Privacy policy

This privacy policy provides information about the processing of personal data in connection with our activities and operations, including our website under the domain name actingresponsibly.com. In particular, we provide information about what personal data we process, and why, how and where we process it. We also provide information about the rights of individuals whose data we process.

We may publish additional privacy statements or other information about data protection for individual or additional activities and operations.

  1. Contact addresses

    The controller responsible under data protection law is:

    acting responsibly AG

    Acting Responsibly

    Blumenrain 50

    2500 Biel/Bienne, Switzerland

    info@actingresponsibly.com

    In individual cases, third parties may be responsible for the processing of personal data or there may be joint responsibility with third parties. We are happy to provide data subjects with information about the respective responsibility on request.

  2. Definitions and legal bases

    1. Definitions

      Data subject: natural person whose personal data we process.

      Personal data: any information relating to an identified or identifiable natural person.

      Sensitive personal data: data relating to trade union-related, political, religious or philosophical views and activities, data relating to health, the private sphere or affiliation to a race or ethnicity, genetic data, biometric data that uniquely identifies a natural person, data relating to criminal or administrative sanctions or proceedings, and data relating to social assistance measures.

      Processing: any handling of personal data, irrespective of the means and procedures used, such as the querying, comparison, adaptation, archiving, keeping, retrieval, disclosure, procurement, recording, collection, deletion, disclosure, structuring, organisation, storage, modification, dissemination, linking, destruction and use of personal data.

    2. Legal bases

      We process personal data in accordance with Swiss law, in particular the Swiss Federal Act on Data Protection (Data Protection Act, FADP) and the Ordinance on Data Protection (Data Protection Ordinance, DPO).

  3. Nature, scope and purpose of the processing of personal data

    We process the personal data that is necessary to enable us to carry out our activities and operations on a permanent, user-friendly, secure and reliable basis. The personal data processed may in particular fall into the categories of browser and device data, content data, communication data, metadata, usage data, master data including inventory and contact data, location data, transaction data, contract data and payment data. The personal data may also constitute particularly sensitive personal data.

    We also process personal data that we receive from third parties, obtain from publicly accessible sources or collect in the course of our activities and operations, insofar as such processing is permitted.

    Where necessary, we process personal data with the consent of the data subjects. In many cases, we may process personal data without consent, for example to comply with legal obligations or to safeguard overriding interests. We may also ask data subjects for their consent if their consent is not required.

    We process personal data for the period necessary for the respective purpose. We anonymise or delete personal data, in particular in accordance with statutory retention and limitation periods.

  4. Disclosure of personal data

    We may disclose personal data to third parties, have it processed by third parties or process it jointly with third parties. Such third parties are, in particular, specialist providers whose services we use.

    For example, we may disclose personal data to banks and other financial service providers, public authorities, educational and research institutions, consultants and lawyers, interest groups, IT service providers, collaboration partners, credit agencies, logistics and shipping companies, marketing and advertising agencies, the media, organisations and associations, social institutions, telecommunications companies, insurance companies and payment service providers.

  5. Communication

    We process personal data in order to be able to communicate with individuals, authorities, organisations and companies. In particular, we process data that a data subject sends to us when making contact, for example by post or email. We may store such data in an address book or using similar tools.

    Third parties who send us data about other individuals are obliged to independently protect the data of these data subjects. In particular, they must ensure that this data is accurate and can be sent.

  6. Data security

    We take appropriate technical and organisational measures to ensure data security appropriate to the respective risk. In particular, we take measures to guarantee the confidentiality, availability, traceability and integrity of the personal data we process, without being able to guarantee absolute data security.

    Our website and other digital presence are accessed by means of transport encryption (SSL/TLS, in particular with the Hypertext Transfer Protocol Secure, abbreviated to HTTPS). Most browsers warn against visiting a website without transport encryption.

    As with generally all digital communication, our digital communication is subject to mass surveillance without cause or suspicion by security authorities in Switzerland, the rest of Europe, the United States of America (USA) and other countries. We cannot directly influence the corresponding processing of personal data by secret services, police agencies and other security authorities, nor can we rule out the possibility that a specific data subject will be monitored.

