Privacy Policy
1. What is this Privacy Policy about?
PLIMPortal AG (hereinafter also "we", "us") obtains and processes personal data concerning you or other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data".
In this Privacy Policy, we describe what we do with your data when you use plimportal.com, other websites of ours or our apps (hereinafter collectively the "Website"), obtain our services or products, are otherwise in contact with us in connection with a contract, communicate with us or otherwise deal with us. Where applicable, we will inform you by timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, e.g. in consent declarations, contractual terms, additional privacy notices, forms and notices.
This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the Swiss Federal Act on Data Protection ("FADP"). Whether and to what extent these laws apply, however, depends on the individual case.
2. Who is responsible for processing your data?
The party responsible under data protection law for the data processing of PLIMPortal AG described in this Privacy Policy is PLIMPortal AG, Bahnhofstrasse 16, 9200 Gossau ("PLIM"), unless otherwise communicated in the individual case. You can reach us for your data protection concerns and the exercise of your rights under section 10 as follows:
PLIMPortal AG, Bahnhofstrasse 16, 9200 Gossau, [email protected]
3. What data do we process?
We process various categories of data about you. The most important categories are the following:
• Technical data: When you use our Website or other electronic offerings, we collect the IP address of your device and other technical data in order to ensure the functionality and security of these offerings. This data also includes logs recording the use of our systems. We generally retain technical data for 6 months. In order to ensure the functionality of these offerings, we may also assign you or your device an individual code (e.g. in the form of a cookie, see section 11). Technical data on its own generally does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the performance of contracts, it may be linked with other data categories (and thus potentially with you personally).
• Registration data: Certain offerings and services can only be used with a user account or a registration, which can take place directly with us or via our external login service providers. In this context, you must provide us with certain data, and we collect data about the use of the offering or service. We generally retain registration data for 12 months after the end of the use of the service or the closure of the user account.
• Communication data: When you are in contact with us via the contact form, by email, telephone, letter or other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. Where we wish or are required to establish your identity, we collect data to identify you (e.g. a copy of an identity document). We generally retain this data for 12 months from the last exchange with you. This period may be longer where necessary for evidentiary reasons or to comply with statutory or contractual requirements or for technical reasons. Emails in personal mailboxes and written correspondence are generally retained for at least 10 years.
• Master data: Master data means the basic data that we require, in addition to the contract data (see below), for the performance of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your bank details, your date of birth or your customer history. We process your master data if you are a customer or other business contact or act for such a person (e.g. as a contact person of the business partner), or because we wish to approach you for our own purposes or the purposes of a contractual partner (e.g. in the context of marketing and advertising). We obtain master data from you yourself (e.g. on a purchase or as part of a registration), from bodies for which you act, or from third parties such as our contractual partners, associations and address dealers, and from publicly accessible sources such as public registers or the internet (websites, etc.). We generally retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer where necessary for evidentiary reasons or to comply with statutory or contractual requirements or for technical reasons. For purely marketing and advertising contacts, the period is normally considerably shorter, usually no more than 2 years since the last contact.
• Contract data: This is data arising in connection with the conclusion or performance of a contract, e.g. information about contracts and the services to be rendered or rendered, as well as data from the run-up to a contract, the information required or used for performance and information about reactions. We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources. We generally retain this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer where necessary for evidentiary reasons or to comply with statutory or contractual requirements or for technical reasons.
Much of the data mentioned in this section 3 you disclose to us yourself (e.g. via forms, in the course of communicating with us, in connection with contracts, when using the Website, etc.). You are not obliged to do so, subject to individual cases. If you wish to enter into contracts with us or claim services, you must also provide us with data as part of your contractual obligation under the relevant contract, in particular master, contract and registration data. When using our Website, the processing of technical data is unavoidable.
To the extent that this is not impermissible, we also take data from publicly accessible sources or receive data from authorities and other third parties.
4. For what purposes do we process your data?
We process your data for the purposes explained below. Further information for the online area can be found in section 11. These purposes, and the objectives underlying them, constitute legitimate interests of ours and, where applicable, of third parties. You will find further information on the legal bases of our processing in section 5.
We process your data for purposes in connection with communicating with you, in particular to answer enquiries and to enable you to exercise your rights (section 10) and to contact you in the event of queries. For this purpose, we use in particular communication data and master data, and, in connection with offerings and services used by you, also registration data. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for follow-up queries.
