Privacy Statement

01Background

This Notice applies to the Personal Data BIOALGX AG (“BIOALGX”, “us”, “we”, or “our”) may collect about you. BIOALGX is responsible for ensuring that it uses Personal Data in compliance with SWISS data protection laws.

At BIOALGX we respect your privacy and are committed to keeping all your Personal Data secure. We will only collect and process your Personal Data for legitimate reasons, in accordance with applicable law and/or regulation and as described in this Notice.

In this data privacy statement, we, BIOALGX, explain how we collect and otherwise process personal data in our activities. “Personal data” is defined as all the information that relates to an identified or identifiable person. The privacy statement applies to all persons whose data we process, regardless of how they contact us, e.g. by telephone, on one of our websites or via our initiatives, one of our pages on a social network, at one of our events, etc. It applies both to the processing of personal data already collected as well as data to be collected in the future. This data privacy statement does not contain an exhaustive description; other data privacy statements or general terms and conditions, conditions of participation and similar documents may govern specific matters.

02Responsible persons and contacts

BIOALGX is responsible for the data processing described here. If you have any data privacy concerns, you can contact us at the following address:

03Collection and processing of personal data

Personal data is all information that relates to an identified or identifiable natural person. Data that cannot be assigned to a natural person (anonymous data) is not included.

You often disclose personal data yourself, e.g. when you transmit data to us or communicate with us. In particular, we process personal data that we receive from you, our customers and business partners as well as other persons in connection with our business relationships or that we collect from visitors to our websites. We also process personal data when you participate in our events, register in our event and newsletter notification lists or interact with us via social media or on our website.

In particular, we process the following personal data:

• Data about your identity such as first name, surname, date of birth, gender, title;
• Contact information — such as name, address, email address, telephone number, professional activity, industry and areas of interest;
• Communication data — such as email correspondence with you;
• Information related to your professional functions and activities;
• Financial data such as bank details and payment card details;
• Information that is provided to us for the purpose of attending meetings, seminars or events and information about which offers you have used or which events you have attended;
• Information about how you interact with our websites or how you use our websites;
• Technical data — such as IP address, language settings, browser settings, time zone, operating system, platform, screen resolution; URL path, username/ID (if available), date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type, referrer URL (the URL that refers to our website, e.g. Google search), the requesting provider;
• Image and video recordings of you — such as photos or videos of our events. By participating in our events, you agree that such images and videos may be used by Basel Area for marketing and promotional purposes, including on our website, social media channels, newsletters, and other marketing materials.
• Advertising and communication data — such as information about when you receive and read newsletters from us, which of our events you attend and preferences for advertising and communication settings;
• Data and information, for example in documents or correspondence and meetings with third parties, which are sent to us by third parties or which we take from public registers; or
• Other information relating to you that you provide to us.

We collect particularly sensitive personal data if we are legally obliged to do so or if you, courts, authorities, etc. have provided us with such information.

This list is not exhaustive. In individual cases, we may also process further personal data.

If you provide us with personal data from other persons (e.g. family members, work colleagues), please make sure that these persons are aware of this privacy statement and only provide us with their personal data if you are allowed to do so and if this personal data is correct.

In addition to the data that you provide to us directly, we collect personal data from the following sources, insofar as this is permitted: Information that you provide to us, your family, your employer, your contractual partners, our business partners, consultants or other third parties; Information from public registers (e.g. commercial register, press, Internet); Information from the media and Internet about you (insofar as this is appropriate in the specific case, e.g. in the context of an application, press review, marketing/sales, etc.).

This may also include business contact data obtained from publicly accessible sources such as official company registers, publicly available databases, company websites and professional networking platforms. The data collected may include names, job titles, company affiliations, business email addresses and other professional contact details that are relevant in a business context.

