GENERAL PRIVACY POLICY OF O4C OFFICE FOR CONTRACTS GMBH
Version: 1 January 2025
We take the protection of your personal data very seriously. In the context of legal ad-vice, services, courses and offerings („Services„), as well as on our websites, we em-phasize transparency and security in the processing of your data. The processing of personal data is carried out exclusively in accordance with applicable law.
In this Privacy Policy, we inform you and visitors to our websites („customers“ or „you„) about how we handle and process personal data and how you can contact us if you have any questions.
A. Privacy Policy
B. Terms and conditions for visiting our websites;
C. Cookie Policy;
D. Engaged Service Providers and Third Parties
In addition to these terms and conditions, customers must also take note of the fol-lowing legal notices in connection with this Privacy Policy:
• General Terms and Conditions of o4c Office for Contracts GmbH
o4c reserves the right to amend this Privacy Policy at any time. The version published at www.o4c.ch is the then-current version.
Who is responsible for the processing of the data?
Responsible for data processing in accordance with this Privacy Policy and the Con-troller under data protection law is, unless otherwise communicated in individual cases,
• o4c Office for Contract Gmbh, Thurstrasse 7, 8555 Müllheim / Schweiz (“o4c” or “we”)
You may contact us in in case of data protection concerns by email an-drea.waeber@o4c.ch.
A. Privacy Policy
o4c processes personal data of customers who are in direct or indirect contact with it. We use the term „data“ synonymously with the term „personal data„. Data means in-formation that relates directly to customers or that we can associate with a customer. In Section A.1 o4c provides information about the categories of data processed in ac-cordance with the information contained in this Privacy Policy. Processing means any handling of data, for example obtaining, storing, using, disclosing or erasing.
This Privacy Policy describes how we process data when customers use services or products from us, engage with us under a contract or in any other context, or com-municate with us. It applies to the processing of data that we have already collected or will collect in the future.
We provide information about certain data processing separately, for example in fur-ther data protection notices, in GTCs, in product and service descriptions, as well as in declarations of consent and contracts.
What data is processed, for what purpose and from which sources?
We process different types of data depending on the situation and purpose, sourced from various origins. Primarily, we collect and receive this data directly from our cus-tomers when they use our services and offerings or as part of general customer com-munication.
Additionally, we may obtain data from other sources, such as public registers or other publicly accessible sources, authorities, and other third parties.
o4c processes various categories of dat. The main categories of data are described below.
• Master data: Master data refers to data relating to the identity as well as per-sonal characteristics and circumstances, for example name, address or date of birth.
• Contract / Course Data: When a contract is concluded, we process not only master data but also additional information, such as details about the use of our services and offerings, including course data (participation status, pro-gress). Such data includes information related to contract execution, enforce-ment, and customer feedback.
• Behavioural and preference data: Behavioural data are data about certain ac-tions and interactions between our customers and o4c. Behavioural data pro-vide us with information about certain actions, for example logins, the purchase and use of services and courses from us or third parties.
Preference data provide us with information about your needs, which services and courses may be of interest, or when and how messages from o4c you re-sponded to. We gather this information from the analysis of existing data in or-der to better understand our customers and to tailor and improve offers to them more precisely.
Behavioural and preference data may either be evaluated on a person-specific basis in order to submit tailor-made offers or to display advertising, or for mar-ket research or business development purposes, including non-person-spe-cific purposes.
Communications data: Communications data refers to data in connection with communications with you in written correspondence, by telephone and via electronic channels (for example email, SM, Chat). They also include authenti-cation data (for example biometric data) as well as video and audio recordings.
Technical data: Technical data is data that we collect when you use electronic options. This data also includes the IP address of an end device and the logs in which we record your use of our systems. In order to ensure the functioning of these options, we may assign an individual code to end devices (for example in the form of a cookie). Together with data from user accounts, registrations, ac-cess controls or the processing of contracts, we may under certain circum-stances associate other data with specific persons.
In addition to the IP address and information about the end device, the tech-nical data also includes the date and time, the geographical region and the type of browser or device with which the customer accesses our electronic options. This information helps us to display content in a browser or on an end device. Technical data are also log files that are generated in our systems.
