Privacy notice

We appreciate your interest in our company. Data protection is of great important to the management of Arcolor AG. It is generally possible to use the web pages of Arcolor AG without providing any personal data. Should a data subject use particular services of our company via our website, processing personal data may however become necessary. Should the processing of personal data be necessary and should no legal basis for such processing exist, we generally obtain the consent of the data subject.

The processing of personal data, for example name, address, email address or telephone number of a data subject concerned always takes place in accordance with the data protection provisions which apply to Arcolor AG. By means of this privacy notice, our company wishes to inform the public of the type, scope and purpose of the personal data which is collected, used and processed by us. Furthermore, by means of this privacy notice, we wish to inform data subjects of the rights to which they are entitled.

As the party responsible for the processing, Arcolor AG has implemented numerous technical and organizational measures to ensure the greatest degree of protection possible for the personal data which is processed via this website. However, as a rule Internet-based data transfers can have security risks, which means that absolute protection cannot be guaranteed. For this reason, each person concerned is free to also provide us with personal data via alternative channels, for example by telephone.

1. Definitions

Our privacy notice is intended to be easily readable and understandable, both for the public and for our customers and business partners. In order to guarantee this, we wish to explain the terms which are used first.

We use the following terms in this privacy notice among others:

a) Personal data
Personal data is all information which relates to an identified or identifiable private individual (hereinafter referred to as “data subject”). A private individual is considered to be identifiable if he or she can be identified directly or indirectly, in particular by means of assignment to a category, such as a name, identification number, location number, online profile or one or more special characteristics which express the physical, physiological, genetic, psychiatric, economic, cultural or social identification of this private individual.

b) Data subject
A data subject is any identified or identifiable private individual whose personal data is processed by the body which is responsible for the processing.

c) Processing
Processing is any procedure carried out with or without the assistance of automated procedures or any such procedure in connection with personal data, such as gathering, recording, organization, allocation, saving, adjustment or alteration, reading, retrieval, use, disclosure by means of transfer, distribution or other form of provision, comparison or connection, restriction, deletion or destruction.

d) Restriction of the processing
Restriction of the processing is the marking of saved personal data in order to restrict its processing in the future.

e) Profiling
Profiling is any type of automated processing of personal data which means that this personal data is used to evaluate certain personal aspects which relate to a private individual, in particular to analyze or forecast aspects in relation to work performance, financial position, health, personal preferences, interests, reliability, behavior, place of residence or change of location on the part of the said private individual.

f) Pseudonymization
Pseudonymization is the processing of personal data in such a way that the personal data can no longer be assigned to a specific private individual without consulting additional information, provided that the said additional information is stored separately and is subject to technical and organizational measures which guarantee that the personal data cannot be assigned to an identified or identifiable private individual.

g) Controller or body responsible for the processing
The controller or body responsible for the processing is the private individual or legal entity, authority, institution or other entity which takes decisions alone or together with others concerning the purposes and methods of the processing of personal data. Should the purposes and methods of the said processing be prescribed by law, the specific criteria concerning the appointment of the controller can be mandated by law.

h) Order processor
The order processor is a private individual or legal entity, authority, institution or other entity which processes personal data on behalf of the controller.

i) Recipient
The recipient is a private individual or legal entity, authority, institution or other body to whom personal data is disclosed, regardless of whether this is a third party or not. Authorities which may receive personal data within the framework of a specific investigation order are not, however, considered to be recipients.

j) Third party
A third party is a private individual or legal entity, authority, institution or other body apart from the data subject, controller, order processor and the persons who are authorized to process the personal data under the direct responsibility of the controller or order processor.

k) Consent
Consent is any declaration of consent issued by the data subject voluntarily in an informed manner and without any misunderstanding for the specific case in the form of a declaration or other clear confirmatory action, by means of which the data subject makes clear that he or she agrees to the processing of the personal data relating to him or her.

2. Name and address of the controller

The controller is:

Arcolor AG
Urnäscherstrasse 50
9104 Waldstatt
Switzerland
Tel: +41 71 353 70 30
Email: info@arcolor.ch
Website: www.arcolor.ch

3. Name and address of the data protection coordinator

The data protection coordinator of the body responsible for the processing is:

Cornel Hollenstein
Arcolor AG
Urnäscherstrasse 50
9104 Waldstatt
Switzerland
Tel.: +41 71 353 70 30
Email: c.hollenstein@arcolor.ch
Website: www.arcolor.ch

Each data subject can contact the data protection coordinator directly in case of any questions and suggestions concerning data protection.

