Data Privacy Guideline of DIAMETAL Group

(As at: August 2019)

Our website www.diametal.com (hereinafter “the Website”) is the website of DIAMETAL Group based in Biel/Bienne (BE) (hereinafter “Company” or “we”). The Company is a subsidiary of Kowema AG with registered office in Risch, Switzerland.

We are aware that the responsible and secure use of your personal data in connection with the use of our Website is important. We therefore attribute great significance to data privacy. In the following, this Data Privacy Guideline explains our practices in the use and protection of personal data.

1.  Scope

By accessing or using our website and providing us with your personal data, you agree to the collection and use of your personal data as per this Data Privacy Guideline. In particular, you consent to your data being passed on to associated businesses or third parties in Switzerland and abroad so that your query or the products or services we supply to you can be processed efficiently.

The links on this Website may lead to content on other websites to which this Data Privacy Guideline does not apply.

“Personal data” is defined as all the information that relates to an identified or identifiable person.

We consider it as a matter of course that we observe the legal requirements of the Swiss Federal Act on Data Protection (DSG), the Ordinance to the Federal Act on Data Protection (VDSG), the Telecommunications Act (FMG) and other provisions of the Swiss data privacy legislation. With regard to the personal data of users from the European Union we will also observe the provisions of the EU General Data Protection Regulation (DSVGO).

The continuous development of the internet requires us to update these Data Privacy Guidelines from time to time. The Company reserves the right to make the necessary changes. We therefore recommend that you review these Data Privacy Guidelines regularly. Only the German version of this Data Privacy Guideline is legally binding.

2.  Contact point for data privacy questions

If you have any questions or suggestions in connection with data processing or data privacy, please contact the coordination office at the address below:

Kowema AG
Lettenstrasse 2
6343 Rotkreuz
Switzerland
T +41 44 787 57 90
dataprivacy@kowema.ch

3.  General remarks on data processing

We process the personal data of our users only to the degree that it is necessary to make available a functional Website and our content and services. Our users’ personal data is processed regularly subject to the user in question giving his or her prior consent, unless it is impossible to obtain such prior consent for genuine reasons and the processing of the data is permitted by legal provisions.

4.  Collection of general data and information

We collect a range of general data and information every time our Website is visited by a person concerned or an automated system. Such general data and information are stored in the server’s log files. The types of data that may be collected are, for example (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which a visiting system arrives at our website (called the referrer), (4) the pages visited on our website by the visiting system, (5) the date and time of access to the website, (6) an internet protocol address (IP address), (7) the visiting system’s internet service provider and (8) other similar data and information serving to protect our IT systems from attacks.

When using such general data and information, we draw no conclusions about the person concerned. Instead, this information is required (1) to deliver our website content correctly, (2) to optimise our website content and the advertising for it, (3) to safeguard the long-term functionality of our IT systems and our website’s technology and (4) to provide law enforcement agencies with the information they need in the event of a cyber attack. We gather the data and information anonymously, and therefore analyse them statistically and also with the objective of increasing data protection and data security within the company – in order ultimately to achieve an optimum level of protection for the personal data that we process.

5.  Purpose and legal basis of data processing

The personal data you provide to us are only used for the purpose for which you provide them to us (e.g. to supply you with the requested products or services or for other purposes to which you have given your consent), unless otherwise provided for by the law. The data you provide or which is automatically or passively collected about you is periodically used for statistical or other uses (including for purposes of third-party providers of cookies and/or related technologies).

      5.1.  For the fulfilment of contractual duties

The data are processed in the course of performing our contracts with our customers or to carry out precontractual activities on request. The purposes of data processing refer primarily to the specific product or service we supply. The personal data collected in this way is used for the entire processing of your purchase, including any subsequent warranty claims, technical administration, etc. You will find further details of the data processing purposes in the relevant contract documentation and terms of business.

