Privacy Policy

Privacy Policy of Tukki

1. Content of the privacy policy

Tukki (hereinafter also referred to as “we”, “us”) obtains and processes personal data concerning you or other persons (so-called “third parties”). The term “data” is here synonymous with “personal data”.

Personal data” refers to data relating to specific or identifiable individuals, i.e. the data subject is identifiable by the data itself or by the inclusion of relevant additional data.

In this Privacy Policy, we describe what we do with your information when you use https://tukki.lk/ or other websites from us (collectively, the “Website“), obtain our services or products, otherwise interact with us under a contract, communicate with us, or otherwise deal with us. Where appropriate, we will notify you by timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, for example, in consent forms, contract terms, additional privacy statements, forms and notices.

If you transmit or disclose data about other persons such as family members, work colleagues, etc., we assume that you are authorized to do so and that this data is correct. By submitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

This Privacy Policy is designed to meet the requirements of the Personal Data Protection Act (PDPA). However, whether and to what extent these laws are applicable depends on the individual case.

1. Contact details and responsibility

Responsible for editing is:

SWIC Digital Gateway AG
Mainaustrasse 21
8008 Zürich
info@swic.digital

 

• Categories of processed data

We process different categories of data. The most important categories are the following:

• Technical data: When you use our website or other electronic offerings (e.g., Tukki-App), we collect the IP address of your terminal device and other technical information to ensure the functionality and security of these offerings. This information includes logs that record the use of our systems. We generally retain technical information for 6 months, but no longer than 5 years. In order to ensure the functionality of these offerings, we may also assign an individual code to you or your terminal (e.g. in the form of a cookie, see Section XI). The technical data in itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).
• Communication Data: If you communicate with us via the contact form, by e-mail, telephone, chat, letter or other means of communication, we collect the information exchanged between you and us, including your contact details and the details of the communication. If we record or listen to telephone conversations or videoconferences, e.g. for training and quality assurance purposes, we will make you aware of this. Such recordings may only be made and used in accordance with our internal policies. You will be informed if and when such recordings take place, e.g. by a display during the relevant videoconference. If you do not want to be recorded, please let us know or end your participation. If you simply do not want to be recorded, please turn off your camera. If we want or need to verify your identity, e.g. in the case of a request for information you have submitted, a request for media access, etc., we will collect data to identify you (e.g. a copy of an ID card). We generally keep this information for 12 months from the last time we communicate with you. This period may be longer if necessary for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. E-mails in personal mailboxes and written correspondence are generally kept for at least 10 years after the end of the contractual relationship.
• Master Data: We refer to Master Data as the basic information that we need, in addition to Contractual Data (see below), to process our contractual and other business relationships or for marketing and promotional purposes, such as your name, contact details and information about, for example, your role and function, bank account(s), date of birth, customer history, powers of attorney, signature authorizations and consent forms. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person for the business partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you, from the organizations you work for, or from third parties such as our contractual partners, associations and address dealers, and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.). We may also process information about third parties as part of master data. We may also collect master data from our shareholders and investors. We generally keep this data for 10 years after the end of the contract. This period may be longer if this is necessary for evidence purposes, to comply with legal or contractual requirements, or for technical reasons. For purely marketing and promotional contacts, the period is usually much shorter, usually no more than 2 years from the last contact.
• Contract data: These are data that arise in connection with the conclusion or processing of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, information required or used for processing, and information about reactions (e.g. complaints or information about satisfaction, etc.). We generally collect this information from you, our contractual partners and third parties involved in the processing of the contract, as well as from third party sources (e.g. credit rating agencies) and publicly available sources. We generally retain this information for 10 years from the end of the contract. This period may be longer if necessary for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons.
• Other data: We may also collect information from you in other situations. For example, in connection with governmental or legal proceedings, information (such as files, evidence, etc.) is collected that may also relate to you. We may also collect information for health protection purposes (e.g., as part of a health plan). We may obtain or produce photographs, videos and audio recordings in which you may be recognizable (e.g. at events, through security cameras, etc.). We may also collect information about who enters or has access to certain buildings (including during access control, based on registration data or visitor lists, etc.), who participates in events or promotions (e.g., contests) and when, or who uses our infrastructure and systems. Finally, we collect and process data about our shareholders and other investors, including, in addition to master data, information for the relevant registries, the exercise of their rights and the holding of events (e.g. general meetings). The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and usually a few weeks for contact tracing data, to visitor data which is usually kept for 3 months, to event reports with pictures which may be kept for a few years or longer. Data about you as a shareholder or other investor will be retained in accordance with company law requirements, but in any event for as long as you remain invested.

