Privacy Policy
Mybenp by BENP GmbH
BENP GmbH, Mülistrasse 5, 9243 Jonschwil, Switzerland (hereinafter, the “Provider”), is the author of this Privacy Policy. This Privacy Policy applies to all users of the Provider’s services, insofar as personal data is processed as a result. In particular, this includes Customers who have concluded a contract with the Provider for the Provider’s services, their employees and website visitors. Furthermore, the Provider may declare that the Privacy Policy applies to other contractual partners on a contractual basis. For the sake of simplicity, all persons whose personal data is processed are hereinafter referred to as “Customers.”
The Provider is responsible for the careful and conscientious handling of the personal information of its Customers. The Provider is responsible for the collection, processing, disclosure, storage and protection of the personal information of its Customers and ensures compliance with the Swiss Federal Act on Data Protection (“FADP”) insofar as protected data of Swiss Customers is concerned; and ensures compliance with the EU General Data Protection Regulation (“GDPR”) insofar as the protected data of Customers from the EU area is concerned.
Customers may revoke the consent they have given under this Privacy Policy at any time with effect for the future (see Section 10, last paragraph).
1. Contact details
The data controller for data processing is:
BENP GmbH
Mülistrasse 5
9243 Jonschwil
Switzerland
The Data Protection Officer can be reached at info@mybenp.com.
2. Applicable Law
Data processing carried out by the Provider is subject to the following law in each case:
Data of Swiss Customers
Only Swiss law is applicable to the processing of data of Swiss customers, in particular the Swiss Federal Act on Data Protection (FADP, SR 235.1) and the associated Ordinance to the Swiss Federal Act on Data Protection (SR 235.11). The EU General Data Protection Regulation (GDPR) shall not apply. The applicability of the GDPR is reserved (i) insofar as it is expressly provided for in this Privacy Policy for partial areas, and (ii) insofar as the GDPR is also mandatorily applicable to data of Swiss customers due to special circumstances.
Data of Customers from the EU area
In addition to Swiss law, Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, GDPR) is applicable to the processing of data of Customers from the EU area. See also Section 13 (additional regulations for Customers from the EU area).
3. Type and scope of the collection of personal data
When visiting our website (without login)
When Customers visit the Provider’s online presence outside the protected login area, the web server technology automatically logs general technical visit information. This includes, among other things, the IP address of the device being used, which is, however, anonymized by Google before being stored so that it can no longer be assigned to the Customer. Google uses the _anonymizeIp() method for this purpose. This also includes information on the browser type, the Internet service provider and the operating system being used.
When using the myBENP cloud software (with login)
During the free trial access as well as during the paid use of the myBENP software within the protected login area, all data entered or submitted by the Customer during the registration process and during the use of the software will also be stored. This is particularly the case when the Customer registers, places orders, fills out online forms, participates in surveys or contests, corresponds with the Provider online or offline, or interacts with the Provider via social media, blogs or other interactive media.
As a rule, the personal master data (name, address, email address) and the settings required for the respective service are collected here.
With the collection of data, the Customer consents to the processing, use and disclosure of personal data within the context and as part of the purposes described in this Privacy Policy.
Data exchange with third parties / service partners
Customers have the option to share their data with third parties, e.g., its personal service partner, directly. By granting access rights, the Customer agrees that the Provider may provide third parties (e.g., the service partner) with all the Customer’s data or allow access to it. The Customer retains full control over the third party’s access rights to the data at all times and can restrict or deny access at any time.
4. Data security
The Provider uses technical and organizational security measures in accordance with recognized market standards to protect stored personal data from accidental, unlawful or unauthorized tampering, deletion, alteration, access, disclosure or use, and against partial or complete loss. The Provider regularly backs up the customer data. In order to prevent data loss even in extreme cases (e.g., the destruction of the data center by an earthquake), the encrypted backups are also stored in several data centers in Switzerland and abroad. The requirements according to the FADP and the GDPR are fully complied with at all times. The security measures are continuously adapted and improved according to technological developments. The Provider assumes no liability for the loss of data or access to and use of the data by third parties. Furthermore, the Provider cannot guarantee the security of data transmission on the Internet. In particular, there is a risk of access by third parties when data is transmitted by email. However, access is protected by means of HTTPS. If explicitly requested by the Customer, the Customer can decide to use dual authentication at any time.