We further process data, among other things, for the establishment, management and performance of contractual relationships, for marketing purposes and relationship management, for market research, to improve our services and operations, and for product development.
5. On what basis do we process your data?
Where we ask you for your consent for certain processing, we inform you separately about the corresponding purposes of the processing. You can withdraw your consent at any time, with effect for the future, by written notice (by post) or, where not otherwise specified or agreed, by email to us; you will find our contact details in section 2. For the withdrawal of your consent in the case of online tracking, see section 11. Where you have a user account, a withdrawal or contacting us may, where applicable, also be carried out via the relevant website or other service. Once we have received notice of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.
Where we do not ask for your consent for a processing operation, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or the body you represent), or that we or third parties have a legitimate interest in it, in particular in order to pursue the purposes and related objectives described above under section 4 and to be able to carry out corresponding measures. Our legitimate interests also include compliance with legal requirements, to the extent that this is not already recognised as a legal basis by the applicable data protection law in any event.
Where we receive sensitive data (e.g. health data, information on political, religious or ideological views or biometric data for identification), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes, on the basis of the necessity of the processing for any legal proceedings or the enforcement or defence of legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately where necessary.
Automated individual decisions: In the context of the credit and identity check and the approval or rejection of credit applications, decisions may be made in an automated manner, i.e. without significant human involvement. Such decisions may have legal consequences for you or significantly affect you (e.g. the rejection of a credit application). In these cases, you have the right to state your point of view and to request that the decision be reviewed by a natural person; the details in section 10 apply to the exercise of this right.
6. To whom do we disclose your data?
In connection with our contracts, the Website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests and the further purposes listed in section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:
• Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or in joint responsibility with us, or receive data about you from us on their own responsibility.
• Authorities: We may pass on personal data to offices, courts and other authorities in Switzerland and abroad where we are legally obliged or entitled to do so, or where this appears necessary to safeguard our interests.
• Other persons: This means other cases where the involvement of third parties arises from the purposes under section 4.
• Debt collection agencies: In the event of the customer's default or late payment, PLIM reserves the right, at its option, to make a report to a debt collection agency.
All of these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the processing by certain third parties (e.g. IT providers), but not that of other third parties (e.g. authorities, banks, etc.).
Note on the credit and identity check by credit reference agencies
In order to process your application, we carry out a credit and identity check of you at one or more credit reference agencies (hereinafter "credit reference agencies"). For as long as you maintain a contractual relationship with us, we may make regular enquiries at credit reference agencies in order to manage your account and your credits.
For this purpose, we pass on your personal data to credit reference agencies, and they provide us with information about you. This includes information from your credit application as well as information on your financial situation and financial history. Credit reference agencies provide us with both public information (including public registers) and shared credit, financial-situation and financial-history information, as well as information on fraud prevention.
We will use this information to:
• assess your creditworthiness and check whether you can afford the product;
• verify the accuracy of the data you have provided;
• prevent criminal activity, fraud and money laundering;
• manage your account(s);
• trace and recover debts; and
• ensure that the products offered to you are appropriate to your circumstances.
We will continue to exchange information about you with credit reference agencies for as long as you have a relationship with us. We will also inform the credit reference agencies about your settled accounts. If you take out credit and do not repay it in full and on time, credit reference agencies record the outstanding debts. This information may be passed on by credit reference agencies to other organisations.
When credit reference agencies receive a search from us, they leave a search footprint in your credit file, which can be seen by other lenders.
PLIM works with CRIF to provide credit services. The identity of the credit reference agencies, their role also as fraud-prevention bodies, the data they store, the way in which they use and pass on personal data, data retention periods and your data protection rights vis-a-vis the credit reference agencies are explained in more detail by the relevant credit reference agency (for CRIF AG: www.crif.ch).
We will not sell, trade or disclose your personal data to third parties who wish to market products to you.
7. Does your personal data also go abroad?
As explained in section 6, we also disclose data to other bodies. These are not located only in Switzerland. Your data may therefore also be processed in Europe; in exceptional cases, however, in any country in the world.
If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose we use the revised Standard Contractual Clauses of the European Commission, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless the recipient is already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exception. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or where a contract's performance requires such disclosure, where you have consented, or where the data concerned has been made generally accessible by you and you have not objected to its processing.
Please also note that data exchanged via the internet is frequently routed via third countries. Your data may therefore also go abroad even where the sender and recipient are located in the same country.