Registration data: Registration data is data about customers that is transmit-ted during registration or activation in order to use or participate in certain op-tions and services (for example newsletters, courses).
Other data: We collect additional data relating to customers in various contexts. For ex-ample, data for misuse and fraud prevention purposes.
What is the data used for and how is it processed?
We process data for the following and thus agreed purposes:
Fulfillment of Contract (Art. 31(1) DSG, Art. 6(1)(b) GDPR)
• Initiation, execution, and termination of business relationships: We pro-cess data for the initiation, registration, execution, and termination of business relationships, particularly for course access and participation management, in-cluding the provision and personalization of courses.
• Customer service and communication to handle inquiries.
• Security and platform maintenance: o4c may also process data for security purposes. However, data security breaches cannot be entirely ruled out. At o4c, we mitigate this risk using state-of-the-art technical and organizational measures.
• Communication: We process data to communicate with you, provide infor-mation, send notifications, and handle your inquiries. We generally retain this data to document communication, ensure quality assurance, and facilitate fol-low-up inquiries. If customers contact us via email, we are explicitly author-ized to respond via the same channel to the sender’s address or the ad-dress provided. Emails are transmitted unencrypted over the open internet, and it cannot be ruled out that they may be accessed, viewed, or manipulated by third parties. Therefore, email communication is not suitable for transmitting confidential information.
• Internal processes and administrative purposes: Administrative purposes include managing master data, accounting, data retention, and IT infrastruc-ture management. Additionally, we use this data to protect and enforce our rights, securing evidence, conducting legal assessments.
Legitimate Interest (Art. 31(1)(c) DSG, Art. 6(1)(f) GDPR)
Our legitimate interest lies in providing you with an optimal offering and user experi-ence, improving our products, websites, and services, supporting our customers, and operating our business efficiently.
• Marketing, Profiling, and Customer Retention: We process data for market-ing purposes and customer retention in order to provide customers with per-sonalized information related to our services.
• Other Purposes: o4c may process data for additional purposes, such as eval-uating and improving internal processes, preparing and executing business transactions (including acquisitions and sales of companies and assets), and for training and educational purposes. The safeguarding of other legitimate in-terests, which cannot be exhaustively listed, also falls within this category.
• Improvement of Services, Operations, and Product Development: Data is also processed to enhance our services, operations, and product offerings.
We continuously develop our offerings and services, adapt them to customer needs, and assess customer satisfaction. We analyze which offerings are used by which cus-tomer groups and how they are utilized, as well as how new services and courses could be designed and implemented. This provides us with insights into the market ac-ceptance of existing and the potential for new offerings.
Disclosure of your data to third parties?
Your data will only be disclosed to third parties if this is necessary for the execution of the contract, such as for the provision of courses (e.g., payment service providers), or if we are legally required to do so.
The involved parties may process your data but only within the scope of legal and/or contractual obligations. We transfer data to the following categories of recipients:
• Service providers: We collaborate with service providers both domestically and internationally. To ensure the efficient, secure, and cost-effective delivery of our services, we rely on third-party providers in various areas. These services include IT services, information distribution, marketing and sales services, and consulting services. We disclose only the necessary data required for the pro-vision of these services. We primarily work with the companies listed in the Ap-pendix regarding our offerings and website.
• Third parties: Third parties are individuals or companies that process your data for their own purposes. They are not commissioned service providers acting on behalf of o4c. As a general principle, we do not share data with third parties for their own purposes unless you have given explicit consent. We primarily work with the third parties listed in the Appendix in connection with our offerings and website. Please note that the processing of data by these third parties is subject to their respective privacy policies, and by using their services, you agree to their terms. • Electronic data transmission: During electronic data transfers, data may be transmitted to third parties without our intervention, both domestically and in-ternationally. This is especially relevant when using mobile devices, as device or software manufacturers (e.g., Apple or Google) may receive data. These third parties may process and share such data in accordance with their own terms of use and privacy policies. Consequently, they may infer relationships be-tween customers, o4c, and merchants.
How long does o4c store data, and when is it deleted?
