The Alloboissons Group, Route du Tir Fédéral 18, 1762 Givisiez, and the companies within its group, process personal data relating to you or to other persons in various ways and for various purposes. Where we refer below to "Alloboissons" or "we", we mean the group company responsible for the relevant data processing.

"Personal data" is any information that allows a link to be made to a specific person, and "process" means any handling of such data, e.g. its collection, use and disclosure.

This statement explains how we process such data (hereinafter personal data or data) when

• you visit our website www.alloboissons.ch
• you order our services or products,
• you are otherwise in contact with us in connection with a contract,
• you contact us by email, post, on social media, via a contact form, etc.,
• you register to benefit from specific offers (e.g. a competition) and subscribe to our newsletter,
• you are in contact with us in connection with any other data processing relating to our offers.

For the sake of readability, we have partly refrained from consistently using both the feminine and masculine forms. It goes without saying that all designations refer to all genders.

We ask you to read this privacy statement carefully to find out when and how Alloboissons processes your personal data, how our company protects your data and what rights you have in this regard. If you have any further questions or would like further information about our processing of data, we are happy to assist you.

This statement is based both on the Swiss Federal Act on Data Protection (FADP) and on the European General Data Protection Regulation (GDPR). Where the privacy statement refers to "personal data", this also means "personal data" within the meaning of the GDPR. Whether and to what extent the GDPR applies, however, depends on the particular case.

Under this statement, the following company is always the "controller", i.e. it is the first legally responsible body from a data protection perspective, unless otherwise stated in a particular case:

Alloboissons SA
Route du Tir Fédéral 18
1762 Givisiez

If you have any questions regarding data protection, please feel free to contact us at the following address so that we can respond to you as quickly as possible: marketing@alloboissons.ch or at the company's postal address.

We process various categories of personal data depending on the situation and purpose. The main categories are set out below, although the list cannot be exhaustive.

Where our contractual partners are companies or associations, we process less personal data, since applicable data protection law in principle only relates to data of persons, i.e. human beings (in Switzerland, the revised data protection law in force since September 2023). However, we process all the data of the individuals with whom we are in contact, e.g. name, contact details, professional information and communication details, information about executives, etc., as part of the general information on the contractual partners with whom we work or who are interested in working with us (e.g. in connection with a sponsorship request made by an association).

You generally provide us yourself with most of the data mentioned under this section (e.g. via input fields on the website, in the context of your communication with us, in connection with contracts, through general use of the website, etc.). If you enter into contracts with us or wish to obtain services, you must also provide us, as part of your contractual obligation under the relevant contract, with data, in particular basic and contractual data.

3.1 Basic data

We refer to basic data as the fundamental data we need for the proper conduct of our business relationships or for marketing and advertising purposes, and which relates directly to you as a person and your particular characteristics. We process, for example, the following basic data:

• Title, first and last name, gender, date of birth
• Address, contact details such as email and landline and mobile phone numbers
• Information on language preferences
• For contact persons at companies, also the relationship with the company you work for
• Information on your profile and professional activity (e.g. employment relationship, employer, start of employment) and, where applicable, your education
• Customer history
• Consent declarations.

We generally obtain this data directly from you, but also from other people working within your company.

3.2 Contractual data

Contractual data is information relating to the conclusion and performance of the contract, e.g. information on the contracts and on the services provided or to be provided, as well as data relating to the period before conclusion of the contract or to the conclusion of the contract itself (e.g. the date of conclusion and the subject matter of the contract), as well as information required or used for the performance of the contract. We process, for example, the following contractual data:

• Date, request process, information on the type and duration as well as the terms of the relevant contract, data relating to the end of the contract
• Contact details and delivery addresses
• Information on the use of services
• Information on payments and payment terms, invoices, mutual claims, contacts with customer service, complaints, shortfalls, returns, information on customer satisfaction, grievances, feedback, etc.
• Identification data for accounts and logins.

3.3 Communication data

Communication data is data relating to the communication we have with you, e.g. when you contact us via the contact form or other means of communication. Communication data includes, for example:

• Name and contact details, such as postal address, email address and telephone number
• Content of correspondence (e.g. emails and telephone conversations)
• Responses to customer and satisfaction surveys
• Information on the type, time and place of communication, as well as other ancillary communication data.

