Bolliger Treuhand AG

In this privacy statement, we, Bolliger Treuhand AG, (hereinafter referred to as BTRAG), we or us) describe how we collect and process personal data. This data protection statement is not an exhaustive description; other statements relating to data protection may govern specific matters. For the purposes of this privacy policy, personal data means all information that relates to an identified or identifiable individual.

1. Responsible body and contact

BTRAG is responsible for the data processing described here, unless otherwise stated in individual cases. Inquiries regarding data protection may be addressed to us by letter or e-mail, enclosing a copy of the user's ID or passport for identification purposes: Bolliger Treuhand AG, for the attention of the Data Protection Officer, Bahnhofstrasse 8, 8953 Dietikon, Switzerland, Tel: +41 (0)44 744 63 63 / bolli@btrag.ch.

2. Collection and processing of personal data

In particular, we process personal data in the following categories of processing.

Customer data of customers for whom we provide or have provided services.
Personal data obtained indirectly from our customers in the course of providing services.
When visiting our website
When using our newsletter
When participating in an event of ours.
When we communicate or a visit takes place.
In case of other contractual relationship, e.g. as supplier, service provider or consultant.
For applications
If we are required to do so for legal or regulatory reasons.
When we are performing our due diligence or other legitimate interests, such as to avoid conflicts of interest, prevent money laundering or other risks, ensure data accuracy, check creditworthiness, ensure security, or enforce our rights.

For more detailed information, please refer to the description of the respective categories of processing in item 5.

3. Personal data categories

The personal data we process depends on your relationship with us and the purpose for which we process it. In addition to your contact data, we also process other information about you or about persons who have a relationship with you. This information may also be particularly sensitive personal data.

We collect the following categories of personal data, depending on the purpose for which we process them:

Contact information (e.g. last name, first name, address, phone number, e-mail)
Customer information (e.g. date of birth, nationality, marital status, profession, title, job title, passport / ID number, AHV number)
Risk assessment data (e.g. credit rating information, commercial register data)
Financial information (e.g. data on bank details)
Mandate data, depending on the mandate (e.g. tax information, statutes, minutes, projects, contracts, employee data (e.g. salary, social security), accounting data, beneficial owners, ownership)
Web page data (e.g. IP address, device information (UDI), browser information, web page usage (analysis and use of plugins, etc.)
Application data (e.g. curriculum vitae, references)
Marketing information (e.g. newsletter registration)
Security and network data (e.g. visitor lists, access controls, network and mail scanners, telephone call lists)

To the extent permitted, we also take certain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, press, internet) or receive such data from our clients and their employees, from authorities, (arbitration) courts and other third parties. In addition to the data about you that you give us directly, the categories of personal data that we receive about you from third parties include, in particular, information from public registers, information that we learn in connection with official and legal proceedings, information in connection with your professional functions and activities (so that we can, e.g. (e.g. so that we can conclude and process transactions with your employer with your help), information about you in correspondence and meetings with third parties, creditworthiness information, information about you that people close to you (family, advisors, legal representatives, etc.) give us so that we can conclude or process contracts with you or with the involvement of you (e.g. references, your address for deliveries, full addresses, etc.). References, your address for deliveries, powers of attorney) Information on compliance with legal requirements such as anti-money laundering and export restrictions, information from banks, insurance companies, sales and other contractual partners of ours on the use or provision of services by you (e.g. payments made, purchases made), information from the media and Internet about you (if this is appropriate in the specific case, e.g. in the context of a job application, etc.).your addresses and, if applicable, interests and other sociodemographic data (for marketing), data in connection with the use of the website (e.g. IP address, MAC address of the smartphone or computer, information about your device and settings, cookies, date and time of visit, pages and content accessed, functions used, referring website, location information).

4. Purposes of data processing and legal basis

4.1. Provision of services

We primarily process the personal data that we receive from our clients and other business partners in the course of our client relationships and other contractual relationships with them and other persons involved in them.

The personal data of our customers is in particular the following information:

Contact information (e.g. last name, first name, address, phone number, e-mail, other contact information)
Personal information (e.g. date of birth, nationality, marital status, profession, title, job title, passport / ID number, AHV number, family circumstances, etc.).
Risk assessment data (e.g. credit rating information, commercial register data, sanctions lists, specialized databases, data from the Internet)
Financial information (e.g. data on bank details, investments or shareholdings)
Mandate data, depending on the mandate, e.g. tax information, statutes, minutes, employee data (e.g. salary, social insurance), accounting data, etc.
Particularly sensitive personal data: This personal data may also include sensitive personal data, such as data relating to health, religious beliefs or social assistance measures, especially if we provide payroll processing or accounting services.

We process this personal data for the described purposes based on the following legal bases:

Conclusion or execution of a contract with the data subject or for the benefit of the data subject, including contract initiation and possible enforcement (e.g. consulting, fiduciary services)
Fulfillment of a legal obligation (e.g., when we perform our duties as auditors or are required to disclose information).
Safeguarding legitimate interests, (e.g., for administrative purposes, to improve our quality, ensure safety, manage risk, enforce our rights, defend against claims, or review potential conflicts of interest).
Consent (e.g. to send them marketing information).