1. Data collection
2. From the person concerned

Much of the data mentioned in this Section III. is provided by you (e.g. via forms, in the course of communication with us, in connection with contracts, when using the website, etc.). Subject to certain individual cases, you are not required to disclose the data. However, if you wish to enter into a contract with us or use our services, you must provide us with data, in particular master data, contract data and registration data, as part of your contractual obligations under the relevant contract. The use of our website inevitably involves the processing of technical data. If you wish to gain access to certain systems or buildings, you must provide us with registration data.

2. Through third parties or from publicly available sources

To the extent permitted by law, we also obtain data from publicly available sources (e.g. debt collection registers, land registers, commercial registers, media or the Internet, including social media) or receive data from other companies within our group, from public authorities and/or from other third parties (e.g. credit agencies, address traders, associations, contractual partners, Internet analysis services, etc.).

1. Purpose of data processing

We process your data for the purposes described below:

1. Communication

We may process your data for purposes related to communication with you, in particular to respond to inquiries or to assert your rights. For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We store this data to document our communication with you, for training purposes, for quality assurance and for follow-up inquiries.

2. Contractual relations

We process your data for the establishment, administration and processing of contractual relationships.

3. For advertising purposes

We process data for marketing and relationship management purposes, for example, to provide our customers and other contractors with personalized advertising about products and services from us and from third parties (e.g., advertising contractors). This may take the form of newsletters and other periodic contacts (electronic, postal, telephone), through other channels for which we have your contact information, as well as one-off marketing campaigns (e.g. events) and may also include free services (e.g. invitations, vouchers, etc.). You may at any time opt out of such contact or opt out of or revoke your consent to be contacted for marketing purposes. Please note that revocation of consent does not affect the lawfulness of the data processing up to the time of revocation.

4. Compliance with legal requirements

We process personal data to comply with laws, regulations, governmental requirements and internal policies (“Compliance”). In certain cases, we may be required to make certain inquiries about customers (“Know Your Customer”) or to report to the authorities. The fulfillment of disclosure, information or reporting obligations, e.g. in connection with regulatory and tax obligations, also requires or entails the processing of data, e.g. for the fulfillment of archiving obligations and for the prevention, detection and investigation of crimes and other violations. It also includes receiving and responding to complaints and other reports, monitoring communications, conducting internal investigations, or disclosing documents to a government agency when we have reasonable grounds to do so or are required to do so by law. We may also process personal information about you as part of an external investigation, for example, by a law enforcement agency, a regulatory body or an appointed private entity. We also process data to serve our shareholders and other investors and to fulfill our obligations in this regard. For all of these purposes, we process in particular your master data, your contractual data and your communication data, as well as, in certain circumstances, behavioral data and data from the categories of other data. The legal obligations may be based on Sri Lankan law, but also on foreign regulations to which we are subject, as well as self-regulation, industry standards, our own corporate governance, and official instructions and requirements.

5. Risk management and corporate governance

We also process data for risk management purposes and as part of prudent business management, including business organization and development. For example, as part of our financial management, we need to monitor our accounts receivable and accounts payable, and we need to avoid becoming victims of crime and abuse, which may require us to analyze data for patterns of such activity. We may also conduct profiling and create and edit profiles for these purposes and to protect you and us from criminal or abusive activity. As part of planning our resources and organizing our operations, we may need to analyze and process information about the use of our services and other offerings, or share information about them with others (e.g., outsourcing partners), which may include your information. The same applies to services provided to us by third parties. As part of our business development, we may sell or acquire businesses, parts of businesses, or companies to or from other parties, or enter into partnerships, which may also involve the exchange and processing of information.

6. Administration and other purposes

We may process your information for additional purposes, such as as part of our internal operations and administration or for training and quality assurance purposes. These additional purposes include, for example, training and educational purposes, administrative purposes (such as master data management, accounting and data archiving, as well as testing, managing and continually improving the IT infrastructure), the protection of our rights (such as enforcing claims in or out of court and before authorities in Switzerland and abroad, or defending ourselves against claims, for example by preserving evidence, obtaining legal clarification and participating in legal or official proceedings), and the evaluation and improvement of internal processes. We may use recordings of (video) conferences for training and quality assurance purposes. The protection of other legitimate interests is also a non-exhaustive list of other purposes.

1. Basis of data processing
2. Consent of the data subject

We may process data on the basis of your consent. If we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time with effect for the future by notifying us in writing – by post or e-mail; you will find our contact details in “II. Contact Information and Responsibility”. Once we have received your notice of revocation, we will no longer process your data for the purposes for which you originally consented, unless we have another legal basis for doing so. Withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

2. Fulfillment or execution of contractual obligations

We may process data from you in order to fulfill our obligations arising from a contract with you. In this case, the processing of the data does not go beyond what is provided in the corresponding contract serving as a basis.

3. Compliance with legal requirements

We may process data from you in order to comply with legal obligations imposed on us, insofar as this is not already recognized as a legal basis by the respective applicable data protection law.