      5.2.  In the context of weighing up interests

If necessary, we process your data beyond the actual fulfilment of the contract to protect our justified interests or those of third parties. Examples include:

• • Consulting and exchanging data with information centres (e.g. debt collection register).
  • Checking and optimising demand analysis processes for the purpose of addressing the customer directly;
  • Advertising or market and opinion research, unless you have objected to the use of your data;
  • Asserting legal claims and defence in legal disputes;
  • Safeguarding IT security and IT operations;
  • Preventing or investigating criminal acts;
  • Measures to manage the business and develop services and products.

We also collect personal data from publicly accessible sources for customer acquisition purposes.

      5.3.  Based on your consent

Provided that you have given us consent to process your personal data for particular purposes, the processing is lawful on the basis of your consent. Any consent given can be revoked at any time. This applies also to the revocation of consent declarations that were granted to us before the DSVGO entered into force. Any revocation of consent does not affect the lawfulness of data processed up until the time of revocation.

      5.4.  Based on legal regulations or in the public interest

Furthermore, we as a Company are subject to various legal obligations requiring us to process and store your data.

6.  Cookies

Our Website uses cookies. Cookies are text files that are placed and stored on a computer system via an internet browser. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a series of characters enabling websites and servers to be associated with the specific internet browser in which the cookie has been stored. This enables the websites and servers visited and the individual browser of the person concerned to be distinguished from other internet browsers containing different cookies. A specific internet browser can be recognised and identified by the unique cookie ID.

Personal data can be collected with the help of cookies. The user is informed of this when visiting the website before the cookies are activated. The use of cookies enables the information and offers on our website to be optimised for the user’s benefit. Cookies allow us to recognise the users of our Website when they return. The purpose of this recognition is to make the use of our website easier for users.

Cookies have various functions. They may be necessary for the functioning of the server, to improve performance and make additional functions available. The cookies used on our Website may be session cookies which are automatically deleted from the user’s server after the session is ended, or they may be permanent cookies or flash cookies which are stored on the user’s device for an extended period. Cookies are protected in such a way that only authorised persons can interpret them.

Cookies can be deactivated or removed by tools that are available in most commercial browsers. The settings must be configured separately for each browser used. Certain functions, services and tools on our Website are only available if cookies are used. If cookies are blocked, it may not be possible to use certain functions, services or applications.

7.  Google Analytics

We use Google Analytics and other analysis instruments. Google Analytics is a web analysis service of Alphabet Inc. (“Alphabet”). Google Analytics also uses cookies. The information generated by the cookie regarding the use of the webpages is usually forwarded to an Alphabet server in the USA, for example, and stored there. Alphabet uses this information to evaluate the user’s use of the Website, compile reports on website activity and Internet usage, and deliver other services connected with the use of the website and the Internet. Alphabet may pass this information on to third parties if this is a statutory requirement or if third parties process the data on Alphabet’s behalf.

Users who do not want Google Analytics to evaluate their visit to our Website can activate the Google Analytics deactivation add-on for browsers. According to Google, this add-on instructs the Google Analytics Java script not to transfer any information about the visit to the website to Google Analytics.

8.  Contact options via e-mail or contact form on the Website

For the sake of customer-friendliness and for legal reasons, our Website contains information that allows you to contact us quickly by electronic means and to communicate with us directly. If you contact us via e-mail or by completing a contact form, you give your consent to the processing of the personal data you send and the response to your query.

You can revoke your consent at any time by e-mail to sales@diametal.com.

9.  Newsletter

Our Website offers the option of subscribing to a free newsletter. When you subscribe to the newsletter, you agree to the processing of the data you enter in order to receive our newsletter.

You can revoke your consent at any time by using the unsubscribe link provided in each newsletter or by e-mail to sales@diametal.com.

10.  Social Media

      10.1.  Integration of YouTube videos

We have integrated YouTube videos into our Website which are stored on http:/www.youtube.com and which can be played directly on our Website.

Playing these videos results in a connection being set up with YouTube and the Google DoubleClick network. This notifies YouTube that you visited the relevant page of our Website. The data listed in Section 4 are also transferred. Clicking on the video may trigger further data processing over which we, as the Website operator, have no influence. Therefore please consult YouTube’s data policy (available on the YouTube website) before you do so.