  7. Personal data abroad

    We principally process personal data in Switzerland. However, we may also disclose or export personal data to other countries, in particular to process it there or to have it processed there.

    We may disclose personal data to any country in the world and elsewhere in the universe, provided that the laws in those countries guarantee an adequate level of data protection in accordance with the decision by the Swiss Federal Council.

    We may disclose personal data in countries whose laws do not guarantee adequate data protection if a suitable level of data protection is guaranteed for other reasons, in particular on the basis of standard data protection clauses or with other suitable guarantees. In exceptional cases, we may export personal data to countries without adequate or suitable data protection if the special data protection requirements are met, such as the express consent of the data subjects or a direct connection with the conclusion or performance of a contract. On request, we will be happy to provide data subjects with information about any guarantees or provide a copy of any guarantees.

  8. Rights of data subjects

    1. Entitlements under data protection law

      We grant data subjects all entitlements in accordance with the applicable law. Data subjects have the following rights in particular:

      • Information: data subjects may request information as to whether we process personal data concerning them and, if so, what personal data is involved. Data subjects will also receive the information they need to assert their rights under data protection law and to ensure transparency. This includes the personal data processed as such, but also includes information on the purpose of the processing, the duration of retention, any disclosure or export of data to other countries and the origin of the personal data.
      • Rectification and restriction: data subjects can have incorrect personal data rectified, incomplete data completed and the processing of their data restricted.
      • Option to express own point of view and to request review by a natural person: data subjects may express their own point of view and request review by a natural person in the case of decisions based exclusively on automated processing of personal data and that has a legal consequence for or a considerable adverse effect on them (automated individual decisions).
      • Erasure and objection: data subjects can have personal data erased (‘right to be forgotten’) and object to the processing of their data with effect for the future.
      • Data portability: data subjects may request the delivery of personal data or the transfer of their data to another controller.

      We may postpone, restrict or deny the exercise of the rights of data subjects to the extent permitted by law. We may inform data subjects of any requirements that must be met in order to exercise their rights under data protection law. For example, we may refuse to provide information in whole or in part on the grounds of confidentiality obligations, overriding interests or the protection of other persons. For example, we may also refuse to erase personal data in whole or in part, in particular with reference to statutory retention requirements.

      In exceptional cases, we may charge a fee for exercising the rights. We will inform data subjects in advance of any costs.

      We are obliged to take appropriate measures to identify data subjects who request information or assert other rights. Data subjects are obliged to cooperate.

    2. Legal protection

      Data subjects have the right to assert their entitlements under data protection law through legal recourse or to lodge a complaint or report with a data protection supervisory authority.

      The data protection supervisory authority for private controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

  9. Use of the website

    1. Cookies

      We may use cookies. Cookies – our own cookies (first-party cookies) and cookies from third parties whose services we use (third-party cookies) – are data that is stored in the browser. This stored data need not be limited to traditional cookies in text form. Cookies can be stored temporarily in the browser as session cookies or for a certain period of time as permanent cookies. Session cookies are deleted automatically when the browser is closed. Permanent cookies have a certain storage period. In particular, cookies enable us to recognise a browser the next time you visit our website and thus measure the reach of our website, for example. However, permanent cookies can also be used for online marketing, for example.

      Cookies can be fully or partially deactivated, restricted or deleted in your browser settings at any time. Browser settings often also enable automated deletion and other management of cookies. Without cookies, our website may not be fully accessible. We actively ask for explicit consent to the use of cookies at the very least to the extent required by applicable law.

      In the case of cookies that are used to measure success and reach or for advertising, a general opt-out is possible for many services via AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) and Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

    2. Logging

      We may log at least the following information each time our website and other digital presence is accessed, provided that this information is transmitted to our digital infrastructure in the event of such access: Date and time including time zone, IP address, access status (HTTP status code), operating system including user interface and version, browser including language and version, individual sub-page of our website accessed including amount of data transferred, last website accessed in the same browser window (referer or referrer).

