Pri­vacy statement

The operator of this website and the data controller for processing data via this website is OBT AG (hereinafter: “OBT”).

The relevant contact details are: Rorschacher Strasse 63 | 9004 St.Gallen | Tel: +41 71 243 34 34 | info@obt.ch

You can reach our data protection coordinator at compliance(at)obt.ch or at our postal address by addressing your correspondence to the attention of “Data Protection Coordinator”.

OBT must appoint a representative within the European Union pursuant to Art. 27 GDPR, as it also offers its services to data subjects in the EU and processes their personal data in the process.

Our representative within the EU is MORGENSTERN consecom GmbH, Grosse Himmelsgasse 1, 67346 Speyer (DE).

1. Accessing and using the website

Each time the website and its subpages are accessed, usage data is transmitted by the respective Internet browser and stored in log files (server log files). The temporarily stored data records contain the following information: IP address of the computer making the request, HTTP response code, referral URL (the source you visit our website from (referrer URL, social media, direct access)), browser information (product and version information for the browser used), date and time of the server request, operating system used on the computer making the request, name of the file accessed, amount of data transferred, success messages (e.g. error, etc.).

The legitimacy of this processing is based on Art. 6 para. 1 b), f) GDPR (user relationship, legitimate interest) or Art. 13 para. 1 DPA. OBT's legitimate interest lies in providing a website with information, offering services to customers and optimising the operation of the website. The data processed by OBT is required to enable the use of the website.

The log files are analysed by OBT in anonymised form in order to further improve the website and make it more user-friendly, to find and correct errors more quickly and to control server capacities. For example, it is possible to track when the website is particularly popular and OBT can provide the corresponding data volume. IP addresses are deleted or anonymised after use. In the case of anonymisation, the IP addresses are changed in such a way that they can no longer be assigned to a specific or determinable or identified or identifiable natural person, or only by means of a disproportionate effort in terms of time, costs and manpower.

2. Use of cookies

OBT uses cookies. These are small packets of data, usually consisting of letters and numbers, that are stored on a computer’s browser when certain websites are visited. The cookies allow the website to recognise the browser, track users as they browse through various sections of the website, and identify users when they return to the website. Cookies do not contain data that personally identifies the user, but the information about users stored by OBT can include the data received from and stored in the cookies.

Information obtained by OBT through the use of cookies may be used for the following purposes:

• Recognition of the user's computer when visiting the website
• Tracking of the user's browsing activities on the website
• Improving the website's user-friendliness
• Evaluation of use of the website
• Website operation
• Preventing fraud and improving the security of the website
• Individual design of the website taking into account the needs of the users

Cookies are harmless on a browser. They do not contain viruses and do not allow the operator to spy on the user. There are two types of cookies used:

• Temporary cookies are automatically deleted when you close your browser (session cookies).
• Permanent cookies, on the other hand, have a maximum lifetime of up to 20 days. This type of cookie allows users to be identified when they return to the website after leaving it.

With the help of cookies, it is possible to track usage behaviour for the aforementioned purposes and to the corresponding extent. They are also intended to provide users with an optimised browsing experience on the OBT website. This data is also only collected in anonymised form. The legitimacy of this processing is based on Art. 6 para. 1 f) GDPR or Art. 13 para. 1 DPA (legitimate interest). The legitimate interest of the operator lies in the optimised presentation of its website.

The provision of the data is necessary in order to enable smooth, error-free access to the operator's website. If the user does not accept cookies or deletes cookies that have already been set, this may lead to the website being limited in its functionality.

3. Contact form and email on click

If users wish to contact OBT, there is a contact form available for this purpose. The following information must be provided within this form: salutation, surname, first name, email address (mandatory fields). Optionally, the following information may also be provided: title, role, company, address, telephone number, comments. In several places on the website users also have the option of sending an email to OBT with just one click. The email address linked to the user's email programme is automatically used as the default to send the email. If a user does not want their email address to be retrieved in this way, this can be changed in the settings.