If we record telephone conversations, we always inform you at the start of the call. If you object to the call being recorded and stored, you have the option to end the call or to contact us through other channels.

3.4 Technical data

Use of our website involves technical data. This includes the following data:

• IP address of the device and device ID
• Information about your device, operating system or language settings
• Information about your internet service provider
• Content viewed and actions taken on our website
• Date and time of access to the website, as well as your approximate location

We may also assign you, or your device, an individual code (e.g. by means of a cookie; see section 5.1). This code is stored for a certain period, though usually only for the duration of your visit. In principle, we cannot determine who you are on the basis of technical data alone, unless you have registered, for example, for our newsletter on our website or have a customer account with us. In that case, we can link the technical data with the basic data, and thus with your identity.

3.5 Behavioural data

In order to best tailor our offers and services to your needs or those of your company, we aim to get to know you better. For this purpose, we collect and use data relating to your behaviour. This data primarily consists of information about your use of our website. It may also be derived from technical data. This may include, for example, information on your use of electronic messages (e.g. whether and when an email is opened, or whether you click on a link, particularly when newsletters are sent). We may also use your interactions with us as behavioural data and combine it with other data (e.g. anonymous information from statistical offices), and then evaluate this data on both a personal and an anonymous basis. We also record your ratings of specific products in this way.

3.6 Preference data

Preference data informs us about your possible needs and, accordingly, the services that may be of interest to you. We therefore also process data relating to your interests and preferences (e.g. in connection with the use of the wish list on our website). We may combine preference data with other data in order to evaluate it on either a personal or non-personal basis. This method allows conclusions to be drawn about characteristics, preferences and future behaviour.

3.7 Other data

We may also record data about you in other situations. Access to data concerning you is also possible in connection with administrative or judicial proceedings (such as files, evidence, etc.). We may receive or produce photographs, videos or other audio recordings in which you may be recognisable (e.g. by means of security cameras in entrance areas, etc.). We may also collect data showing who accesses a specific building and when, or who has access rights (including during access controls, based on log data or visitor lists, etc.), who takes part in an event or action (e.g. a competition) and when, or who uses our infrastructure and systems and when.

We use your personal data primarily to process your orders and requests (e.g. in the case of a sponsorship request). If you are subscribed to our newsletter, we use your email address to send it. In addition, we also process your personal data for other purposes, provided this is permitted and appears appropriate to us, where we have a legitimate interest corresponding to the purpose pursued (and, in some cases, third parties do as well):

• For communication purposes, i.e. to contact you and to maintain contact. This includes responding to enquiries and getting in touch in the event of questions or complaints, e.g. by email. Here we primarily process your basic and communication data.
• For customer relationship management and marketing purposes, so that we can inform you about our offers in a targeted way, based on your personal interests and preferences, e.g. by means of the newsletter and personalised advertising. Here we process in particular technical data, basic and communication data, as well as behavioural data.
• We also process data to improve our services, develop our products and enhance customer service.
• To ensure IT security and for prevention purposes: we process personal data to monitor the smooth operation of our company, in particular the IT department, our website, applications and other platforms, for security purposes, to ensure the security of the IT department, to prevent theft, fraud and abuse, and also for evidentiary purposes. This includes, for example, the evaluation of system logs of the use of our systems (log data), the prevention, defence against and investigation of cyberattacks and malicious attacks, analyses and tests of our networks and IT infrastructure, and system and error checks.
• To safeguard property rights and other measures aimed at the security of the IT system, buildings, anti-theft devices and facilities, and the protection of our employees and other persons as well as assets belonging to or entrusted to us (e.g. video recordings, access controls, visitor lists, network scanners).
• To uphold rights: under certain circumstances, we also process personal data to assert rights in legal proceedings, before or outside of courts and before authorities in Switzerland and abroad, or to defend ourselves against claims. Basic and communication data may be processed for this purpose.
• To comply with legal requirements: this includes, for example, the handling of complaints and other reports, compliance with court or authority orders, measures to detect and investigate abuse, and, more generally, measures we are required to take under applicable law, self-regulation or industry standards. Here we process in particular your basic and communication data.
• For administrative and support purposes: in order to design our internal processes efficiently, we process data to the extent necessary for IT management, accounting or archiving. Here, it is primarily communication, behavioural and technical data that are processed.

