Privacy Policy

Privacy Policy of INVISION AG

 

Table of Contents

1 Controller and content of this privacy policy

2 Data protection contact

3 When visiting our website (log file data)

4 Using one of our contact options

5 Processing in the context of a business relationship with us

6 Processing when conducting video conferences

7 Applying for a job

8 Central data storage and analysis in the CRM system

9 Newsletter

10 Cookies and tracking tools

11 Our social media presence

12 Disclosure of data to third parties

13 Transfer of personal data abroad

14 Retention periods

15 Data security

16 Your rights

 

1     Controller and content of this privacy policy

We, Invision AG (Grafenaustrasse 7, 6300 Zug, Switzerland), operate the website www.invision.ch (“Website”) and are the contracting party for the services we provide. Unless stated otherwise, we are responsible for the data processing activities described in this privacy policy.

So that you know which personal data we collect from you and for what purposes we use it, please take note of the information below. In terms of data protection, we are primarily guided by the statutory requirements of Swiss data protection law, in particular the Federal Act on Data Protection (“FADP”), as well as the EU General Data Protection Regulation (“GDPR”), whose provisions may be applicable in individual cases.

 

2     Data protection contact

If you have questions about data protection or wish to exercise your rights, please contact our data protection contact by sending an email to the following address: dataprivacy@invision.ch

You can reach our EU data protection representative at:

Invision Beteiligungsberatung GmbH
Data Protection
Karl-Arnold-Platz 2
40474 Düsseldorf
Germany
Phone: +49 211 936 727 50
Email: dataprivacy@invision.ch

 

3     When visiting our website (log file data)

When you visit our website, the servers of our hosting provider (Swizzonic AG, Badenerstrasse 47, 8004 Zurich, Switzerland) record every access in a log file for a maximum period of 12 months. The following data is collected in this process and stored by us until it is automatically deleted:

• the IP address of the requesting computer
• the date and time of access
• the name and URL of the file retrieved
• the website from which access occurred, including any search term used, if applicable
• the operating system of your computer and the browser you use (including type, version, and language setting)
• device type, in the case of access via mobile phones
• the city or region from which access occurred, and
• the name of your internet access provider

This data is processed for the purpose of enabling use of our website, ensuring ongoing system security and stability, and for error and performance analysis. It also allows us to optimize our website.

In the event of an attack on the website’s network infrastructure, or in the event of suspected other unauthorized or improper use of the website, the IP address and other data will be analyzed for investigation and defense purposes and, where applicable, used within the framework of criminal proceedings to identify and take civil and criminal action against the users concerned.

Our legitimate interest in data processing for the purposes described above, within the meaning of Art. 6(1)(f) GDPR, forms the legal basis for this processing.

 

4     Using one of our contact options

If you contact us through our contact addresses and channels (e.g. by email, telephone, or contact form), your personal data will be processed. The data you have provided to us is processed, e.g. your name, the name of your company, your email address or telephone number, and your message. In addition, the time the request was received is documented. Mandatory fields in contact forms are marked accordingly (e.g. with an asterisk).

We process this data solely to respond to your inquiry as effectively as possible. The legal basis for this data processing is our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in responding to your inquiry, or, if your inquiry is aimed at concluding or performing a contract, the taking of the necessary steps within the meaning of Art. 6(1)(b) GDPR.

 

5     Processing in the context of a business relationship with us

We process personal data in the context of your business relationship with us. In doing so, we process, among other things, the following data:

• Your contact information (e.g. name, address, telephone number, email address)
• Information about the company for which you are contacting us, as well as your role within that company
• Billing and payment information
• Identification and background information that you provide to us
• Information that you provide to us for the processing of your inquiry
• Other information that you provide to us

We process this data in the course of providing our services, in order to interact with you, to process your inquiry as effectively as possible on your behalf, to communicate with you, to bill for services rendered, and to administer our business relationship with you. In providing our services, we may also obtain data about you from other sources, for example by consulting publicly accessible sources in order to update your details. Furthermore, we process data when a mandate is opened in order to carry out anti-money-laundering, conflict-of-interest, and reputational checks.

For the processing described above, we use Microsoft 365 and various applications contained therein (e.g. Word, PowerPoint, Excel, Outlook, Teams, OneDrive, and SharePoint) provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA) and/or Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) (“Microsoft”). If we grant you direct access to Microsoft 365, the following additional data will be processed about you:

• The IP address used to access the service
• Access data (e.g. username, data relating to so-called multi-factor authentication)
• Master data (e.g. first name, last name, contact details, profile pictures)
• Usage metadata (e.g. time of access, date, type of access, information on the data/files/documents accessed, and all activities related to such use)

According to Microsoft, in this case the data is primarily stored on servers in the EU. For this data processing, we have concluded a data processing agreement with Microsoft, implemented extensive technical and organizational measures in line with the current state of the art in IT security, and agreed on the EU Standard Contractual Clauses (with additional measures) with Microsoft.