04Purpose of personal data processing

We process the data collected primarily in order to achieve the objectives of BIOALGX, to communicate with you, to conclude and process contracts with our customers and business partners, in particular in connection with our business relationships with our customers and the procurement of products and services from our suppliers and contractors. We then process personal data to further develop our offers, services and websites, and other platforms on which we are present; for market and opinion research, media monitoring; to ensure our operations, in particular IT, our websites and other platforms as well as measures for IT, building and facility security and protection of our employees and other people and assets entrusted to us (such as access controls, visitor lists, network and email scanners, telephone recordings) and to comply with our domestic and foreign legal and regulatory obligations.

Employees of such a customer or business partner may also be affected by our data processing.

We process the data collected primarily in order to achieve the objectives of BIOALGX, to communicate with you, to conclude and process contracts with our customers and business partners, in particular in connection with our business relationships with our customers and the procurement of products and services from our suppliers and contractors. We then process personal data to further develop our offers, services and websites, and other platforms on which we are present; for market and opinion research, media monitoring; to ensure our operations, in particular IT, our websites and other platforms as well as measures for IT, building and facility security and protection of our employees and other people and assets entrusted to us (such as access controls, visitor lists, network and email scanners, telephone recordings) and to comply with our domestic and foreign legal and regulatory obligations.

This also includes contacting organizations and professionals by email or other means where we consider that our services, programs or regional initiatives may be of interest in a professional context, including individual communications and targeted outreach campaigns that are not limited to newsletter subscriptions.

Employees of such a customer or business partner may also be affected by our data processing.

Where we contact individuals in their professional capacity without prior interaction, we rely on our legitimate interest in promoting our services and initiatives to relevant organizations. We ensure that such communication is limited to business-related content and that the rights and interests of the data subjects are not overridden.

If you have given us your consent to process your personal data for certain purposes (for example, when registering to receive the newsletters), we will process your personal data to the extent of and on the basis of that consent, unless we have another legal basis, insofar as such consent is needed.

Consent can be revoked at any time; however, this has no effect on the data processed before the revocation.

05Data transfer and data transfer abroad

Sometimes, as part of our activities, it is necessary for us to transfer your personal data to another organization, a data processor or other third parties – insofar as this is permitted and appears to us to be appropriate – because they process it for us or because they want to use it for their own purposes.

A data processor is a company that handles the information on our behalf and in accordance with our instructions. We have data processors who support us in particular with:

• IT services (companies that perform the necessary operations, technical support and maintenance of our IT solutions).
• Marketing service providers (lead generation, printing and sales, web, design and creative agencies).

To the extent we are permitted, we may also disclose your personal data to comply with the law, a judicial proceeding, a court order or other legal process, including arbitration proceedings, e.g. in response to a court order or a subpoena. We also disclose data to public and judicial authorities, supervisory authorities or government bodies and in proceedings if required by law or regulations or by these authorities or other public bodies.

We generally process and store personal data in Switzerland and the European Economic Area (EEA). In certain cases, however, we may also disclose personal data to service providers and other recipients who are located outside this area or who process personal data outside this area, in principle in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually oblige this person to comply with adequate data protection (we use the revised standard contractual clauses of the European Commission: eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless they are already subject to a legally recognized set of rules to ensure data protection and we are able to rely on an exception provision. An exception may apply in particular to legal proceedings abroad, but also in cases of overriding public interest or if the execution of a contract requires such disclosure, if you have given your consent or if it concerns data made generally accessible by you, the processing of which you have not objected to.

06Cookies

“Cookies” are small files that make it possible, during a user’s visit to the BIOALGX website, to store specific information related to the user on the user’s computer or other terminal device. BIOALGX uses cookies in particular to determine the frequency of use and the number of users of its website and to make the range of services as convenient, efficient and attractive as possible. The BIOALGX website uses the following types of cookies to identify users during their visit:

• Strictly necessary cookies (third-party cookies: reCAPTCHA, LinkedIn)
• Performance cookies (third-party cookies: Microsoft D365)
• Targeting cookies (third-party cookies: YouTube, Doubleclick by Google, LinkedIn)

Users can set their browser to disable cookies, to restrict them to certain websites or so that they are informed as soon as a cookie is sent. Users can also delete cookies from their computer’s hard drive at any time.