We may also process data for other purposes. These include business management, including organisation and development, other internal processes and administrative purposes (e.g. management of basic data, accounting and archiving), training purposes, as well as the preparation and conduct of the purchase and sale of various business areas, companies or parts of companies and other transactions related to company law and the associated transfer of personal data, as well as measures aimed at business direction and the defence of other interests.

Since we ask for your consent for certain specific processing activities, we inform you separately about the purposes of that processing. You may withdraw your consent at any time in writing.

We integrate various techniques on our website that allow us, as well as third parties we involve, to recognise you when you use the site and, in some cases, to track you across multiple visits. The integration of such techniques is specifically regulated. We inform you about this in the present section.

5.1.        Comment et pourquoi intégrons-nous des cookies et des technologies similaires ?

Nous avons recours à des prestations de tiers sur notre site web, visant à mesurer et améliorer la convivialité du site et les campagnes publicitaires en ligne. Des composantes tierces peuvent alors être insérées sur notre site, utilisant des cookies. Lorsque nous vous traçons ou intégrons des technologies similaires, il s’agit principalement de différencier vos accès (via votre système) des accès d’autres utilisateurs, afin de pouvoir assurer la fonctionnalité du site et procéder à des évaluations statistiques. Le but n’est pas de déceler votre identité. Les technologies utilisées sont conçues de manière à reconnaître la consultation d’une page comme un visiteur individuel. Notre serveur (ou le serveur d’un tiers) vous attribue, c’est-à-dire à votre navigateur, un numéro de reconnaissance spécifique (le fameux cookie).

Cookies are files that are automatically saved by your browser on your device when you visit our website. Cookies are given a unique number (ID), allowing us to distinguish between our different visitors without personally identifying them. Cookies contain other information depending on their use, e.g. about pages viewed and the duration of a page visit. We use, on the one hand, session cookies, which are deleted as soon as the browser is closed, and, on the other hand, persistent cookies, which remain stored for a certain period after the browser is closed and which serve to recognise a visitor on their next visit.

We use the following types of cookies and similar technologies:

• Necessary cookies: these are useful for the functionality of websites, e.g. so that you can move from one page to another without losing a form you have already filled in.
• Performance cookies: these collect information about the use of a website and enable analyses, e.g. of the most popular pages. This allows us to simplify a visit to a site and improve its usability.
• Functionality cookies: these cookies enable extended functions and can display personalised content.
• Marketing cookies: these help us, as well as our advertising partners, to show you advertising for products and services that may be of interest to you, on our pages or those of third parties, or to display, after a visit to our pages, our advertisements during your subsequent internet use.

We use cookies mainly for the following purposes:

• Personalisation of content
• Delivery of advertisements and personalised offers
• Delivery of advertisements on third-party websites and measurement of performance, i.e. whether or not you have responded to these advertisements (remarketing)
• Saving settings between your visits
• Determining whether and how our website can be improved
• Collection of statistical data on the number of users and their usage habits, as well as on improving the speed and performance of the website

We may also process your data in order to reach you on third-party providers' platforms. We may also use similar technologies, such as LinkedIn Insight Tags, to store data in the browser.

5.2 How to disable cookies and similar technologies

When you visit our website, you have the option to enable or disable specific categories of cookies. You can also configure your browser to block specific cookies or similar technologies, or to delete existing cookies and other data stored in the browser. You can also extend your browser with software (a plug-in) that blocks tracking by specified third parties. You will find more information on this in your browser's help pages (often under the keyword "privacy" or "data protection"). Please note that our website will not function as well if you block cookies and similar technologies.

5.3 Partner and third-party cookies on our website

We use third-party services in order to measure and improve the usability of the site and online advertising campaigns. Third-party providers may also be located outside Switzerland and the EU/EEA, provided that appropriate protection of your personal data is ensured. For example, we integrate analytics services to optimise our site. Third-party providers can thus record the use of the site and link their records to information collected on other sites. In this way, they can record user behaviour across multiple websites and devices, in order to then provide us with statistical evaluations on this basis. Providers may also use this information for their own purposes, e.g. for personalised advertising on their own sites or other sites. If a user is registered with a provider, that provider will be able to attribute this usage data to the person concerned.

Two of the main third-party providers are Google and Meta. You will find further information about them below. Other third-party providers process personal and other data in principle in a similar manner.