      10.2.  Integration of Google Maps

Our Website uses the products of Google Maps. This allows us to display interactive maps on the Website and provides you with convenient use of the map function.

Clicking these maps causes a connection to be set up with Google Maps and the Google DoubleClick network. This notifies Google Maps that you visited the relevant page on our Website. The data listed in Section 4 are also transferred. Clicking on the button may trigger further data processing over which we, as the Website operator, have no influence. Please therefore consult the Google Maps data policy (available on that website) before you do so.

      10.3.  Social networks

If you use the external links on our Website, this Data Privacy Guideline does not extend to these links. Please therefore consult the data policies of these websites before you do so.

11.  Storage duration

The criterion for how long personal data are stored is the relevant statutory or contractual storage period. In certain cases a retention obligation may be in place which exceeds the general legal retention obligation, for example in connection with the security of nuclear power stations or the traceability of products and services in the medical sector. In these cases, the longer retention obligation period applies.

If the purpose of storing the data no longer applies or a prescribed period expires, the personal data are routinely blocked or deleted in accordance with the statutory regulations.

12.  Disclosure of data to third parties

We only disclose your data to others if you have given your consent for this, if we are otherwise legally entitled to do so or if this is necessary in order to assert our rights. Furthermore, we may disclose your personal data to other businesses connected to Kowema if they agree to manage the data in accordance with this Data Privacy Guideline. Your personal data may also be passed on to third parties who act on our behalf or in our name so that they process the data for the purpose for which they were originally collected or for other legally permissible purposes, e.g. the provision of services, to assess the use of our Website, for marketing, data management or technical support.

The personal data you entered may also be passed on to third parties if the business is sold, assigned or transferred in whole or in part, including the associated customer data. In this case, we would oblige the buyer, assignee or transferee to treat personal data in accordance with this Data Privacy Guideline. Personal details may also be disclosed to third parties if we are compelled to do so for legal reasons, by a court order or official regulations or if this is necessary to support criminal or legal investigations or other legal enquiries or proceedings locally or abroad.

13.  Transmission of personal details to countries abroad

We are entitled to pass your data on to third-party businesses outside Switzerland if this is necessary to execute your orders, or is legally prescribed or you have issued us your consent.  These third-party businesses are obliged to protect your privacy to the same degree as we do ourselves. If the data privacy level in a country is considered insufficient for Swiss standards or within the meaning of the EU General Data Protection Regulation, we will ensure by means of a contract that your personal details are protected at all times in accordance with Swiss guidelines or the EU General Data Protection Regulation.

14.  Security

We use appropriate technical and organisational security measures to protect your personal data from manipulation, loss, destruction or access by unauthorised persons. We continuously revise and improve the security measures based on new technology developments. It is possible, however, that internet-based data transfers (e.g. when communicating by e-mail) will have security loopholes, so total protection cannot be guaranteed. It is not possible to protect data completely from access by third parties. This is why any person concerned is free to transfer personal data to us by alternative channels – by phone, for example.

15.  Rights of the person concerned

As far as allowed by the legal provisions in place, you, your legal successors, representatives and/or deputies have a right to information, correction, limitation, deletion and data transferability and objection in relation to your personal data.

      15.1.  Right to confirmation

All persons concerned are entitled to demand that the entity responsible for processing confirms whether their personal data are being processed.

      15.2  Right to information

All persons affected by the processing of personal data are entitled – at any time and free of charge – to demand information about the following from the entity responsible for processing:

• • the purposes of processing;
  • the categories of personal data being processed;
  • the recipients or categories of recipients to whom personal data has been or is being disclosed, especially where recipients are in third countries or are international organisations;
  • where possible, the period for which the personal data are to be stored or, if this is not possible, the criteria for determining that period;
  • the existence of a right to the correction or deletion of their personal data or to the restriction of its processing by the responsible entity or to a right of objection to its processing;
  • the existence of a right to submit a complaint to a supervisory authority;
  • all the available information about the source of the data, if the personal data were not collected from the person concerned;
  • the existence of automated decision-making.