The legitimacy of this processing is based on Art. 6 para. 1 b) GDPR or Art. 13 para. 2 lit. a DPA (pre-contractual measure). The provision of the data is necessary because otherwise the user cannot send OBT a message and his/her request cannot be processed.

4. Ordering IT services

The user can order certain services and software products (e.g. OBT Time) or obtain further information on the services via a separate form. Depending on the service, the following information must be provided as a minimum: salutation, surname, first name, company, address, email address, telephone number.

OBT processes this data in order to handle the contractual relationship with the user and to provide the ordered services. This refers to data that is absolutely necessary for the aforementioned processes. Optional specifications are marked accordingly.

The legitimacy of this processing is based on Art. 6 para. 1 b) GDPR or Art. 13 para. 2 lit, a DPA (pre-contractual measure and fulfilment of contract). The provision of your data is necessary because otherwise the order cannot be processed and we cannot deliver or provide the ordered services or information to you.

5. Newsletter and subscriptions

To receive further information about OBT's services, users can also subscribe to an email newsletter. Furthermore, users can additionally subscribe to receive regular specific information (e.g. our corporate news bulletin, professional guides or our SME research).

To activate the newsletter or a subscription, the double opt-in procedure is used, i.e. users can only subscribe if they have previously expressly confirmed that they agree to the newsletter dispatch or subscription being activated. Once users have activated the newsletter or subscription they then receive a notification email.

To receive the newsletter, users must provide the following information: salutation, surname, first name, email address. To subscribe to receive OBT’s research papers, you must provide the following information: salutation, surname, first name, email address. To subscribe to the corporate news bulletin, you must provide the following information as a minimum: name, first name, address, email address, telephone number.

The legitimacy of these processing operations is based on Art. 6 para. a) GDPR and Art. 13 para. 1 DPA, according to which processing is lawful if the data subject has given his/her consent to the processing of personal data relating to him/her for one or more specific purposes.

The user data will be deleted once consent has been revoked unless the data controller has a legitimate interest in its continued storage. This may be the case if OBT must continue to store the data due to a contract with the user. In any case, only data that is absolutely and completely necessary to achieving the corresponding purpose will continue to be stored.

6. Registration for events

Users can register on the OBT website to take part in various events (e.g. Abacus special course “Evaluations Payroll Accounting”, Abacus “Basic Financial Accounting”). For this purpose, the following information must be provided to register for the event: salutation, surname, first name, role, company, address, email address, telephone number.

OBT processes the data provided in order to set up and manage the event and the associated contractual relationship. This refers to data that is absolutely necessary for the aforementioned processes. Optional specifications are marked accordingly. The legitimacy of this processing is based on Art. 6 para. 1 b) GDPR and Art. 13 para. 2 lit. a DPA respectively, according to which the processing is lawful if it is necessary to fulfil a contract to which the data subject is a party or to implement pre-contractual measures carried out at the request of the data subject.

The processing of data for the purpose of carrying out the event and handling the contractual relationship constitutes the fulfilment of a contract. The data collected by OBT are necessary for the implementation of the contract, otherwise the users will not be able to participate in the event.

The personal data processed as part of the order will be deleted after the expiry of the statutory storage obligations unless the data controller has a legitimate interest in further storage. In any case, only data that is absolutely and completely necessary to achieving the corresponding purpose will continue to be stored. As far as possible, personal data will be anonymised.

7. Information on company sales

On the website, users can request to receive regular information about planned company sales. For this purpose, at least the following information must be provided in order to obtain the information: title, surname, first name, information on signature authorisation, address (street, town, postcode) and email address.

In addition, users must either immediately digitally sign the non-disclosure agreement, which is automatically generated in the browser following the submission of the information, and submit it to OBT digitally; or print it out, sign it and send it to OBT by post.

Subsequently, the information about the corresponding company is sent to the user by email.

The full name and address are required to generate the non-disclosure agreement. OBT requires the email address in order to send the user information on company sales.