5. Purpose of the processing of personal data / Data recipients
The Provider processes the collected data in order to be able to continuously improve its products and services, to manage the use of and access to the applications, products and information, to maintain its business relationship with the Customers, to monitor and improve the performance of its offer, to detect, prevent or clarify illegal activities and to send the Customers offers, information and marketing materials about products or services which the Provider, based on the data, assumes could be of interest to the Customers. The data may also be disclosed to partner companies and service providers, selected third-party companies, institutes and/or legally authorized government authorities, both domestic and foreign, for processing, storage and use as part of the above-mentioned purposes. If personal information is processed or stored in countries that do not ensure adequate data protection compared to Swiss data protection law, the Provider shall require the processor under contractual obligation to fully comply with the relevant provisions of the FADP or – where the data of Customers from the EU area is concerned – with the GDPR.
The Provider has some of the aforementioned processes and services carried out by service providers who are based within the EU or Switzerland and who have been commissioned in accordance with data protection regulations. These are, in particular, companies in the categories of IT services, payment transactions, printing service providers, billing, collection and consulting, as well as sales and marketing and service providers used as part of order processing contracts.
6. Cookies
Cookies help to make the visit to the Provider’s website easier, more pleasant and more useful. Cookies are information files that the web browser automatically stores on the computer’s hard disk when the Customer visits the Provider’s website and uses the offers.
Customers can choose to manage the security settings in their browser and thus block or disable cookies that have been installed, in which case, certain services of the Provider may no longer be able to be (fully) used.
Tracking and analysis tools / Social media
The use of the Provider’s digital offerings is measured and evaluated by means of various technical systems, mainly from third-party providers such as Google Analytics. These measurements can be both anonymous and personal. The collected data may in turn be transferred by the Provider or the third-party providers of these technical systems to third parties in Germany and abroad for processing. The most frequently used and best-known analytics tool is Google Analytics, a service provided by Google Inc. This means that the data collected may be transmitted to a Google server in the United States (or to a location specified by Google).
The Provider’s website uses Google Analytics, a web analytics service provided by Google Inc. with registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. (“Google”). Google Analytics uses cookies. Cookies are text files which are stored on the Customer’s computer and which are used to analyze the Customer’s use of the website. The information generated by the cookies about the use of the website (including the IP address, which is, however, anonymized by Google before being stored so that it can no longer be assigned to the Customer) is transmitted to a Google server in the United States (or to a location determined by Google) and stored there. Google will use this information for the purpose of evaluating the use of the website, compiling reports on website activity for the Provider and providing other services relating to website activity and Internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate the IP address of Customers with any other data held by Google.
The Provider’s website uses the “demographic characteristics” function of Google Analytics. This allows reports to be created that contain information about the age, gender and interests of Customers. This data comes from interest-based advertising from Google as well as visitor data from third-party providers. This data cannot be assigned to a specific person. Customers can disable this function at any time via the ad settings in their Google account or generally prohibit Google Analytics from collecting their data. Further information can be found in Google’s privacy policy at: https://support.google.com/analytics/answer/6004245?hl=en
If Customers do not want their website activity to be made available to Google Analytics, they can install the browser add-on to disable Google Analytics: https://support.google.com/analytics/answer/181881?hl=en
This prevents activity data from being shared with Google Analytics via JavaScript executed on websites (ga.js, analytics.js and dc.js).
The analysis of data by other tools of the website owner is not prevented when Customers use the add-on. Data may still be sent to the website or to other web analytics services.
Finally, the Provider collects certain information about its website in so-called server log files, which are automatically transmitted by the Customer’s Internet browser. This includes the user agent (browser type and version, operating system used), http header information (referrer URL, IP address of the accessing computer), the time of the server request and the login status. These server log files are only merged with other data sources for error analysis.
Technologies for advertising purposes
The Provider’s website uses the functions of Google Analytics Remarketing in conjunction with the cross-device functions of Google AdWords and Google DoubleClick. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
This function makes it possible to link the advertising target groups created with Google Analytics Remarketing with the cross-device functions of Google AdWords and Google DoubleClick. This enables interest-based, personalized advertising messages that have been adapted to the Customer based on the Customer’s previous usage and browsing behavior on one end device (e.g., cell phone) to be displayed on another end device (e.g., tablet or PC).
If the Customer has given Google the corresponding consent, Google links the Customer’s web and app browsing history with the Customer’s Google account for this purpose. This enables the same personalized advertising messages to be displayed on every end device on which the Customer logs in with their Google account.
To support this feature, Google Analytics collects the Google-authenticated IDs of users, which are temporarily linked to the Provider’s Google Analytics data to define and create target groups for cross-device advertising.