We store data for as long as required by applicable legal regulations or the purpose of processing. The retention period is determined by legal and internal regulations, de-pending on the legal basis, this may exceed ten years. o4c also considers retention obligations, processing purposes, and the necessity of preserving its own interests (e.g., IT security).
How does o4c protect the data?
o4c takes appropriate technical and organisational security measures to maintain the security of the data, to adequately protect it against unauthorised or unlawful pro-cessing and to counteract the risk of loss, accidental alteration, unwanted disclosure or unauthorised access.
These security measures include logs, access restrictions, storage of backup copies, instructions to employees, confidentiality agreements and controls. In addition, o4c also requires any third parties involved to take appropriate state-of-the-art security measures. However, security risks cannot generally be completely ruled out. Residual risks are unavoidable.
What rights do customers have in connection with their data?
To the extent that the requirements of applicable law are met, you have the right to access, rectification, erasure, data portability, restriction of processing, and objection to the processing of your data. If you have given us consent to process your personal data, you may revoke this consent at any time with effect for the future.
If you wish to exercise your rights, you must contact o4c with a signed written request and a clearly legible copy of an official identification document. A withdrawal of con-sent may be carried out by other means if we provide such options. Please note that these rights are subject to legal conditions and limitations, meaning they cannot al-ways be fully exercised in every case. We will inform you if exceptions apply.
You also have the right to lodge a complaint with the competent data protection au-thority. In Switzerland, this is the Federal Data Protection and Information Commis-sioner (FDPIC).
Please address your requests and withdraw consent to:
o4c Office for Contracts GmbH, Thurstrasse 7, CH-8555 Müllheim / Schweiz
B. Terms and Conditions for Visits to Websites
The information published on our websites does not constitute binding offers unless explicitly stated otherwise.
Although we take every care to ensure that the information published on our websites is accurate at the time of publication, we cannot explicitly or implicitly guarantee or warrant the accuracy, reliability, timeliness, or completeness of the information.
We assume no responsibility and make no assurances that the functions will be avail-able without interruption or that the respective server is free from viruses or other harmful components.
o4c accepts no liability, even in cases of negligence, for direct or indirect, immediate or consequential damages and losses of any kind arising from:
• Access to the website and advertised services;
• Inability to access or use services;
• Links or access to third-party websites;
• Unauthorized manipulation of the internet user’s IT systems;
• Communication with o4c via the internet or email.
By accessing and using the o4c websites, you agree to these terms.
C. Cookie Policy
We use the term „cookies“ to refer to cookies and similar technologies used in the con-text of electronic communication. The following information provides details about the key aspects of how we process your data when you use our websites and social media channels.
In general, you can use our websites and social media channels without providing per-sonal data such as your name or email address. In this case, we may be able to asso-ciate the data collected in connection with your usage with specific visitors, but not with identified individuals by name. In this sense, online data is generally not consid-ered personal data. However, if you provide us with your name, email address, or other personal data, we will process this data accordingly. Additionally, this may allow us to establish a link between you and data that was otherwise not considered personal data.
This Cookie Policy applies to all websites for which we are responsible. Our websites may contain links to third-party websites. These websites are not subject to this Cookie Policy, and we are neither responsible for their content nor for their handling of personal data. We recommend reviewing the privacy policies of the respective website providers.
C.1 What are cookies and similar technologies?
• Cookies are small files that are transferred to your end device and stored there when you visit a website. A cookie contains, in particular, information about the origin of the website as well as the lifetime of the cookie (i.e. how long it remains stored on your end device). Some cookies are deleted after the end of the browser session („session cookies“). Other cookies remain on your device („permanent cookies“).
• If you access these websites again, we can record your new visit even if we do not know your identity. Cookies may also collect information about your user behav-iour.
C.2 What cookies do we use?
We use cookies to operate our websites, insofar as they are technically necessary, fur-thermore for statistical purposes, to improve user-friendliness and for advertising and marketing purposes.
We use cookies for the operation of our websites, as far as they are technically neces-sary, as well as for statistical purposes and to improve user-friendliness.
• Technically necessary cookies: The use of technically necessary cookies is based on our legitimate interest in providing a functional and secure website. These cook-ies are essential for the operation of the website and cannot be disabled.