Google Analytics is an analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA) and Google Ireland Ltd. (Google Building Gordon House, Barrow St, Dublin 4, Ireland; together referred to as "Google", with Google Ireland Ltd. being responsible for the processing of personal data). Google uses cookies and similar technologies to collect information about the behaviour of a particular user on the relevant website and the device used (tablet, computer, smartphone, etc.). Google collects information on the user's behaviour on the site and the chosen device and provides us with evaluations on this basis, but also processes certain data for its own purposes. We have configured Google Analytics so that visitors' IP addresses are anonymised before transmission to the United States. You can find information on data protection at Google Analytics here. You can disable Google Analytics by installing a browser add-on.

Meta Pixel is an analytics tool provided by Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). This allows us to target advertisements on Meta and Meta's partners so that they are only shown to users who may potentially be interested. We may also measure the effectiveness of such advertisements for statistical purposes and market research. We are jointly responsible with Meta for the exchange of data obtained by that company, the delivery of personalised advertisements, the improvement of ad delivery and the personalisation of content. The data is stored on servers in the EU/EEA and in the United States. Users may address their requests for information and other enquiries directly to Facebook. Further information on data protection at Meta and configuration options can be found here.

We may process and evaluate your data in an automated manner, in accordance with section 3. This includes profiling, i.e. automated evaluations of data for analytical and predictive purposes, for the transmission of preference data (section 3.6), but also to determine risks relating to abuse and security. The main examples are profiling for fraud prevention, for creditworthiness checks and risk management, for maintaining customer relationships and for marketing purposes.

We offer you the option, on our website, of using a social media plugin, e.g. from Facebook, Instagram, TikTok or YouTube, in order to integrate the functions of these providers on our websites. These plugins are disabled by default. As soon as you activate them (e.g. by clicking on the button), the relevant providers can see that you are on our site. If you have an account with the social media provider, it may add this information about you and thus track your use of online services.

We are, in principle, jointly responsible with the relevant provider for the exchange of data collected by that provider via plugins or similar functions (but not for any further processing carried out by the provider). Where possible, an additional agreement is also concluded. You may address your requests for information and other enquiries relating to joint responsibility directly to the relevant provider.

When you communicate with us via social media and our profiles (e.g. Facebook, Instagram, TikTok or YouTube) or comment on or share content, we collect data that we use mainly to communicate with you, for marketing purposes and for statistical evaluations. Please note that the platform provider also collects and uses data when you view our content on social media (e.g. relating to user behaviour), or, where applicable, combines it with other data (e.g. for marketing purposes or to personalise the platform's content). Further information on data processing by social media providers can be found in the privacy statements of the relevant social networks.

In connection with our processing activities, we also disclose your personal data to other recipients.

We may thus transfer personal data that we receive from you or from third parties, mainly to other companies within the Alloboissons Group. Such a transfer may be useful for internal group administration or to support the relevant group companies and their own data processing, e.g. for the personalisation of marketing activities or the development and improvement of services.

We also disclose personal data to service providers who need it in order to provide their services. This concerns, in particular, IT service providers, but also consulting firms, analytics and debt collection providers, credit information agencies, electronic payment service providers, marketing service providers, etc. As long as these providers process personal data in their capacity as processors, they are required to process it in accordance with our instructions and in strict compliance with the applicable data security measures.

We may also disclose your personal data to partners for joint activities. Alloboissons may carry out a joint programme or activity with another company and process your personal data in this context, provided that you take part in that activity.

However, your personal data will only be shared with other companies if you have given your consent (opt-in) to receive information directly from those companies. If you do not wish for companies other than those of the Alloboissons Group to be able to process your personal data, you may decide at any time not to take part in such activities.

Data may also be disclosed to other recipients, e.g. to courts and authorities in connection with proceedings and legal obligations to provide information and cooperate, to purchasers of businesses and assets, to financing companies in the event of securitisation, and to debt collection companies.

Recipients of data are not located solely in Switzerland. This concerns, in particular, certain service providers who may be located outside the European Economic Area (EEA) and Switzerland, i.e. in the United States and in Asia. We may, for example, disclose data to authorities and other persons abroad if we are legally required to do so, or, for example, in connection with the sale of a company or legal proceedings. However, not all of these states guarantee a level of data protection as high as that provided under Swiss law. We therefore compensate for this lower level of protection through contracts, in particular standard contractual clauses issued by the European Commission and recognised by the Federal Data Protection and Information Commissioner (FDPIC). Further information on this subject and a copy of these clauses can be found at www.edoeb.admin.ch/edoeb/de/home/datenschutz/handel-und-wirtschaft/uebermittlung-ins-ausland.html.