Customers can permanently object to cross-device remarketing by disabling personalized advertising in their Google account: https://www.google.com/settings/ads/onweb/
Further information can be found in Google’s privacy policy at: https://www.google.com/policies/technologies/ads/
The Provider’s website also uses the online advertising program Google AdWords. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
In the context of Google AdWords, the Provider uses conversion tracking. When the Customer clicks on an ad placed by Google, a cookie is set for conversion tracking. Cookies are small text files that the Internet browser stores on the Customer’s computer. These cookies expire after 30 days at the latest and are not used for identification. If the Customer visits our website and the cookie has not yet expired, Google and the Provider can recognize that the Customer clicked on the ad and was redirected to this page.
Google informs the provider of the total number of users who clicked on its ad and were redirected to its website, which contains a conversion tracking tag. However, the Provider does not receive any information with which it can personally identify the Customer.
Customers can prevent the storage of cookies by adjusting their browser software settings accordingly. However, the Provider would like to point out the fact that if the storage of cookies is disabled, certain features of this website may not be fully available. Customers can also prevent tracking by disabling the Google conversion tracking cookie via their Internet browser under User Settings.
For further information, please refer to Google’s privacy policy: https://www.google.de/policies/privacy/
The Provider’s website additionally uses the visitor action pixel from Facebook. The provider is Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA.
The Facebook pixel can be used to track the behavior of website visitors after they have been redirected to the Provider’s website by clicking on a Facebook ad. This allows the effectiveness of the Facebook ads to be evaluated for statistical and market research purposes and allows future advertising measures to be optimized.
The collected data is anonymous for the Provider. The Provider cannot draw any conclusions about the identity of the Customers. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and so that Facebook can use the data for its own advertising purposes, in accordance with the Facebook Data Usage Policy. This allows Facebook to place advertisements on Facebook pages as well as outside of Facebook. The Provider cannot influence this use of the data.
Customers can permanently object to remarketing by disabling the “Custom Audiences” remarketing function in the Ad Settings area under the following link. To do this, Customers must be logged in to Facebook: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen
Customers who do not have a Facebook account may opt out of Facebook usage-based advertising on the European Interactive Digital Advertising Alliance website at the following link: https://www.youronlinechoices.com/uk/your-ad-choices
For further information, please refer to Facebook’s privacy policy: https://www.facebook.com/about/privacy/
Integration of third-party offers / Social media
The Provider’s digital offerings are networked with third-party functions and systems in a variety of ways, for example by integrating plug-ins from third-party social networks such as Facebook, Twitter, etc. If the Customer has a user account with these third parties, they may also be able to measure and evaluate the use of the Provider’s digital offerings. In the process, additional personal data, such as IP address, browser settings and other parameters may be transmitted to these third parties and stored there. The Provider has no control over the use of such personal data collected by third parties and assumes no responsibility or liability. Moreover, the Provider has no detailed knowledge of what data is transmitted to the third parties, where it is transmitted to, and whether it is anonymized.
Plugins from YouTube are integrated on the Provider’s website. The provider is YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA.
The YouTube plugin establishes a connection to the YouTube servers. In doing so, the YouTube server is informed about which of the Provider’s pages the Customer has visited.
If Customers are logged into their YouTube account, YouTube can assign their browsing behavior directly to their personal profile. Customers can prevent this by logging out of their YouTube user account.
For more information, please refer to YouTube’s privacy policy: https://www.google.com/intl/en/policies/privacy
Other tools
The Provider’s website uses the map service Google Maps via an API. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. If the Customer uses the functions of Google Maps, the Customer’s IP address is stored by Google and usually transmitted to a Google server in the USA. The Provider has no influence on this data transfer.
For further information, please refer to Google’s privacy policy: https://www.google.com/intl/en/policies/privacy/
7. Profiling / Automated decision-making
Profiling is the automated processing of personal data in order to analyze or predict certain personal aspects or behavior. This makes it possible, for example, to provide Customers with more individualized support and advice or to better tailor offers to individual customer needs.
An “automated individual decision” is a decision that is fully automated, i.e., without relevant human influence, and that has negative legal effects on the Customer or other similarly negative effects. As a rule, the Provider does not make automated individual decisions. The Provider will inform the Customer separately if it uses automated individual decisions in individual cases. In such a case, the Customer has the option of having this decision reviewed manually by an employee of the Provider.
8. Communication by email and/or newsletter
If the Customer wishes to receive a newsletter offered on the Provider’s website, the Provider requires an email address and other information that allows verification that the email address provided is correct and that the Customer agrees to receive the newsletter (the “double-opt-in” procedure).