4.2. Indirect data processing from service provision

When we provide services to our customers, we may also process personal data that we have not collected directly from the data subjects or personal data from third parties. These third parties are usually employees, contacts, family members or persons who have a relationship with the customers or data subjects for other reasons. We need this personal data to fulfill contracts with our customers. We receive this personal data from our customers or from third parties engaged by our customers. Third parties whose information we process for this purpose are informed by our customers that we process their data. Our customers may refer to this privacy policy for this purpose.

The personal data of the persons who have a relationship with our customers is, in particular, the following information:

Contact information (e.g., last name, first name, address, phone number, email, other contact information, marketing data)
Personal information (e.g. date of birth, nationality, marital status, profession, title, job title, passport / ID number, AHV number, family circumstances, etc.).
Financial information (e.g. data on bank details, investments or shareholdings)
Mandate data, depending on the mandate e.g. tax information, statutes, minutes, employee data (e.g. salary, social insurance), accounting data
Particularly sensitive personal data: This personal data may also include sensitive personal data, such as data relating to health, religious beliefs or social assistance measures, especially if we provide payroll processing or accounting services.

We process this personal data for the described purposes based on the following legal bases:

Conclusion or execution of a contract with the data subject or for the benefit of the data subject (e.g., when we perform our contractual obligations)
Fulfillment of a legal obligation (e.g., when we perform our duties as auditors or are required to disclose information).
Safeguarding legitimate interests, in particular our interest in providing optimum service to our customers.

4.3. Use of our website

No personal data need to be disclosed in order to use our website. However, the server collects a range of user information with each call, which is temporarily stored in the server's log files.

When using this general information, no assignment to a specific person takes place. The collection of this information or data is technically necessary to display our website and to ensure its stability and security. This information is also collected to improve the website and analyze its use.

In particular, this involves the following information:

Contact information (e.g. last name, first name, address, phone number, e-mail)
Other information that you submit to us via the website
Automatically transmitted to us or our service providers technical information, information on user behavior or website settings (e.g. IP address, UDI, device type, browser, number of clicks on the page, opening of the newsletter, click on links, etc.).

We process this personal data for the described purposes based on the following legal bases:

Safeguarding legitimate interests, (e.g. for administrative purposes, to improve our quality, analyze data or publicize our services).
Consent (e.g. to the use of cookies or the newsletter).

4.4. Newsletter usage

Insofar as you subscribe to our newsletter, we use your e-mail address and other contact data to send you the newsletter. You can subscribe to our newsletter with your consent. Mandatory data for sending the newsletter are your full name and your e-mail address, which we store after your registration. The legal basis for the processing of your data in connection with our newsletter is your consent to the sending of the newsletter. You can revoke this at any time and unsubscribe from the newsletter.

4.5. Participation in events

If you participate in an event organized by us, we collect personal data in order to organize and conduct the event and, if necessary, to send you additional information afterwards. We also use your information to inform you about other events. It is possible that you will be photographed or filmed by us at these events and that we will publish this footage internally or externally.

This involves the following information in particular:

Contact information (e.g. last name, first name, address, phone number, e-mail)
Personal information (e.g., occupation, position, title, employer company, eating habits).
Pictures or videos
Payment information (e.g. bank details).

We process this personal data for the described purposes based on the following legal bases:

Fulfillment of a contractual obligation with the data subject or for the benefit of the data subject, incl. contract initiation and possible enforcement (enabling participation in the event)
Safeguarding legitimate interests (e.g. holding events, disseminating information about our event, providing services, efficient organization).
Consent (e.g., to send them marketing information or to create visual materials).

4.6. Direct communication and visits

If you contact us (e.g. via telephone, e-mail or chat) or if we contact you, we process the personal data required for this purpose. We also process this personal data when you visit us. In this case, you may be required to leave your contact details before visiting us or at reception. We keep this information for a certain period of time to protect our infrastructure and information.

To conduct conference calls, online meetings, video conferences and/or webinars ("Online Meetings"), we use either the "Zoom" or "Microsoft Teams" service
We process the following information in particular:

Contact information (e.g. last name, first name, address, phone number, e-mail)
Boundary data for communication (e.g. IP address, duration of communication, communication channel).
Recordings of conversations, e.g. during video conferences
Other information uploaded, provided or created by the user during the use of the video conferencing service, as well as metadata used for the maintenance of the service provided Additional information about the processing of personal data by "Zoom" or Microsoft Teams can be found in their privacy statements.
Personal information (e.g. occupation, function, title, employer company)
Time and reason for the visit.

We process this personal data for the described purposes based on the following legal bases:

Fulfillment of a contractual obligation with the data subject or for the benefit of the data subject, incl. contract initiation and possible enforcement (provision of a service)
Safeguarding legitimate interests (e.g. security, traceability, and processing and administration of customer relationships).

4.7. Applications

You can submit your application for a position with us by mail or via the e-mail address provided on our website. The application documents and all personal data disclosed to us in this way will be treated in strict confidence, will not be disclosed to any third party and will only be processed for the purpose of handling your application for employment with us. Without your consent to the contrary, your application file will either be returned to you or deleted/destroyed after the application process has been completed, unless it is subject to a legal obligation to retain it. The legal basis for processing your data is your consent, the fulfillment of the contract with you and our legitimate interests.