4. Cookies

The web pages of Arcolor AG use cookies. Cookies are text files which are stored and saved on a computer system via an Internet browser.

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a clear identification of the cookie. This consists of a character line by means of websites and servers can be assigned to the concrete Internet browser in which the cookie was saved. This enables the visited websites and servers to distinguish the individual browser of the data subject from other Internet browsers which contain different cookies. A specific Internet browser can be recognized once again and identified via the clear cookie ID.

By using cookies, Arcolor AG can provide the users of this website with user-friendlier services, which would not be possible without cookies.

By means of a cookie, the information and services on our website can be optimized for the user. As explained above, cookies enable us to recognize the users of our website once again. The purpose of this recognition is to make the use of our website easier for users.

The data subject can prevent the setting of cookies by our website at any time by setting the used website accordingly and therefore permanently objecting to the setting of cookies. Furthermore, cookies which have already been set can be deleted at any time via an Internet browser or other software programs. This is possible in all current Internet browsers. Should the data subject deactivate the setting of cookies in the Internet browser being used, then it may be the case that not all of the functions of our website will be fully usable.

5. Recording of general data and information

Each time the Arcolor AG website is accessed by a data subject or an automated system, a large amount of general data and information is recorded. This general data and information is saved in the server’s logfiles. The following can be recorded: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system came across our website (so-called referrer), (4) the web pages which are managed on our website via an accessing system, (5) the date and time of accessing the website, (6) an IP address, (7) the Internet service provider of the accessing system and (8) other similar data and information which allows us to protect against dangers in case of attacks against our IT systems.

When using this general data and information, Arcolor AG is not able to trace the data subject. Rather, this information is required to: (1) correctly deliver the content of our website, (2) optimize the content of our website and the advertising for this, (3) guarantee constant functionality of our IT systems and the technology of our website and (4) provide the necessary information to the criminal prosecution authorities in the event of a cyber attack.

6. Routine deletion / blocking of personal data

The body responsible for the processing processes and saves personal data of the data subject only for the period of time necessary to attain the purpose of the saving or if this has been provided for by the legislator in laws or regulations applicable to the body responsible for the processing.

Should the purpose of the saving no longer apply or should the period of saving prescribed by the legislator expire, the personal data will be blocked or deleted routinely and in accordance with the legal regulations.

7. Rights of the data subject

b) Right of information
Each person affected by the processing of personal data has the right granted by the legislator to receive free information from the body responsible for the processing concerning the personal data saved in relation to his or her person as well as a copy of the said information. Furthermore, the legislator has granted the data subject the right to receive details concerning the following information:

• The purposes of the processing
• The categories of personal data being processed
• The recipients or categories of recipients to whom personal data has been disclosed or will be disclosed in the future, in particular in the event of recipients in third countries or at international organizations
• Where possible, the planned duration for which personal data is being saved or should this not be possible, the criteria for determining this duration
• The existence of a right to have the personal data relating to him or her rectified or erased or to have the processing by the controller restricted or the right to raise an objection against this processing
• The right to complain to a supervisory authority
• Should the personal data not be gathered from the data subject: All available information concerning the origin of the data

Furthermore, the data subject has the right to receive information as to whether personal data has been transferred to a third country or an international organization. Should this be the case, the data subject also has the right to receive information concerning the suitable guarantees in connection with the transfer.

Should a data subject wish to claim this right of confirmation, he or she can contact an employee of the body responsible for the processing at any time.

c) Right of rectification
Each person affected by the processing of personal data has been granted the right by the legislator to request the immediate rectification of incorrect personal data relating to him or her. Furthermore, the data subject has the right to have incomplete personal data corrected, also by means of a supplementary declaration, taking the purposes of the processing into account.

Should a data subject wish to claim this right of correction, he or she can contact an employee of the body responsible for the processing at any time.

d) Right to erasure (right to be forgotten)
Each person affected by the processing of personal data has been granted the right by the legislator to request from the controller that the personal data relating to him or her be immediately erased, should one of the following reasons be given and should the processing not be necessary:

• The personal data was gathered for such purposes or processed in such a way which is no longer necessary.
• The data subject revokes his or her consent on which the processing was based and there is no other legal basis for the processing.
• The data subject raises an objection against the processing and there are no legitimate reasons for the processing which take priority.
• The personal data has been processed unlawfully.
• The erasure of the personal data is necessary to fulfill a legal obligation to which the controller is subject.

