.

11. What rights do you have?

As a data subject you have the rights described in our Privacy Policy, in particular the right of access, to data release or portability, to rectification, to erasure and the right to withdraw your consent. Conditions and exceptions apply to these rights. If you wish to exercise your rights, please contact the address given in section 2.

12. Changes to this Cookie Information

We may change this Cookie Information at any time, in particular if we adjust our data processing or if new legal requirements have to be taken into account. The version published on our website at the relevant time is authoritative. The current version can be accessed on this page at any time.