Privacy Policy

This Privacy Policy tells you which personal data (data that identifies you directly or indirectly) we collect and process in connection with our activities. It applies to all processing activities involving personal data. We handle the data we receive and collect responsibly, in accordance with applicable law and with this Privacy Policy. Our processing is generally governed by the Swiss Federal Act on Data Protection (FADP).

Where we consider it useful, we provide supplementary privacy notices and other legal documents (in particular terms and conditions and terms of participation) for individual or additional processing. The processing of health data in the booking process is additionally governed by the Information on the processing of health data.

1. Who is responsible?

The controller within the meaning of the Data Protection Act for the processing of your personal data as described in this Privacy Policy, unless stated otherwise in an individual case, is:

Anida AG, Förrlibuckstrasse 189, 8005 Zurich

References in this Privacy Policy to "Anida", "we" or "us" are references to the controller named above.

If you have a data protection concern, you are welcome to contact us at any time, in particular at the following email address: privacy@anidalab.ch

2. Which personal data do we process?

We collect and process in particular the following personal data about you:

Master data, such as name, address, email address, telephone number, gender, date of birth, social media profiles, photos, videos, relationship details (customer, service provider etc.), history, official records (e.g. commercial register extracts, permits), details of newsletters or other advertising you have subscribed to (including consents);
Communication data, such as contact details, the manner of communication (telephone, email, text messages, video messages etc.) and the place, date, time and content of the communication;
Registration data, such as user name, login details, email address;
Financial data, such as payment details and credit information;
Contract data, meaning data arising in connection with the conclusion or performance of a contract, such as details of the contract, acquired rights and claims, customer satisfaction information and purchase information (e.g. date, place, time and history of purchase as well as quantity, type and value of goods and services);
Technical data, such as IP address, operating system, date, time and geographical information;
Support and compliance data, such as support requests, feedback and communication-related incidents;
Behavioural data, such as the duration and frequency of visits to our website, the date and time of a visit or of opening a message (newsletter, email etc.), the location of your device and your interaction with our online presences on social networks or other third-party platforms;
Preference data, such as user settings and data derived from analysing the data collected (in particular behavioural data);
Health data (sensitive personal data) that you voluntarily provide to us in connection with the planning and delivery of our services, in particular information about your state of health and any medical risks relating to the services to be provided. Details are set out in the Information on the processing of health data;
Other data that you provide to us about yourself.

3. How do we collect personal data?

We collect your personal data in a variety of ways: data you have provided to us (e.g. by email, telephone, post or video call), data we receive from third parties (e.g. business partners, authorities) and data we collect about you (e.g. from publicly accessible registers, websites or business partners).

Data you provide

You provide us with your personal data when you interact with us, for example in the following circumstances:

When you communicate with our staff;
When you submit a form on our website (e.g. contact or registration form);
When you create a user account with us;
When you use our customer portal;
When you visit our premises;
When you attend our customer events and public events;
When you purchase our products or services (on site or online);
When you register in order to use certain offers and services (e.g. the newsletter);
When you take part in one of our competitions or prize draws;
When you apply for a position with us.

The data you provide is in particular master, communication, registration and contract data, but also preference data.

Providing personal data is generally voluntary, i.e. in most cases you are not obliged to disclose personal data to us. However, we must collect and process the personal data required or prescribed by law for the performance of a contractual relationship and the fulfilment of the associated obligations, e.g. mandatory master and contract data. Otherwise we cannot enter into or continue the contract in question. We generally tell you in which cases the personal data we request is strictly necessary.

If you provide us with data about other people (e.g. family members, employees), we assume that you are entitled to do so and that the data is accurate. Please make sure those other people are aware of this Privacy Policy.

Our offerings are generally not aimed at children and young people under the age of 16. Where we process personal data of minors, we assume that the necessary consent of the holder of parental responsibility has been given.

Data we receive

We may also receive personal data about you from third parties, for example:

From business partners we work with, e.g. banks, insurers, distribution and other contractual partners;
From people who communicate with us;
From credit agencies, e.g. when we obtain credit information;
From address traders or Swiss Post, e.g. for address updates;
From providers of online services, e.g. internet analytics and communication services;
From authorities and courts, in connection with official and judicial proceedings.