The legitimacy of these processing operations is based on Art. 6 para 1 a) GDPR and Art. 13 para. 1 DPA, according to which processing is permissible if the data subject has given his/her consent to the processing of personal data relating to him/her for one or more specific purposes.

The personal data processed as part of the order will be deleted after the expiry of the statutory storage obligations unless the data controller has a legitimate interest in further storage. In any case, only data that is absolutely and completely necessary to achieving the corresponding purpose will continue to be stored. As far as possible, personal data must be anonymised.

8. OBT Ticket Portal

On the website, users can enter tickets in the OBT ticket portal to receive IT support for OBT's products. For this to happen, users are required to register initially (one-off basis). The following information must be provided for registration: salutation, company, customer number, first name, last name, address, email address, telephone number. After submitting the registration form, users will receive an email with their login details once the verification has been carried out to assess their eligibility to use the ticket portal. To create a ticket, the incident or request must be described as precisely as possible.

OBT processes the data provided in order to verify whether users are authorised to use the ticket portal to process their support requests and to fulfil the associated contract. This refers to data that is absolutely necessary for the aforementioned processes. Optional specifications are marked accordingly.

The legitimacy of this processing is based on Art. 6 para. 1 b) GDPR and Art. 13 para. 2 lit. a DPA respectively, according to which the processing is lawful if it is necessary to fulfil a contract to which the data subject is a party or to implement pre-contractual measures carried out at the request of the data subject.

The processing of your data for the purpose of verifying your eligibility to use the ticket portal and for handling support requests is part of fulfilling a contract. The data collected by OBT is necessary for the fulfilment of the contract, as support requests cannot otherwise be processed.

The personal data provided during registration and as part of processing support requests is stored in the database of the ticket system (TopDesk). The data will be deleted after expiry of the statutory retention obligations unless the data controller has a legitimate interest in their further retention. In any case, only data that is absolutely and completely necessary to achieving the corresponding purpose will continue to be stored. As far as possible, personal data must be anonymised.

9. Online customer portal myOBT

Users can access the online customer portal, myOBT, via the OBT website (www.myobt.ch). Here, customers or contractual partners of OBT have the opportunity to use the various services on the online customer portal.

Registration

The following personal data is collected for registration: email address, first name, last name, company.

The legitimacy of the processing is based on Art. 6 para. 1 b) GDPR or Art. 13 para. 2 lit. a DPA, according to which the processing is lawful if it is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures that are taken at the request of the data subject. In all other respects, the legitimacy of processing personal data is based on Art. 6 para. 1 f) GDPR or Art. 13 para. 1 DPA (legitimate interest). The legitimate interest lies in the electronic provision of services for OBT’s customers.

Services

Users have access to different functions within the online customer portal depending on the contractual relationship. Users can, for example, enter the following personal data or upload documents with such data:

• Payroll data (e.g. expense claims, sickness and accident reports, bank statements, journals)
• Data for personnel administration (e.g. social security data, personal data, information on children and partners, religion)
• Data for accounting

The respective company that processes its data here remains responsible under data protection law for the personal data entered into the online customer portal.

10. Use of tracking tools

Google Analytics

OBT uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics uses cookies – text files that are saved on your computer and that facilitate analysis of how the website is used.

The information generated by the cookie about the use of this website (e.g. IP address, information on operating systems and browsers) is as a rule transmitted to and stored by Google on servers in the USA. In addition, the operator can also track other interactions that users make while visiting the website in their browser or another website.

As IP anonymisation is activated on this website, the IP address is shortened by Google beforehand. The IP address transmitted by your browser as part of Google Analytics is not amalgamated with other data available to Google.

Google can use this information to analyse the use of the website, to compile reports on website activity for the website operator and to provide further services associated with the use of the website and the Internet. Google may also pass this information on to third parties, provided that this is permitted by law or that third parties have been hired by Google to process the data.

