1. CONTROLLER The controller responsible for the processing of personal data in connection with this website is: TONIQ Sound Agency AG Löwenstrasse 31–35 8001 Zurich Switzerland UID: CHE-279.449.803 Email: fresh@toniq.ch Phone: +41 44 771 75 45 Hereinafter referred to as “TONIQ”, “we”, “us” or “our”. 2. SCOPE AND LEGAL BASIS This Privacy Policy explains how we process personal data in connection with the publicly accessible website toniq.ch. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the corresponding Data Protection Ordinance. Where the EU General Data Protection Regulation (GDPR) applies, personal data is processed, depending on the purpose, in particular on the basis of: – consent pursuant to Art. 6(1)(a) GDPR; – performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR; – compliance with a legal obligation pursuant to Art. 6(1)(c) GDPR; or – our legitimate interests pursuant to Art. 6(1)(f) GDPR. This Privacy Policy does not apply to third-party websites and services that can be accessed through links on our website. The respective providers are responsible for their own processing of personal data. 3. DATA PROCESSING 3.1 Technical provision and hosting of the website Our website is created and operated using Framer. The provider is Framer B.V., Amsterdam, the Netherlands. When visitors access our website, technical data required for the provision, security and stability of the website may be processed. This may include in particular: – IP address; – browser and device information; – requested page or file; – date and time of access; – referrer information; – technical network and connection information. This data is processed in particular to technically provide the website, identify errors, prevent misuse and ensure the security of the website. Framer uses infrastructure provided by Amazon Web Services (AWS), among others. According to Framer, its services are hosted in particular in AWS infrastructure in the United States, with additional infrastructure in Europe and the Asia-Pacific region. Further information can be found in Framer’s privacy and data protection documentation. 3.2 Cookies, local storage and privacy settings Our website uses cookies and similar browser technologies where they are necessary for the operation of the website or where visitors have consented to the use of Google Analytics or external media. When visiting our website for the first time, visitors can choose whether Google Analytics and external content from Vimeo and Google Maps may be loaded. The selected privacy preference is stored in the browser’s local storage. This enables the website to remember the visitor’s choice on subsequent page visits. The stored preference contains information as to whether analytics and external media have been permitted and the time at which the choice was made. The preference remains stored until it is changed through the “Privacy settings” or the website data is deleted from the browser. Consent to analytics and external media can be changed or withdrawn independently at any time through the “Privacy settings” link on our website. We do not use social media tracking pixels or personalised advertising on our website. 3.3 Framer Analytics We use Framer’s built-in “Framer Analytics” functionality to obtain statistical information about the use of our website. According to Framer, Framer Analytics does not use cookies and does not generate persistent identifiers. The analytics functionality is designed to provide usage information in aggregated or anonymised form. Statistics available to us may include, for example, page views, visitor numbers, referring sources, countries, device types and similar website usage information. Framer Analytics is therefore not included in our consent mechanism for analytics or external media. To the extent that personal data is nevertheless generated during the technical collection process, it is processed for the statistical evaluation and improvement of our website and to ensure its operation. Further information can be found in Framer’s information about Framer Analytics. 3.4 Google Analytics We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded on our website where visitors have consented to the “Analytics” category. Before such consent is given, the Google Analytics tag is not loaded by our website and no analytics data is transmitted to Google through that tag. After consent has been given, Google Analytics may process information including: – pages and content viewed; – date and time of page views; – browser and device information; – referrer information; – interactions with our website; – approximate location information; – session and usage information. Following consent, Google Analytics uses first-party cookies such as “_ga” and “_ga_<ID>” to distinguish visitors and sessions. According to Google, IP addresses of users in Switzerland, the European Union, the European Economic Area and the United Kingdom are not logged or stored in Google Analytics. IP addresses are technically used to process the request and are discarded before Analytics data is stored. We use Google Analytics solely for the statistical analysis and improvement of our website. We do not use Google Ads functionality, remarketing or personalised advertising through Google Analytics on our website. Our consent configuration therefore keeps advertising-related consent settings such as “ad_storage”, “ad_user_data” and “ad_personalization” disabled. The retention of user-level and event-level data in Google Analytics is governed by the retention settings configured in our Google Analytics property and by Google’s applicable rules for aggregated reporting. Consent to Google Analytics can be withdrawn at any time through the “Privacy settings” on our website. After consent has been withdrawn, Google Analytics will no longer be loaded on subsequent page visits. Where technically possible, Google Analytics cookies set through our website are removed when consent is withdrawn. Google may process data outside Switzerland and the European Economic Area in connection with the provision of its services. The relevant Google data processing terms apply to Google Analytics customers in Switzerland. Google uses the applicable legal transfer mechanisms for international transfers of personal data. Further information can be found in Google’s privacy information and Google Analytics documentation. 3.5 Vimeo We embed videos provided by Vimeo on our website. Vimeo content is not loaded until visitors have consented to the “External media” category. Before such consent is given, no Vimeo player is loaded by our website. After consent has been given, the visitor’s browser establishes a connection to Vimeo. Information transferred may include in particular: – IP address; – browser and device information; – information about the requested video or webpage; – date and time of the request; – other technical connection data required for the service. Where possible, we use Vimeo’s “Do Not Track” (DNT) setting for our Vimeo embeds. Vimeo may process data in the United States in particular. Consent to Vimeo can be withdrawn at any time through the “Privacy settings”. Vimeo content will then no longer be loaded automatically. Further information can be found in Vimeo’s Privacy Policy. 