In connection with the use of Microsoft 365, Microsoft also processes certain data as an independent controller. Please note that we have no influence over Microsoft’s data processing activities. Further information on data processing by Microsoft can be found in Microsoft’s privacy policy.

The legal basis for processing personal data for the purposes stated above lies in the performance of pre-contractual measures and the performance of a contract within the meaning of Art. 6(1)(b) GDPR, in compliance with legal obligations under Art. 6(1)(c) GDPR, and in our legitimate interest in the targeted and efficient management of the business relationship within the meaning of Art. 6(1)(f) GDPR.

 

6     Processing when conducting video conferences

To conduct telephone/video conferences, online meetings, and webinars (“Teams meeting”), we use Microsoft Teams from Microsoft. When using Microsoft Teams, various data is processed. In the context of a Teams meeting, the following data may be processed:

• User information (e.g. display name, email address, profile picture, preferred language)
• Metadata of the Teams meeting (e.g. date, time, meeting ID, phone numbers, location, text, audio, and video data)
• Authentication data, log files, and protocol data
• Content of the Teams meeting as well as data from use of the chat function
• Details of incoming and outgoing phone numbers, country name, start and end time, if you dial into the Teams meeting by phone

If we record Teams meetings, we will inform you in advance and, where necessary, ask for your consent.

The legal basis for processing personal data is the performance of pre-contractual measures and the performance of a contract within the meaning of Art. 6(1)(b) GDPR, insofar as the Teams meetings take place within the context of the business relationship. Outside the business relationship, the legal basis is our legitimate interest within the meaning of Art. 6(1)(f) GDPR in responding to your inquiry as effectively as possible.

 

7     Applying for a job

You have the opportunity to apply to us, or, as indicated in the job posting, to one of our portfolio companies, for a specific job posting via our online applicant tool. We collect the following data, whereby mandatory fields in the online form are marked accordingly (e.g. with an asterisk):

• First name*
• Last name*
• Email address*
• Phone*
• Available from*
• Salary expectations
• How did you hear about us*
• Documents:
• CV*
• Other
• Reference letter/work certificate

We use this and other data you voluntarily provide to review your application and carry out the application process. Application documents from applicants who are not selected will be deleted upon completion of the application process, unless you explicitly consent to a longer retention period or we are legally obligated to retain them longer.

For online applications, we work together with the e-recruitment tool of Personio SE & Co. KG (Seidlstrasse 3, 80335 Munich, Germany).

The legal basis for reviewing your application and carrying out the application process is the performance of pre-contractual measures within the meaning of Art. 6(1)(b) GDPR.

 

8     Central data storage and analysis in the CRM system

Insofar as a clear assignment to your person is possible, we will store and link the data described in this privacy policy — in particular your personal details, your contacts with us, your contract data, and your browsing behavior on our websites — in a central database. This serves the efficient management of customer data, allows us to respond adequately to your concerns, and enables the efficient provision of the services you request and the processing of the related contracts. The legal basis for this data processing is our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in the efficient management of user data. For this purpose, we use the Microsoft Dynamics 365 software from Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA) and/or Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), and we ensure the protection of your data through appropriate safeguards (generally the EU Standard Contractual Clauses). The legal basis for this processing is our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in using third-party services.

We evaluate this data in order to further develop our services in line with user needs. The legal basis for this data processing is our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in carrying out marketing activities.

 

9     Newsletter

If you have expressed interest in our newsletter, we collect the following data:

• Email address
• Salutation
• First and last name

Insofar as you maintain a business relationship with us, or by expressing interest in our newsletter, you consent to the processing of this data (to the extent consent is required) in order to receive messages from us about our company, our services, and related information (e.g. on investment opportunities). We use your data to send emails until you withdraw your consent. Withdrawal is possible at any time via the unsubscribe link in all of our marketing emails.

Our newsletters may contain a web beacon, a 1×1 pixel (tracking pixel), or similar technical tools. A web beacon is an invisible graphic linked to the user ID of the respective newsletter recipient. For each newsletter sent, we receive information on which addresses have not yet received the email, to which addresses it was sent, and for which addresses delivery failed. It is also shown which addresses opened the email and for how long, and which links they clicked. Finally, we also receive information on which addresses have unsubscribed. We use this data for statistical purposes and to optimize newsletters in terms of frequency, timing, structure, and content of the emails. This allows us to better tailor the information and offers in our emails to the individual interests of recipients.

The web beacon is deleted when you delete the email. To prevent the use of the web beacon in our newsletter, please configure your email program so that HTML is not displayed in messages. Instructions on how to configure this setting can be found in the help sections of your email software, for example here for Microsoft Outlook.

By expressing interest in our newsletter, you also consent to the statistical evaluation of user behavior for the purpose of optimizing and adapting the newsletter. This consent forms our legal basis for processing the data within the meaning of Art. 6(1)(a) GDPR.

We use the CleverReach software from CleverReach GmbH & Co. KG (//CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany) for newsletters and ensure the protection of your data through appropriate safeguards (in this case pursuant to Annex 1 DPA). Your data is therefore stored in a CleverReach database, giving CleverReach access to your data. The legal basis for this processing is our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in using third-party services.