8. For how long do we process your data?
We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidentiary purposes require, or storage is technically necessary. Further information on the respective storage and processing period can be found with the individual data categories in section 3 and with the cookie categories in section 11. Unless legal or contractual obligations prevent this, we delete or anonymise your data after the expiry of the storage or processing period as part of our usual procedures.
9. How do we protect your data?
We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counter the risks of loss, unintended alteration, unwanted disclosure or unauthorised access.
10. What rights do you have?
To make it easier for you to control the processing of your personal data, you also have, in connection with our data processing and depending on the applicable data protection law, the following rights:
• the right to request information from us as to whether and which data we process about you;
• the right to have us correct data if it is inaccurate;
• the right to request the deletion of data;
• the right to request that we provide certain personal data in a common electronic format or transfer it to another controller;
• the right to withdraw a consent, to the extent that our processing is based on your consent;
• the right, on request, to receive further information necessary for the exercise of these rights;
• the right, in the case of automated individual decisions (section 5), to state your point of view and to request that the decision be reviewed by a natural person.
If you wish to exercise the above rights vis-a-vis us, please contact us in writing, in person on site, or, where not otherwise specified or agreed, by email; you will find our contact details in section 2. So that we can rule out any abuse, we must identify you (e.g. with a copy of an identity document, where this is not otherwise possible).
Please note that conditions, exceptions or restrictions apply to these rights under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly where applicable.
If you are not satisfied with our handling of your rights or of data protection, please let us know (section 2). You also have the right to lodge a complaint with the Swiss data protection supervisory authority. You can reach the Federal Data Protection and Information Commissioner (FDPIC) here: Contact | FDPIC.
11. Do we use online tracking and online advertising techniques?
On our Website we use various techniques by means of which we and third parties engaged by us can recognise you during your use and, in certain circumstances, also track you across several visits. In this section we inform you about this.
The core issue is that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the Website and carry out evaluations and personalisations. We do not thereby intend to draw conclusions about your identity, even though we can do so to the extent that we or third parties engaged by us can identify you by combination with registration data. However, even without registration data, the techniques used are designed in such a way that you are recognised as an individual visitor on each page view, for example by our server (or the servers of the third parties) assigning you or your browser a specific identification number (a so-called "cookie").
We use such techniques on our Website and allow certain third parties to do so as well. You can program your browser to block, deceive or delete certain cookies or alternative techniques or existing cookies. You can also extend your browser with software that blocks tracking by certain third parties. Further information can be found on the help pages of your browser (usually under the keyword "data protection") or on the websites of the third parties that we list below.
The following cookies are distinguished (techniques with functionalities comparable to fingerprinting are also included here):
• Necessary cookies: Some cookies are necessary for the functioning of the Website as such or for certain functions. They ensure, for example, that you can switch between pages without losing information entered in a form. They also ensure that you stay logged in. These cookies exist only temporarily ("session cookies"). If you block them, the Website may not function. Other cookies are necessary so that the server can store decisions or entries you have made beyond a session (i.e. a visit to the Website), where you use this function (e.g. selected language, consent given, the automatic login function, etc.). These cookies have an expiry date of up to 24 months.
• Performance cookies: In order to optimise our Website and corresponding offerings and to tailor them better to users' needs, we use cookies to record and analyse the use of our Website, in certain circumstances also beyond the session. We do this by using analytics services of third-party providers. We have listed these below. Performance cookies likewise have an expiry date of up to 24 months. Details can be found on the third-party providers' websites.
• Marketing cookies: We and our advertising partners have an interest in targeting advertising precisely, i.e. displaying it as far as possible only to those we wish to reach. We have listed our advertising partners below. For this purpose, we and our advertising partners - if you consent - also use cookies by means of which the content accessed or the contracts concluded can be recorded. This enables us and our advertising partners to display advertising that we can assume is of interest to you, on our Website but also on other websites that display advertising from us or our advertising partners. These cookies have an expiry period of a few days up to 12 months, depending on the situation. If you consent to the use of these cookies, corresponding advertising will be displayed to you. If you do not consent to these cookies, you will not see less advertising, but simply some other advertising.
