Data Protection Policy

This data protection policy informs you in accordance with Art. 12 et seq. GDPR about how your personal data is handled when you use our website. In particular, it explains what data we collect and what we use them for. It also informs you about how and for what purpose this is done – always taking into account the applicable data protection provisions, in particular the EU General Data Protection Regulation (GDPR), the Swiss Federal Data Protection Act and other applicable national laws.

This data protection policy applies to all companies of the CREALOGIX Group named below.

The responsible body is the company of the CREALOGIX group of companies (we, us), which decides on the purposes and means of the personal data processing in accordance with applicable law. This also includes the (mobile) applications that refer to this data protection policy.

We process personal data in accordance with the following principles: lawfulness and transparency; good faith; purpose limitation (data is only used for the purposes for which it was collected); data minimisation and proportionality; accuracy; storage limitation; integrity and confidentiality; privacy by design and by default; and the implementation of appropriate technical and organisational security measures.

Several data protection officers have been appointed for our group of companies.

For CREALOGIX (Deutschland) GmbH and for CREALOGIX BaaS GmbH & Co.KG: dsb-clx@ensecur.de, dsb-clx-baas@ensecur.de, datenschutz@crealogix.com

For all other CREALOGIX Group Companies: datenschutz@crealogix.com

Some services on our website may require us to process personal data about you in order to provide our services. This is, of course, only done within the legal framework, insofar as it is necessary and you have consented to it in the event of legal necessity. We take great care to adhere to the principles of data reduction and data economy.

Within our group, access to your data is given to those offices that require them to fulfil our contractual and legal obligations. We use HubSpot (HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany) as our customer relationship management and marketing platform. Data collected through the sales lead form and the newsletter signup form on this website may be transferred to HubSpot for customer relationship management and marketing purposes.

As the CREALOGIX Group, we process your data predominantly in Switzerland, Germany and the United Kingdom. Personal data is transferred between affiliated companies in these countries and, where applicable, to our service provider HubSpot (see 'Recipients of the data' above).

Where data is transferred from the EU/EEA to a country without an adequacy decision, we rely on the mechanisms set out in Art. 44–49 GDPR, in particular EU Standard Contractual Clauses, supplemented by additional safeguards where required by the competent supervisory authorities.

Where data is transferred from Switzerland, we rely on the mechanisms set out in Art. 16 ff. of the revised Federal Act on Data Protection (FADP/DSG), in particular the Federal Data Protection and Information Commissioner's list of countries with an adequate level of data protection, Swiss Standard Contractual Clauses, or the Swiss-U.S. Data Privacy Framework where the recipient is a certified US organisation.

How long we keep your personal data depends on the purpose for which it was collected: contact-form submissions are deleted once your enquiry has been resolved, unless you have consented to further use; leads and newsletter signups collected via HubSpot that do not convert into a customer relationship or further engagement are deleted after 90 days of inactivity; where statutory retention obligations apply (for example under commercial or tax law), we retain the relevant data for the legally required period even after the purposes above no longer apply.

To protect your data on our website and systems, we apply a combination of technical and organisational measures, including: access control and authorisation concepts that limit data access to personnel who need it; encryption of data in transit (at least TLS 1.2 for our web forms); regular backups; logging of relevant system activity; defined incident response and recovery procedures; regular staff awareness training on data protection and security; and periodic review of these measures to reflect the current state of the art. These measures are continuously adapted to technological developments.

Under the GDPR, you are entitled to the following statutory data subject rights: right to information (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to deletion (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), right to revoke consent (Art. 7(3) GDPR), and right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Insofar as the processing of your data is carried out to protect legitimate interests, you have the right to object to this processing at any time. To exercise your right to object, send an email to datenschutz@crealogix.com.

In principle, you are not obliged to provide us with your personal data. However, if you do not do this, we will not be able to provide you with unrestricted access to our website or to respond to your enquiries to us.

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances) within the meaning of Art. 22 GDPR or Art. 21 of the Swiss Federal Act on Data Protection (FADP/DSG).

Our data protection policy is regularly revised and updated to comply with the applicable data protection laws in force. We will update this policy in particular when: our processing activities change; we launch new services; we engage new processors or vendors; our corporate structure changes; we adopt new technology; or legal or regulatory requirements change.