Data privacy regultions

This Privacy Policy informs you about how we process personal data. We are aware of the importance that the processing of personal data has for the data subject and comply with all applicable statutory requirements. Protecting your privacy is of the utmost importance to us. We therefore consider compliance with the statutory data protection provisions a matter of course.

Name and contact details of the controller and, where applicable, its representative:

pilot suisse AG
Giesshübelstraße 10, 8045 Zurich
info(at)pilot-suisse.ch

Place of jurisdiction: Zurich, Switzerland

Personally liable shareholder:

pilot suisse AG

Managing Directors authorized to represent the company:

Ahmad Hoteit, Ben Moser

You can contact our Data Protection Officer at: datenschutz(at)pilot.de

We collect and process the following personal data about you:

• Contact information
• Social media identifiers
• Online identifiers

We process your personal data for the following purposes:

• Contacting you (mailings)
• Advertising
• Quality assurance
• Statistics

The processing of your data is based on the following legal grounds:

• Your consent, Art. 6 para. 1 lit. a) GDPR
• The performance of a contract with you, Art. 6 para. 1 lit. b) GDPR
• Legitimate interests, Art. 6 para. 1 lit. f) GDPR (see below)

When processing your data, we pursue the following legitimate interests:

• Improving our services
• Protection against misuse
• Statistics

When processing your data, we work with the following service providers who have access to your data:

• Web hosting providers
• Providers of social media platforms
• Advertising networks (for displaying advertisements)
• Providers of web analytics tools

We store your data

• if you have consented to the processing, for no longer than until you withdraw your consent,
• if we require the data to perform a contract, for no longer than the contractual relationship with you exists or statutory retention periods apply,
• if we use the data on the basis of a legitimate interest, for no longer than your interest in having the data deleted or anonymized does not prevail.

We receive the data from you (including via the devices you use).

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if processing takes place as part of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is done only in accordance with the statutory provisions.

Unless explicit consent has been given or the transfer is required by contract or law, we process or have data processed only in third countries with a recognized level of data protection, on the basis of a contractual obligation through so-called standard contractual clauses of the EU Commission, where certifications exist or binding internal data protection regulations apply (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de)

You have the right, in some cases subject to certain conditions,

• to request access to information about the processing of your data,
• to have your data rectified,
• to have your data erased or blocked,
• to have processing restricted,
• to object to the processing of your data,
• to receive your data in a portable format and transmit it to a third party,
• to withdraw your consent to the processing of your data with effect for the future, and
• to lodge a complaint with the competent supervisory authority about unlawful data processing.

The competent supervisory authority is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

Requirement or obligation to provide data:

Unless expressly stated at the time of collection, the provision of data is not required or mandatory.

We maintain online presences within social networks and process users’ data in this context in order to communicate with users active there or to provide information about us.

Please note that users’ data may be processed outside the European Union. This may result in risks for users, as it may, for example, make it more difficult to enforce users’ rights.

Furthermore, users’ data is generally processed within social networks for market research and advertising purposes. For example, usage profiles may be created on the basis of users’ behavior and the resulting interests. The usage profiles may in turn be used to display advertisements within and outside the networks that are presumed to correspond to users’ interests. For these purposes, cookies are generally stored on users’ computers, in which the users’ behavior and interests are stored. Usage profiles may also store data independently of the devices used by users, in particular if users are members of the respective platforms and are logged in.

For a detailed description of the respective forms of processing and the options for objecting (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

We also point out that requests for information and the assertion of data subject rights can be most effectively made directly to the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. If you nevertheless require assistance, you can contact us.

The legal basis is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. If cookies are set in this context, the legal basis is also Section 25 TDDDG and Art. 6 para. 1 lit. a) GDPR. We have a legitimate interest in presenting our company online in social media, providing information about us and our work, and communicating with customers, partners and/or interested parties.

Further information can be found below:

Instagram

Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA; website: https://www.instagram.com; privacy policy: https://instagram.com/about/legal/privacy.

Twitter

Service provider: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; privacy policy: https://twitter.com/de/privacy, (settings) https://twitter.com/personalization.