The data we receive is in particular master, communication, financial and contract data, but also preference data.

Data we collect

We may also collect your personal data ourselves or automatically, for example in the following circumstances:

When you use our products and services;
When you order and/or purchase products or services from us;
When you visit our websites or use our customer portal;
When we consult publicly accessible sources (e.g. public registers, websites, platforms);
When we obtain information about you from your organisation or another organisation (e.g. for reference purposes in an application process, if you agree);
When we work together with business partners;
When you click a link in one of our newsletters or otherwise interact with one of our electronic marketing messages.

The data we collect is in particular master data, behavioural data and technical data.

We may also derive further personal data from data we already hold, e.g. by analysing behavioural data. Such derived personal data is often preference data.

4. For what purposes do we process personal data?

We process your personal data primarily in order to conclude and perform our contracts with you, our customers and our business partners. In particular, we also process your personal data for the following purposes:

to communicate with you;
to provide and improve our services (including our websites) for you and our customers;
to manage the business relationship with you and our customers;
to operate our customer portal, in particular for registration and login, account administration and user support, secure hosting, controlled access and activity logs;
to carry out advertising, marketing, market research and product development;
to ensure your safety and ours and to prevent misuse (e.g. for IT security, theft, fraud and abuse prevention and for evidentiary purposes);
to comply with legal and regulatory obligations;
to enforce our claims and defend ourselves against the claims of others;
to prepare and carry out the sale or purchase of business divisions, companies or parts of companies and other corporate transactions, including the associated transfer of personal data;
for business management purposes;
to use the health data you voluntarily provide (sensitive personal data) to assess training-related risks and to ensure the safe delivery of the training you have booked. The details, in particular on access and retention, are set out in the Information on the processing of health data.

When processing personal data for the purposes described in this policy, we rely among other things on our legitimate interest in maintaining, developing and managing the business relationship and communication with you as a business partner about our products and services.

For certain purposes you may give us your consent to process your personal data. Unless we have another legal basis, we process your personal data within the scope of and on the basis of that consent. You may withdraw your consent at any time. Withdrawal has no effect on processing that has already taken place.

5. Why and how do we share data?

We may pass your personal data to trusted third parties where this is necessary or useful for the provision of our services or the fulfilment of the purposes defined in this Privacy Policy.

We may pass your personal data to the following categories of recipient: external service providers (e.g. IT service providers, auditors, freight forwarders, payment services); customers and other contractual partners; opposing parties, their legal representatives and the persons involved; business partners with whom we may need to coordinate the provision of services; authorities and courts. Please note that these recipients may in turn involve third parties, so that your data may also become accessible to them.

Where we share your personal data with processors that process it on our behalf, this is done on the basis of our instructions and in accordance with this Privacy Policy and other appropriate confidentiality and security measures. These processors may only process your personal data as we ourselves would be permitted to do. For example, we use service providers to support the operation of our IT infrastructure, to provide our products and services, to improve our internal business processes and to offer additional support to our customers.

We generally process your personal data only in Switzerland and the European Economic Area (EEA) (see also section 6 below). For our websites we use third-party services; please see our Cookie Information (section 13 below) for information on the independent collection of data by those providers.

Access to the specific answers in the health questionnaire is limited to the instructors of the class you have booked and to those people who strictly need it for administration, data protection or the clarification of a specific legal case.

6. Why and how do we transfer data abroad?

We may transfer your personal data to recipients in the European Economic Area (EEA) as well as to recipients in the USA and in other countries that do not guarantee adequate data protection (so-called third countries). We normally do so where it is necessary to perform a contract or to enforce legal claims. Where we disclose data to further third countries and this is not already known to you (e.g. from a contract or from communication with us), the relevant country, international body or at least the region can generally be found at the appropriate place in this Privacy Policy and in particular in the Cookie Information. We transfer your personal data to a third country only where the data protection requirements are met (e.g. after concluding recognised standard data protection clauses, under the Swiss-U.S. Data Privacy Framework or on the basis of consent obtained) or where we can rely on an exemption. An exemption may apply in particular in cases of overriding public interest or where the performance of a contract in your interest requires such disclosure.