Should one of the reasons above be given and should a data subject wish to have personal data which is saved by Arcolor AG deleted, he or she can contact an employee of the body which is responsible for the processing at any time. The employee of Arcolor AG will ensure that the erasure request is complied with.

Should the personal data have been made public by Arcolor AG and should our company be obligated to erase the personal data as the controller, then taking the available technology and implementation costs into account, Arcolor AG will take reasonable measures, also of a technical nature, to inform other data processing controllers who processed the published personal data that the data subject has request that the other data processing controllers delete all links to the said personal data or copies or reproductions thereof, should the processing not be necessary. The employees of Arcolor will take the necessary steps in the individual case.

e) Right to have the processing restricted
Each person affected by the processing of personal data has been granted the right by the legislator to request that the controller restrict the processing, should one of the following requirements be met:

• The correctness of the personal data is disputed by the data subject for a period of time which enables the controller to check the correctness of the personal data.
• The processing is unlawful, the data subject rejects the erasure of the personal data and requests instead that the use of the personal data be restricted.
• The controller no longer requires the personal data for the purposes of the processing, however, the data subject requires it in order to assert, exercise or defend legal claims.
• The data subject has raised an objection against the processing and it is not yet clear whether the legitimate reasons of the controller outweigh those of the data subject.

Should one of the above reasons be given and should a data subject wish to have personal data which is saved by Arcolor AG restricted, he or she can contact an employee of the body which is responsible for the processing at any time. The employee of Arcolor will take the necessary steps in the individual case.

f) Right of data portability
Each person affected by the processing of personal data has been granted the right by the legislator to receive the personal data relating to him or her which was provided to the controller by the data subject in a structured, up-to-date and machine-readable format. He or she also has the right to transfer the said data to another controller without hindrance on the part of the controller to which the personal data was provided, should the processing be based on consent or a contract and should the processing take place with the assistance of automated procedures, should the processing be necessary to carry out a task which is in the public interest or should the processing be necessary to exercise public powers which have been assigned to the controller.

Furthermore, when exercising his or her right of data portability, the data subject has the right to have the personal data transferred from one controller directly to another controller, provided that this is technically feasible and that the rights and freedoms of other persons are not affected as a result.

In order to claim the right of data portability, the data subject can contact an employee of Arcolor AG at any time.

g) Right of objection
Each person affected by the processing of personal data has been granted the right by the legislator to raise an objection against the processing of personal data relating to him or her for reasons connected to his or her specific situation. This also applies to profiling based on these provisions.

In the event of an objection, Arcolor AG will no longer process the personal data, unless we can prove mandatory protectable reasons for the processing which outweigh the interests, rights and freedoms of the data subject or unless the processing serves the purpose of asserting, exercising or defending legal claims.

Should Arcolor AG process personal data to operate direct advertising, the data subject has the right to raise an objection against the processing of personal data for the purpose of such advertising at any time. This also applies to the processing should it be connected to such direct advertising. Should the data subject raise an objection with Arcolor AG against the processing for purposes of direct advertising, Arcolor AG will no longer process the personal data for these purposes.

In addition, for reasons connected to his or her specific situation, the data subject has the right to raise an objection against the processing of personal data relating to him or her which is carried out by Arcolor AG for scientific, historical research or statistical purposes, unless such processing is necessary in order to fulfill a task which is in the public interest.

In order to exercise the right of objection, the data subject can contact any employee of Arcolor AG at any time. In connection with the use of services of the information company, the data subject is also free to exercise his or her right of objection by means of automated procedures where technical specifications are used.

h) Automated decisions in the individual case, including profiling
Each person affected by the processing of personal data has been granted the right by the legislator not to be subject to a decision based solely on automated processing, including profiling, which has legal effect on him or her or which significantly impacts on him or her in a similar manner, unless the decision is (1) necessary for the conclusion or performance of a contract between the data subject and the controller or (2) is lawful in accordance with legal regulations to which the controller is subject and the said legal regulations contain measures to safeguard the rights and freedoms, as well as the legitimate interests of the data subject or (3) takes place with the express consent of the data subject.