• Analytics and marketing cookies: For analytics and marketing cookies (e.g., Google Analytics), we obtain your consent before these cookies are used. You can with-draw your consent at any time in the cookie settings.
The use of cookies is based on our legitimate interest in providing user-friendly and attractive websites and ensuring contract fulfillment.
C.3 How can you control the use of cookies?
If you choose not to allow or disable cookies, the functionality of our websites may be limited. If you do not wish to accept cookies, you can configure your web browser to notify you before cookies are set and allow them on a case-by-case basis. You can also configure your browser to automatically disable cookies.
Please note that most web browsers offer privacy protection features. While most browsers automatically accept cookies, they also provide the option to block or delete them. Instructions for managing cookies in your browser can usually be found in the help section of the browser or in the user manual of your mobile device.
C.4 How and where is your data stored?
• Please note that the IP address of your device is stored by the website operator when you visit our websites. For technical reasons, additional log data is col-lected, such as information about the internet service provider, operating sys-tem of the device, browser details, referring URL (origin), date and time of ac-cess, and accessed content. In certain cases, personal data such as the visi-tor’s name and address may also be collected, for example, if you register on a website. In such cases, log data may be processed as personal data. • We process personal data that are necessary for contract fulfillment or busi-ness initiation, or for which you have provided explicit consent. You can with-draw your consent at any time with future effect. Personal data submitted via our websites will only be stored as long as necessary for the intended purpose or as required by legal retention obligations.
• We may engage service providers to process data related to our websites and social media channels, who analyze data on our behalf. In this case, your data may also be transferred abroad, including to countries outside the EU or the European Economic Area (EEA). These third countries may not have data pro-tection laws equivalent to those in Switzerland, the EU, or the EEA. In such cases, we ensure data protection through data transfer agreements. In certain cases, we may also transfer data in compliance with data protection regula-tions without such agreements, e.g., if you have consented to the transfer, or if the transfer is necessary for contract fulfillment, the establishment, exercise, or defense of legal claims, or for overriding public interests.
Despite the measures taken to protect your data, it is important to note that data pro-tection and confidentiality may be limited when data is processed via publicly acces-sible media. When using the internet for data transmission via a computer, smartphone, or another device, it cannot be entirely ruled out that third parties may gain access to your data due to the nature of the internet. We disclaim all liability for direct or indirect damages resulting from such data transmission in connection with the use of our websites.
C.5 For what purposes do we use digital data?
We use cookies, the data collected through cookies, and the data contained in the mentioned log files (log data, collectively referred to as „digital data“) primarily for the purposes listed below:
• Operation of digital services: Log data is automatically generated when using digital services and is therefore essential for their operation. Additional digital data collected via cookies is required to provide specific features of the digital service or to request your consent for the use of cookies and other technolo-gies.
• Provision of specific content and functions: When you use content and fea-tures of our services and provide us with data—for example, by registering for a newsletter, bot, or chat—we process the data you submit in accordance with the respective purpose of the function or content.
• Security and stability: We use digital data to enhance the security and stability of our digital services. Generally, directly personal data is not required for this purpose. However, if we can associate cookies with you personally, we may use them for security and stability purposes in a personalized manner when necessary.
• Statistics: We use both personal and non-personal digital data for statistical purposes, i.e., for analyses aimed at obtaining specific insights, such as identi-fying fluctuations in the usage of our online services. This information is aggre-gated, meaning it is no longer personally identifiable. • Improvement of services: We use digital data to continuously enhance our online services.
• Communication: We use digital data to communicate with you via electronic channels. This includes processing communication content as well as log data related to the type and timing of communication.
• Compliance with legal and regulatory requirements: We may process digital data to comply with laws, regulations, official directives, and internal policies. This includes preventing, detecting, and investigating criminal offenses and other violations, conducting internal and external investigations, and disclosing digital data to authorities when required.
• Defense and enforcement of claims: We may use digital data in civil and crim-inal proceedings or for defense against legal claims in such proceedings.
C.6 How do we obtain evaluations and statistics?