LinkedIn

Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; website: https://www.linkedin.com/; privacy policy: https://www.linkedin.com/legal/privacy-policy; opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

You can withdraw your consent by deactivating the relevant selection on our Consent Management Platform, which you can access via this link.

Whenever you access pilot’s websites, the access data for the process is automatically stored in a log file. This concerns general information such as the page from which the file was requested, the name of the file accessed, the date and time of access, the amount of data transferred, the protocol used, the descriptions transmitted by the web browser and, where applicable, the operating system.

This general information is anonymized, meaning that it is not stored together with any personal data you may have provided to pilot and is not otherwise combined with such data. It is evaluated solely for statistical purposes and to improve the content and functionality of the website. This data is not disclosed to third parties for any other non-commercial or commercial purposes. The access data is stored in the log file for a maximum of four weeks.

This website also uses cookies. A cookie is a text file containing an identification number that is transmitted to the user’s computer and stored there when the user visits the website, together with the other data actually requested. The file is kept available for subsequent access and serves to authenticate the user.

Since cookies are simple files and not executable programs, they do not pose a threat to the computer. Cookies do not contain any directly personal data, thus ensuring the protection of your privacy. Depending on the settings you have selected in your web browser, it may accept cookies automatically. However, this setting can be changed and the storage of cookies can be deactivated or configured so that you are notified as soon as a cookie is set. If the use of cookies is deactivated, some website functions may not be available or may only be available to a limited extent.

We may work with advertising partners who help us make our online offering more interesting for you. For this purpose, cookies from partner companies (third-party cookies) may also be stored on your hard drive when you visit our website. If we work with the aforementioned advertising partners, you will be informed individually and separately about the use of such cookies and the scope of the information collected in the following sections.

If you have subscribed to the mailings of the pilot agency group, pilot processes the personal data you have provided to us in order to inform you about news from the agency group.

You consent to the regular dispatch of newsletters by email or mailings by post to the contact details provided (postal address, email address). Before sending the newsletter by email, we verify that you are the owner of the email address provided or that its owner has agreed to receive the newsletter. The data processing is carried out with your consent on the basis of Art. 6 para. 1 lit. a) GDPR.

pilot uses a data processor to manage the address data and send the newsletter. The service provider only has access to the personal information required to fulfil the order. Neither the service provider nor pilot itself uses the address data for any other purposes. pilot concludes a data processing agreement with the service provider that complies with the requirements of Art. 28 and 29 GDPR.

You may object to this processing at any time without having to comply with any formal requirements, either by post to pilot Hamburg GmbH & Co. KG, Neue Rabenstraße 12, D-20354 Hamburg, or by email to the electronic mailbox widerruf(at)pilot.de.

We use the Google Analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). This service analyzes and evaluates the use of our website and creates statistics and reports on this basis that help us optimize and improve our website for visitors. Google Analytics uses cookies for this purpose. For this processing purpose, the information generated by the cookie, such as your anonymized IP address, device and browser characteristics, session duration and pages visited, is transmitted to a Google server on our behalf, stored and evaluated there.

On this website, we use the IP anonymization function of Google Analytics. This ensures that IP addresses are collected anonymously. Your IP address is generally anonymized by Google by truncating it within the European Union or in other contracting states of the European Economic Area (EEA). In exceptional cases, your IP address is transmitted to a Google server in the USA and anonymized there. The IP address transmitted by you is not merged with other Google data.

Google Analytics advertising features include remarketing and reports on performance according to demographic characteristics and interests. These procedures are intended to use information about user behavior to target advertising measures more closely to the interests of the respective users. As part of remarketing, personalized advertising measures may be displayed on other websites based on the user’s browsing behavior on this website. The advertising material may contain products that the user previously viewed on the website. If you have given your consent via our consent banner and are logged into a Google service (e.g. your Google account) during your visit, the data collected as part of Google Analytics may be merged with other Google data. This data may be used for cross-device remarketing. The data processed by Google can be viewed, managed and deleted by you as the account holder in the “My Activity” section of your Google account.