In certain cases, in accordance with legal data protection provisions, we may also disclose data without such contracts, e.g. if you have authorised the disclosure or if the information is necessary for the performance of the contract, for the establishment, exercise or defence of legal claims, or for overriding public interests.

We store and process your personal data for as long as necessary for the intended purpose (for contracts, in principle for the duration of the contractual relationship), for as long as we have a legitimate interest (e.g. to exercise legal rights, for archiving purposes, or to ensure IT security), and for as long as the data is subject to a statutory retention obligation (for certain specific data, the retention period may be up to ten years). Where there are no legal or contractual obligations, we delete or anonymise your data at the end of the archiving and processing period, as part of our usual procedures.

We generally retain basic and contractual data for ten years from the last contractual activity, but at least from the end of the contract. This period may be longer, provided this is necessary or technically required for evidentiary reasons or to comply with legal or contractual provisions.

We anonymise or delete your behavioural and preference data once it is no longer relevant for the purposes pursued, which, depending on the type of data, is the case after two years (product and service preferences). This period may be longer, provided this is necessary or technically required for evidentiary reasons or to comply with legal or contractual provisions.

Video recordings made in the company's buildings and in certain subsidiaries for security reasons are deleted after 6 weeks.

Depending on the case, the processing of data is only permitted if applicable law specifically allows it. This does not apply under Swiss data protection law, but does, for example, under the GDPR, to the extent that it applies. In that case, we rely on the following legal bases for the processing of your personal data:

• you have consented to the processing of your data (Art. 6(1)(a) and Art. 9(2)(a) GDPR);
• the processing is necessary for the performance of the contract or for the implementation of pre-contractual measures (e.g. for the review of a contract request; Art. 6(1)(b) GDPR);
• the processing is necessary for the establishment, exercise or defence of legal claims or civil proceedings (Art. 6(1)(f) and Art. 9(2)(f) GDPR);
• the processing is necessary for compliance with legal provisions in Switzerland and abroad (Art. 6(1)(c) and (f); Art. 9(2)(g) GDPR);
• the processing is necessary for a legitimate interest in the processing of data, in particular the interests mentioned in section 4 (Art. 6(1)(f) GDPR).

We take appropriate security measures to ensure the confidentiality, integrity and availability of your personal data, to protect it from unauthorised or unlawful processing, and to avoid the risk of loss, unintentional alteration, unwanted disclosure or unauthorised access. However, it is not possible to completely rule out security risks. A low level of risk remains unavoidable.

13. What are your rights?

Under applicable data protection law, you have rights that enable you to obtain further information about our processing of data and to influence it. These are, in particular, the following rights:

• Right to information: you may request further information about our processing of your data. We are happy to assist you. You may submit a request for information if you wish to obtain further information as well as a copy of your data.
• Objection and erasure: you may object to the processing of your data and request the erasure of your personal data at any time, provided we are not required to continue processing and retaining it.
• Rectification: you may rectify or complete incorrect or incomplete personal data, or have it supplemented by a notice of dispute.
• Data portability: you also have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to have it transferred to a third party, provided that the corresponding processing of data is based on your authorisation or is necessary for the performance of the contract.
• Withdrawal: for as long as we process data on the basis of your authorisation, you may withdraw your consent at any time. Withdrawal is only valid for the future, and we reserve the right, in the event of withdrawal, to continue processing the data on another basis.

Please note that these rights are subject to legal provisions and restrictions and are therefore not fully available in every case. To the extent legally permitted, in particular for the protection of the rights and freedoms of other data subjects, as well as to preserve interests worthy of protection, we may also partially or fully refuse a request from data subjects (e.g. by redacting specific content relating to third parties or our trade secrets).

If you wish to exercise your rights, please do so in writing. Our contact details can be found under section 2. We must, in principle, verify your identity (e.g. by means of a copy of an identity document). It is also possible to lodge a complaint with the competent supervisory authority in order to object to our processing of your data. The relevant supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).