We use service providers to analyze the behavior of visitors and customers. These pro-viders may receive log data and other online data from us and use their own cookies and similar technologies to collect online data about our digital services. However, we do not share directly identifiable personal data, such as your name or email address, with them. The primary service provider is:
Google Analytics: We use the Google Analytics service, operated by a Google entity in Ireland (Google). Using cookies, data about user behavior on our digital services is rec-orded (e.g., duration and frequency of page views, accessed content, geographical origin of access). Based on this data, Google generates reports on the usage of our services.
Google engages Google LLC in the United States as a data processor, but IP ad-dresses— which could enable the identification of individuals—are truncated before being transferred to Google LLC. We have disabled the „Data Sharing“ and „Google Sig-nals“ settings.
However, we cannot exclude the possibility that Google may use the collected online data for its own purposes, draw conclusions about user identity, create personalized profiles, and link this data to Google accounts.
For further information on Google’s privacy policy, please visit: https://www.google.com/privacy.html
For details on Google Analytics data protection, visit: https://support.google.com/an-alytics/answer/6004245?hl=en
If you have a Google account, you can find information on how Google processes your data here: https://policies.google.com/technologies/partner-sites?hl=en
To disable Google Analytics, you can install a browser extension via the following link: https://tools.google.com/dlpage/gaoptout?hl=en
C.7 Social Media and Third-Party Platform Links
LinkedIn Link: Our website and services include a link to the LinkedIn network, oper-ated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. If you click on the LinkedIn button, you will be redirected to your LinkedIn user account in a separate browser window—provided that you are logged into LinkedIn. This estab-lishes a direct connection between your browser and LinkedIn’s servers, and LinkedIn receives information that you have visited our website with your IP address. Addition-ally, LinkedIn may link your visit to our website with your LinkedIn account. Please note that we have no knowledge of the content of the transmitted (personal) data or how LinkedIn processes it. For more information, please refer to LinkedIn’s Privacy Policy.
Vimeo: Our website and services include embedded videos from Vimeo, a platform operated by Vimeo, Inc., 555 West 18th Street, New York, NY 10011, USA. When you visit a page with embedded Vimeo videos, a connection to Vimeo’s servers is estab-lished. This allows Vimeo to receive your IP address and register that you have visited our website. If you are logged into your Vimeo user account, Vimeo may associate your visit to our website with your account. Additionally, Vimeo may use cookies or similar technologies to collect information about the use of its videos. Please note that we have no knowledge of the content of the transmitted data or its processing by Vimeo. For more details, please see Vimeo’s Privacy Policy: https://vimeo.com/privacy.
YouTube Link: Our website and services include a link to YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The link is identified by a YouTube logo or similar reference. If you click on the YouTube link, you will be redirected to the YouTube platform in a separate browser window, provided that you are logged into your Google or YouTube account. This establishes a direct connection between your browser and YouTube’s servers, and this information (including your IP address) is transmitted directly from your browser to a Google server in Ireland or the USA and stored there. If you are logged into YouTube or Google, YouTube may associ-ate your visit to our website with your account. If you do not want YouTube to link your data to your account, please log out before visiting our website. More information can be found in Google’s Privacy Policy.
Instagram Link: Our website and services include a link to the social media platform Instagram, operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA. The link is identified by an Instagram logo in the form of an „Instagram camera“. If you click on the Instagram button, you will be redirected to your Instagram account in a separate browser window—provided that you are logged into Instagram. This estab-lishes a direct connection between your browser and Instagram’s servers, and this in-formation (including your IP address) is transmitted directly from your browser to an Instagram server in the USA and stored there. If you are logged into Instagram, Insta-gram may associate your visit to our website with your Instagram account. If you do not want Instagram to link your data to your account, please log out before visiting our website. More details can be found in Instagram’s Privacy Policy.
Facebook Link: Our website and services include a link to the social media platform Facebook, operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. The link is identified by a Facebook logo. If you click on the Facebook but-ton, you will be redirected to your Facebook account in a separate browser window—provided that you are logged into Facebook. This establishes a direct connection be-tween your browser and Facebook’s servers, and this information (including your IP address) is transmitted directly from your browser to a Facebook server in the USA and stored there. If you are logged into Facebook, Facebook may associate your visit to our website with your Facebook account. If you do not want Facebook to link your data to your account, please log out before visiting our website. More details can be found in Facebook’s Privacy Policy.