Most browsers accept cookies automatically. However, you can prevent the use of cookies by changing your browser settings; in this case, not all website functions may be available. You must make the settings separately for each browser you use. You can also prevent the collection and processing of this data by Google LLC by downloading and installing the browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. Alternatively, or within browsers on mobile devices, please click on the following link: Disable Google Analytics. An opt-out cookie will then be stored on your device for our websites and will apply to the browser you are currently using. If you delete the cookies in this browser, you will have to click on this link again. Google offers logged-in Google users and other users the option of deactivating personalized advertising. Details can be found here: https://support.google.com/ads/answer/2662922?hl=de

The data processing, in particular the setting of cookies, is carried out with your consent on the basis of Art. 6 para. 1 lit. a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Google’s privacy policy can be found here: https://policies.google.com/privacy?hl=de.

On this website, we use LinkedIn social plugins provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). You can recognize these, for example, by the LinkedIn logo.

When you activate a social plugin integrated into our website, LinkedIn receives information that your browser has accessed the corresponding page of our website and that you have interacted with the social plugin. LinkedIn uses cookies for this purpose. Detailed information on the use of cookies can be found at https://www.linkedin.com/legal/cookie-policy.

If you are logged in to LinkedIn, LinkedIn can assign the visit to our website to your LinkedIn profile. If you do not want LinkedIn to directly associate the data collected via our website with your LinkedIn profile, you can log out of LinkedIn before visiting our website. You can object to the analysis of user behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

The data processing is carried out with your consent on the basis of Art. 6 para. 1 lit. a) GDPR. You may withdraw your consent at any time with effect for the future via our Consent Management Platform, which you can access here, without affecting the lawfulness of processing based on consent before its withdrawal. You can also withdraw your consent by adjusting your browser settings or via LinkedIn: https://www.linkedin.com/psettings/. You can also deactivate interest-based advertising via the deactivation page of the Network Advertising Initiative (http://optout.networkadvertising.org/), the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/). The archive request function allows you to request information about the data LinkedIn processes about you: https://www.linkedin.com/psettings/member-data.

It cannot be ruled out that LinkedIn may transfer data to the USA for storage and further processing. If such data is transferred to the USA, this is based on the EU Commission’s standard contractual clauses or the DPF: https://www.linkedin.com/legal/l/dpa.

Further information on how LinkedIn processes personal data, including the options for exercising your data subject rights, can be found in LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy.

Whenever one of our pages containing LinkedIn functions is accessed, a connection is established to LinkedIn servers. LinkedIn is informed that you have visited our websites with your IP address. If you are logged in to your LinkedIn account, LinkedIn can assign your visit to our website to you and your user account. As the provider, we do not receive any information about the content of the data transmitted or how it is used by LinkedIn. However, the LinkedIn Insight Tag enables us to obtain information about visitors to our websites. This allows us to analyze, among other things, the professional characteristics of LinkedIn members (such as career level, company size, country, location, industry and job title) and better target our pages to specific audiences. We can also measure whether visitors make purchases or take other actions (conversion measurement), which can also take place across devices. With the retargeting function, we can display targeted advertising to visitors to our websites outside the website; according to LinkedIn, this does not identify the advertising recipient. LinkedIn also records log files (URL, referrer URL, IP address, device and browser characteristics and time of access). IP addresses are truncated or hashed. Direct identifiers of LinkedIn members are deleted by LinkedIn after seven days, and the remaining pseudonymized data is deleted within 90 days. As the website operator, we cannot assign the data collected by LinkedIn to specific individuals. LinkedIn may store the personal data of website visitors on its servers in the USA and use it for its own advertising purposes.

Data processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR only with the relevant consent; consent may be withdrawn at any time. Consent can be withdrawn by deactivating the relevant selection on our Consent Management Platform, which you can access via this link.

You can object to the analysis of user behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Logged-in members can control the use of their data for advertising purposes in their LinkedIn account settings. To prevent data collected on our website from being linked to your LinkedIn account, log out of your LinkedIn account before visiting the websites.