The legitimacy of this processing is based on Art. 6 para. 1 a) GDPR or Art. 13 para. 1 DPA (consent). Users can decide for themselves whether they want to allow this processing. You have the option of revoking your consent at any time with effect for the future.

11. Google Maps

OBT uses the Google Maps map service provided by Google. Through its use, information on the use of the website (for example, date and time of the visit, IP address, etc.) is transmitted to Google servers in Ireland and stored. If necessary, data may also be transferred to the USA.

The data will be used by Google for the purposes of advertising, market research and/or needs-based design of its websites.

OBT uses Google Maps to enable users to find routes. The use of data for route finding constitutes a legitimate interest of the operator within the meaning of Art. 6 para. 1 f) GDPR or Art. 13 para. 1 DPA. This facilitates route finding to the operator's place of business. The provision of the data is neither required by law nor necessary for the conclusion of a contract. Failure to provide the data means that this feature cannot be used.

12. Fonts

OBT uses external fonts on the website via the Google Fonts service. This is operated by Google Ireland. Through its use, information on the use of the website (for example, date and time of the visit, IP address, etc.) is transmitted to Google servers in Ireland and stored. If necessary, data may also be transferred to the USA.

The operator uses Google Fonts to enable the use of external fonts for better presentation of the website. The use of data for the purpose of improving the presentation of the website constitutes a legitimate interest of the operator within the meaning of Art. 6 para. 1 f) GDPR or Art. 13 para. 1 DPA. The provision of the data is neither required by law nor necessary for the conclusion of a contract. Failure to provide the data will result in the font being displayed to the user in a different form.

The operator does not store any personal data about the integration of Google Fonts. The data is stored by Google in accordance with its own data protection regulations. Further information on this can be found in Google's Privacy Policy and terms of use.

13. reCAPTCHA

OBT uses the reCAPTCHA service from Google Ireland Limited. This is designed to contribute to the security of the website and to distinguish whether it is a natural person or a machine entering the data. As part of this, various personal data is collected, such as IP address, and this data is transmitted to Google in Ireland. As the case may be, data may also be transferred to the USA.

The use of data for the security of the website constitutes a legitimate interest of the operator within the meaning of Art. 6 para. 1 f) GDPR or Art. 13 para. 1 DPA.

The provision of the data is neither required by law nor necessary for the conclusion of a contract. Failure to provide the data means that users cannot use the corresponding forms.

The operator does not store any personal data about the integration of reCAPTCHA. The data is stored by Google in accordance with its own data protection regulations. Further information on this can be found in Google's Privacy Policy and terms of use.

14. Advertisements

Insofar as users have contacted OBT via a form and have thereby transmitted their data, this data may be used by OBT for advertising purposes.

The legitimacy of this processing is in principle based on Art. 6 para. 1 f) GDPR or Art. 13 para. 1 DPA (legitimate interest). OBT relies on actively introducing its services to new or existing clients from a business perspective. Depending on the advertising channel, admissibility is also based on Art. 6 para. 1 a) GDPR or Art. 13 para. 1 DPA (consent). If the operator's advertising is only lawfull with the user's consent, they will be asked for their consent in each individual case.

Users have the right to information (Art. 15 GDPR or Art. 8 para. 1 DPA); correction (Art. 16 GDPR or Art. 15 para. 1 DPA); deletion (Art. 17 GDPR or Art. 15 para. 1 DPA); restriction of processing (Art. 18 GDPR or Art. 15 para. 1 DPA); and data transfer (Art. 20 GDPR).

Users also have the right to complain to the relevant supervisory authority.

Users may revoke consent given to the operator at any time with effect for the future. However, this has no influence on the data processing carried out up until that point on the basis of this consent (e.g. sending a newsletter, evaluation of usage data for analysis purposes, contact by telephone for advertising purposes).

When visiting the website, content linked to third-party websites may be displayed. The operator has no access to the cookies or other functions used by third-party sites, nor can the operator control them. Such third-party sites are not subject to the operator’s data protection provisions.