      We log such information, which may also constitute personal data, in log files. This information is required to make our digital presence permanent, user-friendly and reliable. The information is also necessary in order to be able to guarantee data security – including by third parties or with the help of third parties.

    3. Tracking pixels

      We may integrate tracking pixels into our digital presence. Tracking pixels are also known as web beacons. Tracking pixels – including those from third parties whose services we use – are usually small, invisible images or scripts formulated in JavaScript that are automatically retrieved when accessing our digital presence. Tracking pixels can be used to record at least the same information as logging in log files.

  10. Third-party services

    We use the services of specialised third parties to enable us to carry out our activities and operations on a permanent, user-friendly, secure and reliable basis. Through these services, we can embed functions and content in our website, amongst other things. In the case of such embedding, the services used record the IP addresses of users for technical reasons at least temporarily.

    For necessary security-related, statistical and technical purposes, third parties whose services we use may process data in connection with our activities and operations in aggregated, anonymised or pseudonymised form. This includes, for example, performance or usage data in order to be able to offer the respective service.

    In particular, we use:

    Google services: Google LLC (USA)/Google Ireland Limited (Ireland), in part for users in the European Economic Area (EEA) and in Switzerland; general information on data protection: ‘Privacy Principles’, ‘Learn more about how Google processes personal information’, Privacy Policy, ‘We are committed to complying with applicable data protection laws’, ‘Google Product Privacy Guide’, ‘How Google uses information from sites or apps that use our services’, ‘Types of cookies and similar technologies used by Google’, ‘Advertising you can influence’ (‘Personalised advertising’).

    1. Digital infrastructure

      We use the services of specialised third parties in order to be able to use the digital infrastructure required in connection with our activities and operations. This includes, for example, hosting and storage services from selected providers. In particular, we use:

      Hostpoint: hosting; provider: Hostpoint AG (Switzerland); data protection information: Privacy policy.

    2. Audio and video conferencing

      We use specialised audio and video conferencing services to communicate online. We can use it to hold virtual meetings, for example, or conduct online classes and webinars. Participation in audio and video conferences is also subject to the legal texts of the individual services, such as privacy policies and terms of use.

      Depending on your circumstances, we recommend that you mute the microphone as standard when attending audio or video conferences and blur the background or display a virtual background.

      In particular, we use:

      Zoom: platform for collaborative work, particularly with video conferencing; provider: Zoom Communications Inc. (USA); data protection information: ‘Privacy at Zoom’, Privacy Statement, ‘Compliance’.

    3. Documents

      We use third-party services to integrate documents into our website. Such documents may include PDF files, presentations, spreadsheets and text documents. This enables us not only to view, but also to edit or comment on these documents.

      In particular, we use:

  11. Extensions for the website

    We use extensions for our website in order to be able to use additional functions. We may use selected services from suitable providers or use these extensions on our own digital infrastructure.

    In particular, we use:

    • Google reCAPTCHA: spam protection (distinction between desired content from people and unwanted content from bots and spam); provider: Google; Google reCAPTCHA-specific information: ’What is reCAPTCHA?’.

  12. Measuring success and reach

    We try to measure the success and reach of our activities and operations. In this context, we may also measure the impact of third-party information or check how different parts or versions of our digital presence are being used (A/B testing method). Based on the results of the measurement of success and reach, we can, in particular, correct errors, strengthen popular content or make improvements.

    In most cases, the IP addresses of individual users are recorded to measure success and reach. In this case, IP addresses are generally shortened (‘IP masking’) in order to follow the principle of data economy through corresponding pseudonymisation.

    Cookies can be used and user profiles can be created to measure success and reach. Any user profiles created include, for example, the individual pages visited or content viewed on our digital presence, information on the size of the screen or browser window and the – at least approximate – location. As a rule, any user profiles are created exclusively in pseudonymised form and are not used to identify individual users. Individual third-party services with which users are registered may associate the use of our website with the user account or user profile of the respective service.

    In particular, we use:

  13. Final notes on the privacy policy

    We have created this privacy policy using the data protection generator from Datenschutzpartner.

    We may update this privacy policy at any time. We provide information about updates in an appropriate form, in particular by publishing the current privacy policy on our website.