7. How do we use profiling?

"Profiling" means the automated processing of personal data in order to analyse personal aspects or make predictions (e.g. analysis of personal interests and habits). Profiling generally derives preference data. We use profiling in particular in the automated processing of master, contract, behavioural and preference data when you use and purchase our products and services, and also in connection with our websites, events, competitions and prize draws. We use profiling in particular to improve our offerings, to present them and our content in a way that meets your needs, to present you only with advertising and offers that are likely to be relevant to you, and to decide which payment options are available to you following a credit check. As a basis for profiling we may also combine personal data from different sources in order to improve the quality of our analyses and forecasts.

We do not use your health data for profiling.

8. How do we make automated individual decisions?

"Automated individual decisions" are decisions taken fully automatically, i.e. without human involvement, which have legal consequences for the data subject or may otherwise significantly affect them.

We generally do not use automated individual decisions; if we do, we will inform you separately in the individual case.

Should automated individual decisions be introduced in the future, we will ensure that appropriate safeguards are implemented in accordance with applicable law. In particular, data subjects would have the right to state their point of view and to request that the decision be reviewed by a natural person.

9. How do we protect data?

We take appropriate technical (e.g. firewall, SSL encryption, password protection) and organisational (e.g. access restrictions, training of authorised persons) security measures to safeguard your personal data. Through these measures we protect your personal data against unauthorised or unlawful processing, against unauthorised access and against accidental loss, alteration or disclosure. Please always bear in mind that transmitting information over the internet and other electronic means involves certain security risks. We cannot guarantee the security of information transmitted in this way.

10. How long do we keep data?

We keep your personal data for as long as required by our processing purposes (see section 4), statutory retention periods (generally five or ten years) and our legitimate interests, in particular for documentation and evidentiary purposes, or where storage is technically necessary (e.g. in the case of backups or document management systems). Unless legal or contractual obligations or technical reasons prevent it, we generally delete or anonymise your personal data after the storage and processing period has expired, as part of our usual procedures and in accordance with our retention policy.

A significantly shorter period applies to the specific answers from the health questionnaire; the details are set out in the Information on the processing of health data.

11. Newsletter

We offer you the option of subscribing to our newsletter, in which we inform you about news at regular intervals. So that we can send you the newsletter by email, you must give us your consent in a double opt-in procedure, i.e. we only send you a newsletter if you have expressly confirmed this to us beforehand. You can unsubscribe at any time, e.g. using the link at the end of every newsletter, or by telling us by email that you wish to unsubscribe.

For sending the newsletter we use Mailchimp, a service of The Rocket Science Group, LLC (an Intuit company), 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

When you sign up for the newsletter we collect your email address. Any further information is voluntary. So that we can determine whether a newsletter email has been opened and which links have been clicked, we process certain data. Technical information (e.g. time of retrieval, IP address, browser type and operating system) is also recorded. We process all of this data for the purpose of sending the newsletter and analysing the newsletter campaign. We keep your data until you unsubscribe from the newsletter; after that we continue to keep the information required to implement the unsubscription and to demonstrate your consent. Data stored for other purposes remains unaffected.

You can find more information about the data collected in Intuit's (Mailchimp's) privacy policy at intuit.com/privacy/statement.

12. Social media

We may operate pages and other online presences on social networks and other third-party platforms (e.g. fan pages, channels, profiles) and there collect and process data about you (in particular contact and profile data) that you or the social networks provide to us. We receive the data when you get in touch with us via our online presence (e.g. by viewing and commenting on posts). We receive aggregated or otherwise sufficiently anonymised data from the platforms for evaluation, so that we can further develop the posts and services we offer. We process the data in particular for communication, for marketing purposes (including advertising on these platforms) and for market research. We may further distribute content you have published yourself, or delete or restrict content from or about you in accordance with the usage guidelines. Personal data may also be processed outside Switzerland and the European Economic Area (EEA).

The platforms also evaluate your use of our online presences and link this data with other data about you known to the platforms. They also process this data for their own purposes and under their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to manage their platforms (e.g. which content they show you).