In particular, we process the following information:

Contact information (e.g. last name, first name, address, phone number, e-mail)
Personal information (e.g. occupation, function, title, employer company)
Application documents (e.g. letter of motivation, certificates, diplomas, curriculum vitae)
Assessment information (e.g. assessment of personnel consultants, reference information, assessments)

We process this personal data for the described purposes based on the following legal bases:

Safeguarding legitimate interests (e.g. hiring new employees)
Consent.

4.8. Suppliers, service providers, other contractual partners

When we enter into a contract with you to provide a service to you, we process personal data about you or your employees. We need this data to communicate with you and to use your services. We may also process this personal data in order to check whether there could be a conflict of interest in connection with our activities as auditors and to ensure that we do not enter into any unwanted risks, e.g. with regard to money laundering or sanctions, through our cooperation.

We process the following information in particular:

Contact information (e.g., last name, first name, address, phone number, email).
Personal information (e.g., occupation, position, title, employer company).
Financial information (e.g., bank account data).

We process this personal data for the described purposes based on the following legal bases:

Conclusion or execution of a contract with the data subject or for the benefit of the data subject, incl. contract initiation and possible enforcement
Safeguarding legitimate interests, (e.g. avoiding conflicts of interest, protecting the company, enforcing legal claims).

5. Web and newsletter analysis

At present, we do not use any web and newsletter analysis tools such as "Google Analytics" or "Google Maps", nor do we use any so-called "social media plugins".

Should this change, we will adjust our privacy policy accordingly.

6. Data sharing and data transmission

We will only disclose your data to third parties if this is necessary to provide our service, if these third parties provide a service for us, if we are required to do so by law or by the authorities, or if we have an overriding interest in disclosing the personal data. We will also pass on personal data to third parties if you have given your consent to this or have requested us to do so.

Not all personal data is transmitted encrypted by default. Unless explicitly agreed otherwise with the customer, accounting data, salary administration data, salary statements and wage statements are transmitted unencrypted.

The following categories of recipients may receive personal data from us:
- Service providers (e.g. IT service providers, hosting providers, suppliers, consultants, lawyers, insurance companies).
- Third parties within the scope of our legal or contractual obligations, authorities, state institutions, courts.

We conclude contracts with service providers who process personal data on our behalf, obliging them to ensure data protection. The majority of our service providers are located in Switzerland or in the EU / EEA. Certain personal data may also be transferred to the USA (e.g. Google Analytics data) or, in exceptional cases, to other countries worldwide. If data transfer to other countries that do not have an adequate level of data protection is necessary, this will be done on the basis of the EU standard contractual clauses (e.g. in the case of Google) or other appropriate instruments).

7. Duration of the retention of personal data

We process and store your personal data as long as it is necessary for the fulfillment of our contractual and legal obligations or otherwise the purposes pursued with the processing, i.e., for example, for the duration of the entire business relationship (from the initiation, processing to the termination of a contract) and beyond that in accordance with the statutory retention and documentation obligations. In this context, it is possible that personal data will be retained for the time during which claims can be asserted against our company (i.e. in particular during the statutory limitation period) and to the extent that we are otherwise legally obliged to do so or legitimate business interests require this (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for the above-mentioned purposes, it will be deleted or anonymized as a matter of principle and as far as possible. For operational data (e.g. system logs, logs), shorter retention periods of twelve months or less apply in principle.

8. Data security

We take appropriate technical and organizational security measures to protect your personal data from unauthorized access and misuse, such as issuing instructions, training, IT and network security solutions, access controls and restrictions, encryption of data carriers and transmissions, pseudonymization and controls.

9. Obligation to provide personal data

In the context of our business relationship, you must provide those personal data that are necessary for the establishment and implementation of a business relationship and the fulfillment of the associated contractual obligations (you generally do not have a legal obligation to provide us with data). Without this data, we will not be able to enter into or perform a contract with you (or the entity or person you represent). Also, the website cannot be used if certain traffic-securing information (such as IP address) is not disclosed.

10. Your rights

You have the following rights in connection with our processing of personal data:

Right to information about personal data stored by us about you, the purpose of processing, the origin and about recipients or categories of recipients to whom personal data is disclosed.
Right to rectification if your data is incorrect or incomplete.
Right to restrict the processing of your personal data
Right to request the deletion of the processed personal data
Right to data portability
Right to object to data processing or to withdraw consent to the processing of personal data at any time without giving reasons.
Right to complain to a competent supervisory authority, if provided for by law.

To exercise these rights, contact us at the address indicated in section 1.

Please note, however, that we reserve the right to assert the restrictions provided for by law on our part, for example if we are obliged to retain or process certain data, have an overriding interest in doing so (insofar as we are entitled to rely on this) or require it for the assertion of claims. If costs are incurred by you, we will inform you in advance.

11. Change of the privacy policy

We expressly reserve the right to change this privacy policy at any time.
Last modified April 2023

Dataprivacy