C.8 Contacting Us
When you contact us (e.g., via email or social media), the information you provide will be processed to handle and respond to your inquiry. We will delete requests once they are no longer needed. We regularly review whether retention is necessary; in addition, the statutory archiving requirements apply.
D. List of Most Frequently Used Service Providers and Third Parties / Data Exchange Due to Use of Our Services and Websites
We reserve the right to update this list at any time; the most recent version shall apply.
1. Zoom Video Communications
• Company: Zoom Video Communications, Inc.
• Address: 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA
• Website: www.zoom.us – Contact: support@zoom.us
• Service: Video conferencing and online meetings
• Legal basis: Legitimate interest pursuant to Art. 31(1) DSG and/or consent pur-suant to Art. 6(6) DSG; Art. 6(1)(a) or (f) GDPR
• Data Transfer: The transfer of data to the USA is carried out under the EU-U.S. Data Privacy Framework (DPF). Zoom is certified under this framework, ensur-ing that data transfers comply with the requirements of the GDPR and the Swiss DSG. Further information on Zoom‘s certification under the DPF can be found here: https://www.dataprivacyframework.gov
2. Microsoft Teams
• Company: Microsoft Corporation
• Address: One Microsoft Way, Redmond, WA 98052-6399, USA
• Website: www.microsoft.com – Contact: support@microsoft.com
• Service: Video conferencing, online meetings, and team collaboration tools
• Legal basis: Legitimate interest pursuant to Art. 31(1) DSG and/or consent pur-suant to Art. 6(6) DSG; Art. 6(1)(a) or (f) GDPR
• Data Transfer: The transfer of data to the USA is carried out under the EU-U.S. Data Privacy Framework (DPF). Microsoft is certified under this framework, en-suring that data transfers comply with the requirements of the GDPR and the Swiss DSG. Further information on Microsoft’s certification under the DPF can be found here: https://www.dataprivacyframework.gov
3. WhatsApp
• Company: WhatsApp LLC (subsidiary of Meta Platforms, Inc.)
• Address: 1601 Willow Road, Menlo Park, CA 94025, USA
• Website: www.whatsapp.com – Contact: privacy@whatsapp.com
• Service: Messaging service for communication
• Legal basis: Consent pursuant to Art. 6(6) DSG; Art. 6(1)(a) GDPR.
• Data Transfer: The transfer of data to the USA is carried out under the EU-U.S. Data Privacy Framework (DPF). Whatsapp is certified under this framework, en-suring that data transfers comply with the requirements of the GDPR and the Swiss DSG. Further information on Whatsapp’s certification under the DPF can be found here: https://www.dataprivacyframework.gov
4. Brevo
• Company: Sendinblue SAS
• Address: 55 Rue d’Amsterdam, 75008 Paris, France
• Website: www.brevo.com – Contact: contact@brevo.com
• Service: Sending and managing newsletters
• Legal basis: Consent pursuant to Art. 6(6) DSG; Art. 6(1)(a) GDPR.
• Data transfer: The processing of personal data takes place within the European Union (EU), which ensures an adequate level of data protection recognized.
5. Microsoft OneDrive
• Company: Microsoft Corporation
• Address: One Microsoft Way, Redmond, WA 98052-6399, USA
• Website: www.microsoft.com
• Contact: support@microsoft.com
• Service: Cloud storage and file hosting service for secure storage, manage-ment, and sharing of files
• Legal basis: Legitimate interest pursuant to Art. 31(1) DSG and/or consent pur-suant to Art. 6(6) DSG; Art. 6(1)(a) or (f) GDPR.
• Data Transfer: The transfer of data to the USA, if not stored in Switzerland, is carried out under the EU-U.S. Data Privacy Framework (DPF). Microsoft is cer-tified under this framework, ensuring that data transfers comply with the re-quirements of the GDPR and the Swiss DSG. Further information on Microsoft’s certification under the DPF can be found here: https://www.dataprivacyframe-work.gov
6. Cookies and Third-Party Providers
A detailed overview of the cookies used, partners and associated data processing can be found in our Cookie Policy (see C – Cookie Policy).