In addition to marketing cookies, we use further techniques to control online advertising on other websites and thereby reduce wastage. For example, we may transfer the email addresses of our users, customers and other persons to whom we wish to display advertising to operators of advertising platforms (e.g. social media). If these persons are registered there with the same email address (which the advertising platforms determine by a comparison), the operators display the advertising placed by us to those persons in a targeted manner. In doing so, the operators do not receive personal email addresses of persons not already known to them. In the case of known email addresses, however, they learn that these persons are connected with us and which content they have accessed.
We may also embed further third-party offerings on our Website, in particular from social media providers. These offerings are deactivated by default. As soon as you activate them (e.g. by clicking a switch), the relevant providers can determine that you are on our Website. If you have an account with the social media provider, it can associate this information with you and thus track your use of online offerings. These social media providers process this data on their own responsibility.
We currently use offerings of the following service providers and advertising partners (to the extent that they use data about you or cookies set at your end to control advertising):
• Google Analytics: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our processor. For this, Google Ireland relies on Google LLC (based in the USA) as its processor (both "Google"). By means of performance cookies (see above), Google tracks the behaviour of visitors on our Website (duration, frequency of pages accessed, geographical origin of the access, etc.) and, on this basis, produces reports for us on the use of our Website. We have configured the service so that visitors' IP addresses are shortened by Google in Europe before being forwarded to the USA and can therefore not be traced back. We have switched off the "data sharing" and "signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can, from this data, draw conclusions about the identity of visitors for its own purposes, create personal profiles and link this data with the Google accounts of those persons. If you consent to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (in particular usage data relating to the Website and App, device information and individual IDs) to the USA and to other states.
• X: Plug-ins of the short-message network X Corp. (formerly Twitter), 795 Folsom St., Suite 600, San Francisco, CA 94107, USA, are integrated on our web pages. You can recognise the X plug-ins (Tweet button) by the X logo on our page. When you access a page of our web presence that contains such a plug-in, a direct connection is established between your browser and the X server. X thereby receives the information that you have visited our page with your IP address. If you click the "Tweet button" while you are logged in to your X account, you can link the content of our pages on your X profile. This enables X to associate the visit to our pages with your user account. We point out that, as the provider of the pages, we obtain no knowledge of the content of the transmitted data or its use by X. Further information on this can be found in X's privacy policy. If you do not wish X to be able to associate the visit to our pages, please log out of your X user account.
• Instagram: So-called social plug-ins of Instagram, operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram"), are used on our web pages. When you access a page of our web presence that contains such a plug-in, your browser establishes a direct connection to Instagram's servers. The content of the plug-in is transmitted by Instagram directly to your browser and integrated into the page. Through this integration, Instagram receives the information that your browser has accessed the relevant page of our web presence, even if you do not have an Instagram profile or are not currently logged in to Instagram. This information (including your IP address) is transmitted by your browser directly to a server of Instagram in the USA and stored there. If you are logged in to Instagram, Instagram can associate the visit to our Website directly with your Instagram account. If you interact with the plug-ins, for example by pressing the "Instagram" button, this information is likewise transmitted directly to a server of Instagram and stored there. If you do not want Instagram to associate the data collected via our web presence directly with your Instagram account, you must log out of Instagram before visiting our Website.
• Facebook: On the basis of our legitimate interest in the analysis, optimisation and operation of our online offering, this Website uses the Facebook social plug-in, operated by Facebook Inc. (now Meta Platforms Ireland Ltd.) (1 Hacker Way, Menlo Park, California 94025, USA). To the extent that personal data is thereby transmitted to the USA, we rely on the safeguards mentioned in section 7 (in particular the Standard Contractual Clauses of the European Commission). Whether and for how long an adequacy decision of the European Commission for the USA exists may change. The plug-in establishes a direct connection between your browser and the Facebook servers. The Website operator has no influence on the nature and scope of the data that the plug-in transmits to the servers of Facebook Inc. The plug-in informs Facebook Inc. that you, as a user, have visited this Website. It is possible in this connection that your IP address is stored. If you are logged in to your Facebook account during the visit to this Website, the information mentioned is linked with it. If you use the functions of the plug-in - for example by sharing or "liking" a post - the corresponding information is likewise transmitted to Facebook Inc. If you wish to prevent Facebook Inc. from linking this data with your Facebook account, please log out of Facebook before visiting this Website and delete the stored cookies.
12. Can this Privacy Policy be amended?
This Privacy Policy is not part of a contract with you. We may amend this Privacy Policy at any time. The version published on this Website is the current version in each case.