Should the decision (1) be necessary in order to perform a contract between the data subject and the controller or (2) take place with the express consent of the data subject, Arcolor AG will take reasonable measures to safeguard the rights and freedoms, as well as the legitimate interests of the data subject, whereby this includes as a minimum to have a person intervene on the part of the controller, to set out one’s opinion and to contest the decision.

Should the data subject wish to claim his or her rights in connection with automated decisions, he or she can contact an employee of the body which is responsible for the processing at any time.

i) Right to revoke consent which has been issued under data protection laws
Each person affected by the processing of personal data has been granted the right by the legislator to revoke any consent which has been issued in connection with the processing of personal data.

Should the data subject wish to claim his or her rights to revoke consent, he or she can contact an employee of the body which is responsible for the processing at any time.

8. Data protection in relation to applications and during the application process

The body responsible for the processing gathers and processes the personal data of applicants in order to carry out the application process. The processing can also take place electronically. This is the case, in particular, if an applicant sends relevant application documents to the body responsible for the processing by electronic means, for example by email or by a web form on the website. Should the body responsible for the processing conclude an employment contract with an applicant, the transferred data will be saved for the purpose of performing the employment relationship in compliance with the statutory regulations. Should no employment contract be concluded with the applicant by the body responsible for the processing, the application documents will be deleted two months after notification of the rejection, unless other legitimate interests of the body responsible for the processing prevent the deletion.

9. Legal basis of the processing

The Data Protection Act (Datenschutzgesetz) serves as the legal basis for processing procedures where we obtain consent for a specific processing purpose. Should the processing of personal data be necessary to perform a contract whose contracting party is the data subject, which is the case with processing procedures which are necessary in order to deliver goods or provide other services or consideration as examples, the processing is based on the relevant guidelines. The same applies to such processing procedures which are necessary in order to carry out pre-contractual measures, such as in the case of inquiries relating to our products or services. Should our company be subject to a legal obligation which makes the processing of personal data necessary, such as in order to fulfill tax obligations, the processing is based on the statutory regulations. In rare cases, the processing of personal data may become necessary in order to safeguard vital interests of the data subject or of another private individual. For example, this would be the case if a visitor to our company were to be injured and his or her name, age, health insurer details or other vital information needed to be disclosed to a doctor, hospital or other third parties. Processing procedures not covered by any of the above legal provisions are based on this legal basis should the processing be necessary in order to safeguard a legitimate interest of our company or of a third party, provided that this does not outweigh the interests, basic rights and basic freedoms of the data subject. Such processing procedures are therefore permitted on our part in particular because they have been stated specifically by the legislator. To this extent, the legislator expressed the opinion that a legitimate interest could be assumed if the data subject is a customer of the controller.

10. Legitimate interests in the processing which are pursued by the controller or a third party

Should the processing of personal data be based on the guidelines, our legitimate interest is represented by the carrying out of our business activities in the common interests of our employees and shareholders.

11. Duration of the saving of personal data

The criteria for the duration of the saving of personal data is the respective statutory retention period. Following the expiration of the statutory retention period, the relevant data will be routinely deleted, unless the data remains necessary to perform or negotiate a contract.

12. Legal or contractual regulations concerning the provision of personal data; necessity for conclusion of the contract; obligation on the part of the data subject to provide the personal data; possible consequences of failure to provide personal data

We wish to inform you that the provision of personal data is partly required by law (for example tax regulations) or may be necessary under contractual provisions (for example information concerning the contracting partner). In addition, in order to conclude a contract, it may be necessary for a data subject to provide us with personal data, which will then need to be processed by us. For example, the data subject is obligated to provide us with personal data if our company concludes a contract with him or her. Non-provision of the personal data would mean that the contract would not be able to be concluded with the data subject. Prior to the provision of personal data by the data subject, he or she must contact one of our employees. Our employee will provide clarification to the data subject in the individual case as to whether the provision of the personal data is mandated by law or required under the contract or is necessary to conclude the agreement, whether an obligation to provide the personal data exists and what the consequences of failure to provide the personal data would be.

13. Existence of automated decision making

As a responsible company, we do not carry out automated decision making or profiling.

14. Validity

This privacy notice remains in effect until further notice. (Last revised: June 2023)