4. Legitimate interest

We may process data from you if we can demonstrate that there is a legitimate interest for us to process it. So, in particular to pursue the purposes and related objectives described above in Section V. and to be able to implement appropriate measures.

 

• Profiling and automated individual decisions

No data will be processed for the purpose of creating profiles or making automated individual decisions.

• Disclosure of personal data

In connection with our contracts, the Website, our services and products, our legal obligations, or otherwise to protect our legitimate interests and the other purposes listed in Section V., we may also transfer your personal data to third parties, in particular to the following categories of recipients:

1. SWIC Digital Gateway AG and other companies of the CORUM Group: For the purpose of contract fulfillment or to fulfill our obligations (from contract or from law), your data may be passed on to SWIC Digital Gateway AG or other companies within the CORUM Group. In this regard, the same requirements and conditions apply to data processing by another CORUM Group company as apply to Tukki
2. Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurance companies, debt collection companies, credit agencies or address checkers). Tukki will ensure that the service providers involved have an adequate level of protection before disclosing your personal information. This may be done by reviewing appropriate certifications or through appropriate contracts (e.g., Standard Contractual Clauses; Binding Corporate Rules; etc.).
3. Authorities: We may disclose personal data to offices, courts and other authorities in Germany and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us on their own responsibility.
4. Other persons: This refers to other cases where the inclusion of third parties arises from the purposes under Section V, e.g., service recipients, media and associations in which we participate or if you are part of one of our publications.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

1. Data disclosure abroad

We process your data in Switzerland. Data will not be transferred abroad for purposes other than those described in this Privacy Policy. If

1. Duration of processing

We process your data for as long as is necessary for our processing purposes, legal retention periods and our legitimate interests in processing for documentation and evidence purposes, or if storage is technically necessary.

1. Use of Cookies

To ensure the functionality and performance of our website, we use cookies. Cookies are small text files that are stored on the user’s local computer during a visit to a Web site and sent back to the server when the user visits the site again. This allows the website provider to analyze the user’s behavior in order to provide the best possible user experience. Cookies can be distinguished according to the type of cookie, i.e., the function performed by the cookie and whether the cookie is placed by the website operator itself (so-called “first party cookies”) or by a third party (so-called “third party cookies”). In terms of function, cookies can be distinguished as follows:

• Necessary cookies: Some cookies are necessary for the functioning of the website as such or certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies only exist temporarily (“session cookies”). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries made by you beyond one session (i.e. one visit to the website), if you request this function (e.g. selected language, given consent, the function for an automatic login, etc.). These cookies have an expiration date of up to 24 months.
• Performance cookies: In order to optimize our website and corresponding offers and to better adapt them to the needs of the users, we use cookies to record and analyze the use of our website, possibly even beyond the session. We do this through the use of third-party analytics services. We have listed these below. Before we use such cookies, we ask for your consent. You can revoke this at any time via the cookie settings here. Performance cookies also have an expiration date of up to 24 months. Details can be found on the websites of the third-party providers.
• Marketing Cookies: We and our advertising partners have an interest in targeting advertising, i.e., displaying it only to those we want to target. We have listed our advertising partners below. For this purpose, we and our advertising partners – if you consent – also use cookies that can be used to record the content accessed or contracts concluded. This allows us and our advertising contractors to display advertisements that we think you will be interested in, on our website, but also on other websites that display advertisements from us or our advertising contractors. These cookies have an expiration period ranging from a few days to 24 months, depending on the situation. If you consent to the use of these cookies, you will be shown appropriate advertising. If you do not consent to these cookies, you will not see less advertising, but randomly selected other advertising.
• Third party use

We currently procure the services of the following third-party providers:

• Data subject rights

Under certain circumstances, the applicable data protection law grants you the right to object to the processing of your data, in particular for marketing purposes. To help you control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

• The right to request information from us as to whether and what data we are processing from you;
• the right to have us correct data if it is inaccurate;
• the right to request the deletion of data;
• the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
• the right to withdraw consent, insofar as our processing is based on your consent;
• the right to receive, upon request, further information necessary for the exercise of these rights.

If you wish to exercise the above rights against us (or against one of our group companies), please contact us in writing, at our premises or, unless otherwise stated or agreed, by e-mail; our contact details can be found in ” II. Contact details and responsibility ” on page 1. In order for us to be able to rule out misuse, we must identify you (e.g. with a copy of your ID card, unless otherwise possible).

Please note that conditions, exceptions or restrictions apply to these rights under applicable data protection law (e.g., to protect third parties or trade secrets). We will inform you accordingly if necessary.

• Changes to the privacy policy

Tukki reserves the right to adapt this privacy policy at any time. The version published on this website is the current version.

Last update on: 02.10.2024