When using the platforms, further legal documents (e.g. terms and conditions and terms of use) apply in addition to the respective privacy policies.

We currently use the following platforms:

Instagram including Insights, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. More information about the data processing is available in Instagram's privacy policy at privacycenter.instagram.com/policy;
Facebook including Page Insights, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We are joint controllers with Meta Platforms Ireland Limited and have concluded the "Controller Addendum" (facebook.com/legal/controller_addendum). More information about the data processing is available in Facebook's privacy policy at facebook.com/privacy/policy;
LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, whereby data may also be transferred to the USA. We are joint controllers with LinkedIn and have concluded the "Page Insights Joint Controller Addendum" (legal.linkedin.com/pages-joint-controller-addendum). More information about the data processing is available in LinkedIn's privacy policy at linkedin.com/legal/privacy-policy.

13. Cookies and similar technologies

When you visit our websites we use log data, cookies, similar technologies and third-party services, and in doing so process personal data and other data. This also includes embedded third-party content that establishes a connection to the provider when the relevant page is loaded.

How and why this happens, which categories of cookies we use, which third-party providers are involved, to which countries personal data is disclosed and how you can give, change or withdraw your consent is described in our Cookie Information. The Cookie Information forms an integral part of this Privacy Policy.

14. What rights do you have?

As a data subject you may assert various claims against us in accordance with the applicable national and international provisions. Where necessary, we will process your personal data again in order to fulfil your claims.

You have the following rights in relation to your personal data:

Right of access: you have the right to obtain information about which personal data we hold about you and how we process it;
Right to data release or portability: you have the right to receive or transfer a copy of your personal data in a common electronic format, provided it is processed automatically and processed with your consent or in direct connection with the conclusion or performance of a contract between you and us;
Right to rectification: you have the right to have your personal data corrected if it is inaccurate;
Right to erasure: you have the right to have your personal data deleted or destroyed;
Right to object: you have the right to object to the processing of your personal data to which you have consented (in particular in the case of processing for direct marketing purposes).

Please note that conditions and exceptions apply to these rights. Where legally permitted, we may restrict or refuse your request to exercise these rights. We reserve the right to redact copies for data protection or confidentiality reasons, or to provide extracts only.

If you wish to exercise your rights against us, or if you disagree with how we handle your rights or data protection, please contact us; our contact details are set out in section 1. So that we can rule out misuse, we must identify you (e.g. with a copy of an ID document if necessary).

15. Legal bases under the GDPR

We do not assume that the EU General Data Protection Regulation ("GDPR") applies in our case. Should this exceptionally be otherwise for certain processing activities, this section 15 additionally applies exclusively for the purposes of the GDPR and the processing subject to it.

We base the processing of your personal data in particular on the fact that

it is necessary, as described in section 4, for the initiation and conclusion of contracts and their administration and enforcement (Art. 6(1)(b) GDPR);
it is necessary to safeguard our legitimate interests or those of third parties as described in section 4, in particular for communication with you or third parties, to operate our website, to improve our electronic offerings and for registration for certain offers and services, for security purposes, for compliance with Swiss law and internal regulations for our risk management and corporate governance, and for further purposes such as training and education, administration, evidence and quality assurance, and the organisation, delivery and follow-up of events, as well as to safeguard other legitimate interests (see section 4) (Art. 6(1)(f) GDPR);
it is necessary to comply with a legal obligation under Union law or the law of a Member State (Art. 6(1)(c) GDPR) or is necessary to protect your vital interests or those of other natural persons (Art. 6(1)(d) GDPR);
you have separately consented to the processing, e.g. by way of a corresponding declaration on our website (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

If you are in the EEA, in addition to the rights in section 14 you also have the right to restriction of processing and you may lodge a complaint with the data protection supervisory authority in your country. A list of the authorities in the EEA is available at edpb.europa.eu.

16. How can we change this Privacy Policy?

We may change this Privacy Policy at any time or take up new processing activities. We also update this Privacy Policy from time to time to take account of legal requirements. We will inform you of such amendments and additions in an appropriate manner; in particular, we publish the current Privacy Policy on our website. The current version can be accessed on this page at any time.

← Back to home