1……. What is this privacy policy about?

2……. Who is responsible for processing your data?

3……. What data do we process?

4……. For what purposes do we process your data?

5……. On what basis do we process your data?

6……. To whom do we disclose your data?

7……. Is your personal data also sent abroad?

8……. How long do we process your data?

9……. How do we protect your data?

10….. What rights do you have?

11….. Do we use online tracking technologies?

12….. Can this privacy policy be amended?

 

1. What is this privacy policy about?

The ZHAW Institute for Sustainable Development – Living Lab Lokstadt (hereinafter also referred to as “we“, “us“) collects and processes personal data concerning you or other persons (so-called “third parties“). We use the term “data” here synonymously with “personal data“.

In this Privacy Policy, we describe what we do with your data when you use https://livinglablokstadt.zhaw.ch/ (hereinafter “Website“), purchase our services or products, otherwise interact with us under a contract, communicate with us or otherwise deal with us. Where appropriate, we will provide you with timely written notice of any additional processing activities not mentioned in this Privacy Policy.

This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation (“GDPR“), the Swiss Data Protection Act (“DPA“) and the revised Swiss Data Protection Act (“revDSG“). However, whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for processing your data?

The ZHAW Institute for Sustainable Development, Winterthur, is responsible for the data processing of the Living Lab Lokstadt described in this data protection declaration, unless otherwise communicated in individual cases.

You can contact us as follows for your data protection concerns and to exercise your rights in accordance with section 10:

ZHAW Institute for Sustainable Development
Technoparkstrasse 2
CH-8400 Winterthur
livinglab.lokstadt@zhaw.ch

3. What data do we process?

We process various categories of data about you. The main categories are as follows:

• Technical data: When you use our website, we collect the IP address of your end device and other technical data to ensure the functionality and security of these offers. This data also includes logs in which the use of our systems is recorded. We generally store technical data for 12 months. To ensure the functionality of these offers, we can also assign you or your end device an individual code (e.g. in the form of a cookie, see section 11). The technical data itself does not allow any conclusions to be drawn about your identity.
• Communication data: If you are in contact with us via the contact form, by e-mail, telephone, letter or other means of communication, we record the data exchanged between you and us, including your contact details and the marginal data of the communication. E-mails in personal mailboxes and written correspondence are generally stored for at least 10 years.

You provide us with much of the data mentioned in this section 3 yourself (e.g. via forms, in the context of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so. When using our website, the processing of technical data is unavoidable.

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for the online area can be found in Section 11. These purposes and the underlying objectives represent legitimate interests of us and, where applicable, of third parties. You will find further information on the legal basis of our processing in Section 5.

We process your data for purposes related to communication with you, in particular to respond to inquiries and assert your rights (Section 10) and to contact you in the event of queries. In particular, we use communication data for this purpose. We retain this data in order to document our communication with you for follow-up questions.

We continue to process your data to improve our services and operations and to optimize our website.

5. On what basis do we process your data?

If we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can withdraw your consent at any time with effect for the future by sending us written notification (by post) or by e-mail; our contact details can be found in Section 2. As soon as we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. To whom do we disclose your data?

In connection with the website and our services, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

• Service providers: We work with service providers in Switzerland and abroad who process anonymized data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility. For the service providers used for the website, see section 11. Our central IT service providers are Hostpoint and Burst Statistics.
• Public authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us under their own responsibility.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

7. Will your personal data also be sent abroad?

As explained in section 6, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore be processed both in Europe and in the USA; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exemption clause.

8. How long do we process your data?

We process your data for as long as required by our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes or if storage is technically necessary. Further information on the respective storage and processing period can be found in the individual data categories in section 3 or in the cookie categories in section 11. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our usual processes.

9. How do we protect your data?

We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, unintentional alteration, unwanted disclosure or unauthorized access.

10. What rights do you have?

Depending on the applicable legal basis, you have different rights. If the IDG or DSG are applicable, your rights are governed by these decrees.

If the GDPR is applicable, the following applies: Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR).

You can withdraw your consent to the processing of personal data at any time. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected by this

If you wish to exercise the above rights against us , please contact us in writing, at our premises or, unless otherwise stated or agreed, by e-mail; our contact details can be found in Section 2.

Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us know (Section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority in your country.

11. Do we use online tracking technologies?

We use various technologies on our website with which we and third parties engaged by us can recognize you when you use our website and, under certain circumstances, track you over several visits. We will inform you about this in this section.

Essentially, this is so that we can distinguish access by you (via your system) from access by other users, so that we can ensure the functionality of the website and carry out evaluations. We do not want to infer your identity. The technologies used are designed in such a way that you are recognized as an individual visitor each time you access a page, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called “cookie”).

We use such techniques on our website and allow certain third parties to do the same. However, depending on the purpose of these techniques, we may ask for your consent before using them.

A distinction is made between the following cookies (technologies with comparable functions such as fingerprinting are also included here):

• Necessary cookies: Some cookies are necessary for the functioning of the website as such or for certain functions. They ensure, for example, that you can switch between pages without losing information entered in a form. These cookies are only temporary (“session cookies”). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, consent given, etc.). These cookies have an expiry date of up to 24
• Performance cookies: In order to optimize our website and corresponding offers and better tailor them to the needs of users, we use cookies to record and analyze the use of our website. We do this by using third-party analysis services. We have listed these below. Before we use such cookies, we will ask for your consent. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.

We currently use offers from the following service providers:

• Burst Statistics: Burst Statistics is a privacy-friendly statistics tool to analyze visitor behavior. For this function, we collect anonymized data that is stored locally without sharing it with other parties. For more information, please read Burst‘s privacy policy.
• Privacy Suite: This website uses the Privacy Suite for WordPress from Complianz to collect data records on consent. For this functionality, your IP address is anonymized and stored in our database. Further information can be found in the Complianz privacy policy.

12. Can this privacy policy be amended?

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

Last update: 03.06.2024