 

10   Cookies and tracking tools

For more information on the cookies and tracking technologies used, please see our Cookie Policy.

 

11   Our social media presence

On our website you will find links to our employees’ profiles on LinkedIn, operated by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland).

If you click on the LinkedIn icon, you will automatically be redirected to the selected profile of our employee on LinkedIn. In doing so, a direct connection is established between your browser and LinkedIn’s server. As a result, LinkedIn receives the information that you visited our website and clicked the link, along with your IP address.

If you click on the LinkedIn icon while logged into your LinkedIn user account, the content of our website may be linked to your profile, such that LinkedIn can directly attribute your visit to our website to your account. If you wish to prevent this, you should log out before clicking the icon. A connection between your access to our website and your user account will occur in any case if you log in to LinkedIn after clicking the icon. LinkedIn is responsible under data protection law for the related data processing. Please therefore refer to the information on LinkedIn’s website.

The legal basis for any processing attributable to us is our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in the use and promotion of our employees’ social media presence.

 

12   Disclosure of data to third parties

Without the support of other companies, we would not be able to provide our services in the desired form. In order for us to make use of these companies’ services, it is to some extent also necessary to disclose your personal data. Such disclosure occurs, in particular, to the extent necessary for the performance of the contract you desire. For such disclosures, the necessity for the performance of the contract within the meaning of Art. 6(1)(b) GDPR forms the legal basis.

Disclosure also occurs to selected service providers, and only to the extent necessary for the provision of the service. Various third-party service providers are already explicitly mentioned in this privacy policy. Otherwise, these include, for example, IT service providers (such as providers of software solutions or reporting/analysis solutions), advertising agencies, and consulting firms. Our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in obtaining third-party services forms the legal basis for this data disclosure.

In addition, your data may be disclosed, in particular to authorities, legal advisors, or debt collection companies, if we are legally obligated to do so or if this is necessary to safeguard our rights, in particular to enforce claims arising from our relationship with you. Data may also be disclosed if another company intends to acquire our company or parts thereof, and such disclosure is necessary for conducting due diligence or completing the transaction. In addition, we transmit your data to companies affiliated with us (i.e. other companies within the corporate group). Our legitimate interest, within the meaning of Art. 6(1)(f) GDPR, in safeguarding our rights and complying with our obligations, or in the sale of our company, forms the legal basis for this data disclosure.

 

13   Transfer of personal data abroad

We are entitled to transfer your personal data to third parties abroad, insofar as this is necessary to carry out the data processing described in this privacy policy. In doing so, the statutory provisions on the disclosure of personal data to third parties are of course observed. Where the country in question does not have an adequate level of data protection, we ensure through contractual arrangements that your data is adequately protected at these companies.

 

14   Retention periods

We store personal data only for as long as necessary to carry out the processing described in this privacy policy within the framework of our legitimate interest. For contract-related data, storage is required by statutory retention obligations. Requirements obligating us to retain data arise from accounting regulations and tax law provisions. Under these provisions, business correspondence, concluded contracts, and accounting records must be retained for up to 10 years. Once we no longer need this data to provide services to you, the data will be blocked. This means the data may then only be used if necessary to fulfill retention obligations or to defend and enforce our legal interests. Data is deleted or anonymized as soon as there is no longer any retention obligation or legitimate interest in its retention.

 

15   Data security

We employ appropriate technical and organizational security measures to protect your personal data stored with us against loss and unlawful processing, in particular unauthorized access by third parties. Our employees and the service providers we engage are obligated by us to maintain confidentiality and uphold data protection. Furthermore, these persons are granted access to personal data only to the extent necessary to fulfill their tasks.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information over the internet and via electronic communication means always involves certain security risks, and we cannot provide an absolute guarantee for the security of information transmitted in this way.

 

16   Your rights

Provided the statutory requirements are met, as a data subject affected by data processing you have the following rights:

• Right of access: You have the right to request, free of charge and at any time, access to the personal data we hold about you, insofar as we process it. This allows you to verify which personal data we process about you and that we use it in accordance with applicable data protection provisions.
• Right to rectification: You have the right to have inaccurate or incomplete personal data corrected and to be informed of such correction. In this case, we will inform the recipients of the affected data of the adjustments made, unless this proves impossible or involves disproportionate effort.
• Right to erasure: You have the right to have your personal data deleted under certain circumstances. In individual cases, in particular where statutory retention obligations apply, the right to erasure may be excluded. In such cases, where the relevant requirements are met, the data may be blocked instead of deleted.
• Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.
• Right to data portability: You have the right to receive, free of charge, the personal data you have provided to us in a readable format.
• Right to object: You may object to data processing at any time.
• Right to withdraw consent: In principle, you have the right to withdraw any consent given at any time. However, processing activities carried out in the past based on your consent do not become unlawful as a result of your withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority, for example regarding the manner in which your personal data is processed.

To exercise these rights, please send us an email to the address listed in Section 2.