The persons concerned are also entitled to information on whether their personal data have been transmitted to a third country or an international organisation. If this is the case, the person concerned is also entitled to information on appropriate guarantees in connection with the transmission.

      15.3.  Right of correction

Any person affected by the processing of their personal data have the right to demand that incorrect personal data relating to them be corrected without delay. Furthermore, the person concerned is entitled, while taking the purposes of processing into account, to demand that their incomplete personal data be completed, if necessary by means of a supplementary statement.

      15.4.  Right of deletion

Any person affected by the processing of their personal data have the right to demand that the responsible entity delete their personal data without delay, especially if one of the following reasons applies and processing is not necessary:

• • the personal data were obtained or otherwise processed for purposes for which they are no longer needed;
  • the person concerned revokes their consent on which processing was based and there was no other legal basis for the processing;
  • the person concerned objects to the processing and there are no predominant justified reasons for processing;
  • the personal data have been unlawfully processed;
  • deletion of the personal data is required to fulfil a legal obligation applicable to the responsible entity.

      15.5.  Right to restrict processing

All persons affected by the processing of their personal data have the right to demand that the responsible entity restrict processing if one of the following conditions is met:

• • the person concerned disputes the correctness of the personal data, for a period enabling the responsible entity to verify their correctness;
  • the processing is unlawful, the person concerned rejects the deletion of the personal data and demands instead that their use be restricted;
  • the responsible entity no longer needs the personal data for the purposes of processing, but the person concerned needs them to assert, exercise or defend legal entitlements;
  • the person concerned has lodged an objection to processing and it is not yet clear whether the responsible entity’s entitlement outweighs that of the person concerned.

      15.6.  Right of data transferability

All persons affected by the processing of their personal data have the right to be supplied with the personal data relating to them that was given to a responsible entity by the person concerned, and in a structured, standard, machine-readable format. Such persons are also entitled to transmit these data to another responsible entity without hindrance by the responsible entity to whom the personal data were supplied, provided that processing is based on consent or a contract and processing is conducted with the aid of automated processes if processing is not necessary for the fulfilment of a task in the public interest or in the exercise of official authority transferred to the responsible entity.

      15.7.  Right of objection

All persons affected by the processing of their personal data are entitled, for reasons that arise from their specific situation, to object to the processing of personal data relating to them. This also applies to profiling based on these provisions. In the event of an objection we will no longer process personal data unless we can demonstrate that there are legitimate reasons for doing so that outweigh the interests, rights and liberties of the person concerned, or that processing serves the assertion, exercise or defence of legal entitlements.

      15.8.  Right to revoke consent under data protection law

All persons affected by the processing of their personal data have the right to revoke consent for the processing of personal data at any time. For the sake of clarity, such revocation has no effect on the legality of processing done on the basis of the consent given before the revocation.

      15.9.  Right to lodge an objection to a regulatory authority

If you reside in the European Union (EU), you may have the right to lodge an objection to a regulatory authority if you do not agree to the processing of your personal data.

16.  Notes for children and parents

Children are entitled to particular protection with regard to their personal data because they may be less aware of the respective risks, consequences and guarantees and their rights with regard to the processing of their personal data. Our Website is intended for an adult audience. Underage persons, especially children under the age of 13, are forbidden to send personal data to us themselves or to register for one of the services. If we discover that such data have been sent to us, we will delete them from our database. The parents (or the legal guardian) of the child can contact us and request the deletion or deregistration. For this we require a copy of an official document that proves that you are the parent or guardian.

17.  Applicable law and place of jurisdiction

The relationship between the user and the Company arising from the use of the Website is subject to material Swiss law with the exclusion of conflict-of-laws provisions and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

The place of jurisdiction is Biel/Bienne (BE). Responsibility lies with the ordinary courts of law. This Company is however entitled to sue the user at his/her residence or the company represented by the user at the seat of its registered office.