My Swiss Keeper Solution privacy policy.

02 Short version

The following is a summary of, but not a replacement for, this Privacy Notice:

• Our role. My Swiss Keeper SA processes your personal data mainly (i) on your behalf, if you are an individual Keeper, or (ii) on behalf of the Keeper to which you are affiliated. In this second scenario, we act as data processor for your Keeper. You must refer to your Keeper’s privacy policy for information about its processing activities. In limited situations described in this Privacy Notice, we act as data controller of your personal data (see section 3).
• Data we collect and analyse. We collect the content that you or your Keeper provide us with, but this information is encrypted and we only use it to provide our Services or comply with our legal obligations. In addition, we collect your account information and data on how you interact with the Services for ensuring strong encryption (see sections 4, 5 and 6).
• Storage and transfers. Your personal data is stored in Switzerland. Except with your explicit consent, we do not share it with third parties or transfer it abroad unless this is both necessary for the operation of our Services and permitted by applicable laws (see sections 7 and 8).
• Your rights. You may contact us (privacy@myswisskeeper.com) to exercise your rights pertaining to your personal data (see sections 12 and 13).

03 Who is responsible for the processing of your personal data

The My Swiss Keeper Solution is operated by us, My Swiss Keeper SA, a Swiss company with registered office in Vaud, Switzerland. You will find our contact details below in section 12.

Except when we process your personal for our legitimate business operations related to providing the Services, as further detailed in this Privacy Notice, or when you are our Keeper, the Keeper to whom you are affiliated is responsible, as data controller, for the processing of your personal data through the Services. In that case, we act as a data processor for your Keeper in accordance with our GTC.

04 Types of data we collect and how we obtain it

05 How we use your data

We process your personal data in compliance with applicable law, in particular Swiss data protection laws and, to the extent they apply to us, other data protection legislations, such as the EU General Data Protection Regulation (GDPR), manually or automatically using computer tools.

This means that we will only process your information for certain reasons (see Section 7) where we have a legal basis to do so.

06 Why we use your data

We process your personal data for the following reasons:

6.1 To provide our Services

This includes:

6.2 To manage our customers

This includes:

• processing orders and payment
• tracking our activities
• managing our archiving and records

6.3 For our legitimate business interests related to the provision of the Services

This includes:

• ensuring that our Services are provided in an efficient and secure way (e.g. through internal analysis of the Services’ stability and security, updates and troubleshooting)
• protecting the security of our IT systems, architecture and networks

6.4 To send you advertising information

We may contact you by email to inform you about our activities and our Services, if you have not objected to the corresponding use of your email address. You can object to the use of your email address for this purpose at any time by contacting us (see section 13).

6.5 To comply with our legal obligations

This includes:

• responding to disclosure request from public authorities
• keeping information for tax or accounting purposes, or for the establishment, exercise or defense of legal claims

07 The circumstances in which we share your personal data with third parties

We will only share your personal data with third parties if this is necessary for the operation of our Services, if there is a legal obligation or permission to do so, or if there is another valid reason to do so.

08 International transfers

We store your personal data on servers located in Switzerland.

We will not transfer your personal data to other countries or make it available there except if we have a legal obligation to do so, or if we obtain your explicit consent. Note that we do not control from where you or your Keeper and authorized users access and use our services.

09 How long we store your personal data

Your personal data will not be stored longer than necessary. We will erase or anonymize your personal data as soon as it is no longer necessary for us to fulfil the purposes set out in section 6 of this Privacy Notice. This also varies, depending on the type of data concerned and the applicable legal requirements:

• Contents. Your content is retained for as long as your account is active. If you no longer use your content, your content will be deleted or anonymized within 90 days after such event, unless data must be retained for a valid reason.
• Account information. Subject to the legal obligations incumbent upon us, certain information relating in particular to the contractual relationship must be retained for at least 10 years.
• Usage data. Usage data is generally deleted or anonymized immediately when you end your session.

10 Security

We are committed to the security of your personal data, and have in place physical, administrative and technical measures designed to keep secure your personal data and to prevent unauthorized access to it. Your content information is protected using strong encryption processes. We do not have access to encryption keys of our users as part of the normal operation of the Solution.

Although we take appropriate steps to protect your personal data, no IT infrastructure is completely secure. Therefore, we cannot guarantee that data you provide to us is safe and protected from all unauthorized third-party access and theft. We waive any liability in this respect.

The internet is a global environment. As a result, by sending information to us electronically, such data may be transferred internationally over the internet depending upon your location. Internet is not a secure environment and this Privacy Notice applies to our use of your personal data once it is under our control only. Given the inherent nature of the internet, all internet transmissions are done at your own risk.

If we have reasonable reasons to believe that your personal data have been acquired by an unauthorized person, and applicable law requires notification, we will promptly notify you of the breach by email (if we have it) and/or by any other channel of communication (including by posting a notice on the Solution).

11 How we use cookies or other analytical tools

Cookies are small files of letters and numbers downloaded to your computer when you access certain websites. In general, cookies allow a website to recognize a user’s computer.

There are various types of cookies. In connection with the Solution, we only use “essential cookies”, which are required to make the Solution capable of being used (the Solution cannot function properly without them).

We currently only use the following cookie in connection with the Solution:

To find out more about cookies, including how to see what cookies have been set and understand how to manage, delete and block them, visit www.aboutcookies.org or www.allaboutcookies.org. Your rights with regard to the processing of your personal data.

By accessing your user account, you can review, update, correct or delete the personal data available within your user account. We do not have access to your content and therefore cannot help you exercise your data protection rights in that context. You should direct your privacy inquiries relating to your content, including any requests to exercise your data protection rights, directly to your Keeper’s contact person.

You may contact us directly to exercise your rights pertaining to your account information or usage data. Unless otherwise provided by law, you have the right to know whether we are processing your personal data, to know the content of such personal data, to verify its accuracy, and to the extent permitted by law, to request that it be supplemented, updated, rectified or erased. You also have the right to ask us to cease any specific processing of personal data that may have been obtained or processed in breach of applicable law, and you have the right to object to any processing of personal data for legitimate reasons.

The above does not restrict any other rights you might have pursuant to applicable data protection legislation under certain circumstances.

If you are not satisfied with the way in which we process your personal data, you may lodge a complaint with the competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, in addition to the rights described above.

Although this is not required, we recommend that you contact us first, as we might be able to respond to your request directly.

12 Contact us

If you believe your personal data has been used in a way that is not consistent with this Privacy Notice, or if you have any questions or queries regarding the collection or processing of your personal data, please contact us at privacy@myswisskeeper.com.

13 Updates to this Privacy Notice

This Privacy Notice may be subject to amendments. Any changes or additions to the processing of personal data as described in this Privacy Notice affecting you will be communicated to you through appropriate means (depending on whether we maintain communication with you), including via email and/or via the Solution (e.g. banners, pop-ups or other notification mechanisms). If you do not agree to the changes made, you must stop accessing and/or using the impacted Services.