3.6 Google Maps We use Google Maps on our website to display an interactive map. Google Maps is not loaded until visitors have consented to the “External media” category. Before such consent is given, no Google Maps map is loaded by our website. After consent has been given, the visitor’s browser establishes a connection to Google. In this context, information including the following may be processed or transferred: – IP address; – browser and device information; – date and time of the request; – referrer information; – information about the requested map or website; – other technical connection data required for the service. Google may process data worldwide and in particular in the United States. Consent to Google Maps can be withdrawn at any time through the “Privacy settings”. The map will then no longer be loaded automatically. Further information can be found in Google’s Privacy Policy. 3.7 Newsletter Visitors can subscribe to our newsletter through our website. For this purpose, we process the information entered in the subscription form, in particular the email address, in order to send the requested newsletter. The form is provided through our Framer website. The information entered is transmitted to us through Framer’s technical infrastructure. Subscription to the newsletter is voluntary. Where the GDPR applies, the processing of the email address for newsletter purposes is based on consent pursuant to Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future, in particular by sending a message to fresh@toniq.ch or by using an unsubscribe option provided in the newsletter. Following an unsubscribe request, we will no longer use the email address for sending newsletters. Limited information relating to the unsubscribe request may be retained where necessary to document the withdrawal, comply with legal obligations or defend legal claims. 3.8 Contact by email We provide email addresses and email links on our website. Where visitors contact us by email, we process the information transmitted to us, in particular: – email address; – name, where provided; – content of the message; – other information and attachments voluntarily provided. We use this data to respond to the enquiry and, where necessary, for further business communications. Where the GDPR applies, processing is based, depending on the nature of the enquiry, in particular on pre-contractual measures, the performance of a contract or our legitimate interest in responding to business enquiries. 4. RECIPIENTS AND SERVICE PROVIDERS We disclose personal data only where this is necessary to provide our website and services, where consent has been given, where we are legally required to do so or where disclosure is otherwise permitted by law. In connection with this website, we use in particular the following providers or categories of recipients: – Framer B.V. for the website, hosting, forms and Framer Analytics; – Framer’s infrastructure and hosting providers, in particular Amazon Web Services; – Google for Google Analytics following consent; – Vimeo for embedded videos following consent; – Google for Google Maps following consent; – where necessary, IT, communications and professional service providers used in connection with our business activities. Depending on the relevant service, providers may process personal data as processors acting on our behalf or as independent controllers. 5. INTERNATIONAL DISCLOSURE OF PERSONAL DATA When our website is used, personal data may also be processed outside Switzerland. This concerns in particular: – the Netherlands and the European Economic Area in connection with Framer; – the United States in connection with Framer’s infrastructure and AWS; – Ireland and potentially the United States and other countries in connection with Google Analytics and Google Maps; – the United States in connection with Vimeo. Where personal data is disclosed to a country recognised as providing an adequate level of data protection, we rely on the applicable adequacy decision. Where no adequate level of data protection exists, appropriate safeguards are used where required by law. These may include standard contractual clauses adapted to Swiss data protection law or approved by the European Commission, or other legally recognised transfer mechanisms. The relevant Google data processing terms apply to Google Analytics customers in Switzerland. As providers may change their infrastructure and subprocessors, individual processing locations may change over time. Current information can be found in the respective providers’ privacy and data protection documentation. 6. RETENTION We retain personal data only for as long as necessary for the relevant processing purpose or for as long as statutory or contractual retention obligations apply. In particular: – Privacy preferences stored in the browser remain stored until the selection is changed or the website data is deleted from the browser. – Google Analytics data is processed and retained in accordance with the retention settings configured in our Google Analytics property and Google’s applicable rules. – Newsletter data is generally used until the visitor unsubscribes or the relevant purpose otherwise ceases to apply. – Data contained in email communications is retained for as long as necessary to respond to the enquiry, maintain the business relationship and comply with statutory retention or evidentiary requirements. – Technical security and log data is processed or retained only for as long as necessary for the secure and reliable operation of the website and in accordance with the requirements of the relevant technical service providers. – Data processed by providers acting as independent controllers is subject to the respective provider’s retention policies. After the applicable retention period has expired, personal data is deleted or anonymised unless a statutory or contractual obligation requires further retention. 7. DATA SECURITY We implement appropriate technical and organisational security measures to protect personal data against loss, misuse, unauthorised access, alteration and destruction. Communication between visitors’ browsers and our website is protected using encrypted HTTPS/TLS connections. Despite appropriate security measures, absolute security cannot be guaranteed when information is transmitted over the internet. 8. RIGHTS OF DATA SUBJECTS Subject to applicable data protection law, data subjects may in particular request information about the personal data that we process about them. Depending on the applicable law and the relevant legal requirements, the following rights may in particular be available: – right of access; – right to rectification of inaccurate data; – right to deletion or destruction; – right to obtain or transfer certain personal data; – right to restriction of processing where the GDPR applies; – right to object to certain processing where the GDPR applies; – right to data portability where the applicable legal requirements are met; – right to withdraw consent at any time with effect for the future. Requests relating to these rights may be addressed to: TONIQ Sound Agency AG Löwenstrasse 31–35 8001 Zurich Switzerland Email: fresh@toniq.ch We may request appropriate information in order to verify the identity of the person making the request. Statutory retention obligations and other legal exceptions may restrict certain rights. Persons in Switzerland may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) in relation to data protection concerns. Where the GDPR applies, data subjects also have the right to lodge a complaint with a competent data protection supervisory authority. 9. CHANGES TO THIS PRIVACY POLICY We may amend this Privacy Policy at any time, in particular where we change our website, the services used, our data processing activities or where legal requirements change. The current version published on our website applies. Where consent is required for a particular processing activity, such consent will be requested separately. Consent that has been given may be withdrawn at any time with effect for the future in accordance with the options described in this Privacy Policy.