You can refuse the use of cookies at any time via the “Cookie Settings” pop-up window at the bottom left of our web pages. However, please note that you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you in the manner and for the purposes set out above.

07Log files

Every time a page is accessed and displayed, access logs are recorded in a log file, in Switzerland, and are automatically deleted after 24 hours. The website statistics are generated from the raw logs and stored in prepared form. These records contain the following information: IP address of the accessing device, date and time of access, URL accessed, access status/HTTP status code, amount of data transferred during access, browser identification of the user and the website from which the user was redirected to the requested page (referrer), if available. BIOALGX reserves the right to use data from log files if there is a suspicion that users are using the website in violation of the law or contractual provisions.

08Social media

We use the Salient Social Plugin to share our content on the social network LinkedIn. This is visible to you (usually through appropriate symbols). We’ve configured these items to disable tracking by default. If you activate these icons (by clicking), the operators of the corresponding social networks can detect that you are on our website and where exactly you are on our website and can use this information for their own purposes. This processing of your personal data is the responsibility of the respective operator and is carried out in accordance with their data protection regulations.

09Profiling

We may process some of your personal data automatically in order to evaluate certain personal aspects (“profiling”). In particular, profiling enables us to provide you with better advice about services or to inform you about events that may be relevant to you. For this purpose, we may use evaluation tools to communicate with you and place appropriate advertisements for you, including market and opinion research.

10Third-party links

Our service may contain links to third-party websites. Access to and use of such linked websites is not subject to this privacy statement, but to the privacy policies of those third-party websites. We are not responsible for the information practices of such third-party websites.

11Automated individual decisions

In principle, we do not use fully automated automatic decision-making (as regulated in Art. 22 GDPR, for example) to establish and implement the business relationship. Should we use such procedures in individual cases, we will inform you separately if this is required by law and will inform you of the associated rights.

12Data security

We take appropriate technical and organizational security precautions to protect your personal data against unauthorized access and misuse, such as issuing instructions, training, IT and network security solutions, access controls and restrictions, encryption of data carriers and transmissions, etc. Employees sign an employment contract that contains a confidentiality clause. We also require our contractors to take appropriate technical and organizational security measures.

13Period for which personal data is stored

We process and store your personal data as long as it is necessary for the fulfilment of our contractual and legal obligations or otherwise for the purposes intended by the processing, i.e. for example for the duration of the entire business relationship (from the initiation and processing of a contract through to its termination) as well as in accordance with the statutory retention and documentation obligations. It is possible that personal data will be kept for the period in which claims can be asserted against our company and insofar as we are otherwise legally obliged to do so or legitimate business interests require this (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for these purposes, it will generally and wherever possible be deleted or anonymized. For operational data (e.g. system and other logs), shorter retention periods apply.

14Rights of the data subject

You have the right to information about, and correction and deletion of, your data within the framework of the data protection law applicable to you. In addition, there is the right to restrict data processing and to object to our data processing activities, in particular those carried out for direct marketing, profiling in the context of direct marketing and other legitimate interests in data processing. Furthermore, you have the right to surrender certain personal data for transfer to other bodies (“data portability”).

Please note that these rights may be restricted or excluded in individual cases, for example if there are doubts about a person’s identity or if this is necessary to protect other people, to protect legitimate interests or to comply with statutory obligations.

If you incur costs, we will inform you in advance.

We have already informed you above about the possibility of revoking your consent. Please note that the exercise of these rights may conflict with contractual agreements, and this may have consequences such as the premature termination of the contract or additional costs. We will inform you in advance in such a case, unless this is already regulated by contract.

In order to assert these rights, it is generally necessary for you to prove your identity (e.g. by means of a copy of the identity documents if your identity is not otherwise apparent or can be verified in another way).

In addition, any data subject is entitled to enforce their rights in court or to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

15Changes to privacy statement

BIOALGX may amend this data privacy statement at any time, with no prior notice. The current version published on our website applies.