The newsletter provides regular recommendations and offers that may be of interest to the Customer. For this purpose, the Provider collects and processes personal data regarding the Customer’s usage behavior on the website, in the myBENP software and in relation to the use of the newsletter (e.g., whether the Customer opens the newsletter or on which web URL links the Customer clicks). The Provider evaluates this data for statistical purposes in order to better tailor the content of the newsletter to the interests of its Customers.
The processing of the personal data entered in the newsletter registration form is based on the Customer’s consent, which the Customer can revoke at any time with effect for the future. The Customer may withdraw this consent at any time via the “unsubscribe” link in the newsletter. The personal data collected is used for the design of the content and for sending of newsletter.
The Provider stores the personal data provided by the Customer for the purpose of receiving the newsletter until the Customer unsubscribes from the newsletter.
9. Duration of storage
The Provider processes and stores personal data as long as the Customer uses the Service. It should be noted that the contractual relationship between the Provider and the Customer is a continuing obligation, which is designed to last for years.
After termination of the contractual relationship, the Provider is generally not obliged to store the Customer’s data. For this reason, data that is no longer required is regularly deleted. This does not apply to data which is required for further processing due to legal regulations or for mandatory internal purposes.
10. Information, rectification, erasure, blocking, consent
With regard to their personal data, Customers have the following rights according to the FADP or the GDPR. In principle, the Provider grants the rights contained in the GDPR to Swiss customers as well. However, the Provider reserves the right to make a different assessment in individual cases.
• The right to information (Art. 8 FADP, Art. 15 GDPR);
• The right to rectification (Art. 5 para. 2 FADP, Art. 16 GDPR);
• The right to erasure (Art. 17 GDPR);
• The right to restriction of processing (Art. 18 GDPR);
• The right to data portability (Art. 20 GDPR); and
• The right to object (Art. 21 GDPR).
In the case of the rights mentioned above, any restrictions of the GDPR as well as the respective applicable Swiss data protection laws or other national laws shall apply.
Insofar as the Customer is asked to give consent in connection with the Provider’s services, the Customer gives this consent by clicking on the corresponding checkbox. The Provider is then entitled to collect, process, use and disclose the Customer’s personal data accordingly.
The Customer can, of course, withdraw this consent at any time without affecting the legality of the processing carried out on the basis of the consent until the withdrawal. The withdrawal can be sent in writing to the Provider’s address mentioned at the beginning of this Privacy Policy. However, it is also sufficient to send an email to: info@mybenp.com. However, some of the services and features will no longer be available to the Customer thereafter.
11. Links to other websites
The Provider’s website contains hyperlinks to third-party websites that are not operated or controlled by the Provider. The Provider is not responsible for the content or data protection practices of these third-party websites.
12. Additional regulations for Customers from the EU-area
The following regulations are only applicable to Customers from the EU area, they do not apply to Swiss Customers.
Legal basis of processing
The processing of data for the purposes stated in Section 5 is carried out in accordance with Article 6 (1) (b) GDPR for the performance of the contract. The subject matter of the contract is the above-mentioned services.
Likewise, the processing of data, as described above, is carried out to protect the legitimate interests of the Provider (Article 6 (1) (f) GDPR). These legitimate interests are to improve the products and services (including the delivery of direct advertising), to monitor and improve the performance of the offer and to detect, prevent or clarify illegal activities.
In addition, the data is processed in accordance with Article 6 (1) (c) GDPR to fulfill legal obligations (e.g., the storage and documentation obligations of the Provider). This includes in particular the personal master data.
If Customers are of the opinion that one or more of the purposes mentioned under Section 5 is/are not covered by the legal bases mentioned above, Customers may request the Provider to stop processing their personal data for certain individual purposes (opt-out). The decision to opt-out shall not prevent Customers from the further use of the Provider’s SaaS services, unless such use necessarily requires the corresponding data processing. Customers may send an opt-out request in writing to the Provider’s address mentioned above. However, it is also sufficient to send an email to: info@mybenp.com.
Right to lodge a complaint
If Customers are of the opinion that the processing of their personal data violates the GDPR, they have the right of appeal to a competent supervisory authority pursuant to Article 77 GDPR.
The Provider will of course be pleased to answer the Customer’s questions and requests before a complaint is lodged. For this purpose, the Customer may contact the Provider in writing or by email (info@mybenp.com).
Last version: March 2023
BENP GmbH
Mülistrasse 5
9243 Jonschwil
Switzerland