Data is transferred to the USA on the basis of the EU Commission’s standard contractual clauses: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

Further information can be found in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy

On this website, we use the Usercentrics Consent Management Platform as a consent management tool in the context of analytics activities. This is a service provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.

The Usercentrics Consent Management Platform collects log file and consent data using JavaScript. This JavaScript enables us to inform users about their consent to certain tags on our website and to obtain, manage and document this consent.

We process the following data:

(1) Consent data (anonymized log data (consent ID, service ID, controller ID), consent status, timestamp)

(2) Device information (including shortened IP addresses, device information, timestamps)
(3) User data (including email address, ID, browser information, settings ID, change log)

The consent ID (which contains the data listed above) and the consent status with timestamp are stored in your browser’s local storage and simultaneously on the cloud servers used. Further processing only takes place if you submit a request for information or withdraw your consent. In this case, the relevant information is provided in a compact data format in an easily readable text form for the purpose of exchanging data (JSON file).

No user information is stored for statistical purposes relating to the use of consent that has or has not been granted. Only the frequency and locations of clicks are stored.

The purpose of data processing is to analyze, manage and provide evidence of consents given in order to comply with our obligation to implement GDPR-compliant consent management.

The specific purposes of processing personal data are:
(1) Obtaining and providing consents
(2) Providing evidence of which device you used and at what time you gave your consent
(3) Ensuring access to the settings and documenting changes

The legal basis for managing your consent to the processing of your personal data is Art. 6 para. 1 lit. c and f GDPR. Our legitimate interest lies in the legally compliant documentation and verifiability of consent, the control of marketing measures on the basis of the consent granted and the optimization of consent rates.

The data is generally deleted as soon as it is no longer required. The cookie used has a lifetime of 60 days. Data relating to withdrawn consent is stored for a period of three years. This retention period is based on our accountability obligation pursuant to Art. 5 para. 2 GDPR and on the limitation period pursuant to Section 195 BGB. This period begins at the end of the year in which consent was given or withdrawn and ends three years later.

The current Usercentrics privacy policy can be found at: https://usercentrics.com/de/datenschutzerklaerung/

The function can be activated and deactivated in our “Privacy settings” by checking or unchecking the relevant box.

We use HubSpot both on our website and throughout the group for CRM and marketing activities.

HubSpot is a software company from the USA with a branch office, HubSpot Ireland Limited, at 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland.

We use this integrated software solution for internal CRM purposes as well as for analytics purposes. In the latter case, HubSpot uses cookies, small text files that are stored locally in the cache of your web browser on your device and enable us to analyze your use of the website. HubSpot evaluates the information collected (e.g. IP address, geographic location, browser type, duration of visit and pages accessed) on our behalf in order to generate reports on visits and pages accessed.

Information collected using HubSpot and the contents of our website are stored on servers operated by HubSpot’s service providers. If you have given your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, processing on this website is carried out for the purpose of website analysis. Otherwise, HubSpot is used for CRM purposes on the basis of Art. 6 para. 1 lit. f GDPR.

Since HubSpot may transfer personal data to affiliated companies and subprocessors in countries outside the EU and the EEA, additional safeguards are required to ensure the level of data protection provided by the GDPR. For the USA, the EU Commission has issued an adequacy decision pursuant to Art. 45 para. 1 GDPR with regard to companies certified under the EU-U.S. Data Privacy Framework. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework and has therefore committed to complying with appropriate data protection standards, which can be viewed at the following link: www.dataprivacyframework.gov/s/participant-search. For potential transfers to other third countries outside the EU and the EEA for which there is no adequacy decision by the EU Commission, standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR are also agreed. These oblige the recipient in the third country to process the data in accordance with the level of protection applicable in Europe.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

You may permanently object to the collection of data by HubSpot and/or the setting of cookies by preventing the storage of cookies through your browser settings or by sending us an email at widerruf(at)pilot.de. You may object to the processing of your personal data at any time with effect for the future.