ProduceShop

Privacy policy ProduceShop

Your privacy is of utmost importance to MBK Fincom SA, and in order to protect you in the best possible way, in accordance with the Federal Act on Data Protection (LPD), Regulation (EU) 2016/679 (GDPR), and Directive 2002/58/EC (eDirective), we provide you with the necessary information regarding the processing of personal data collected during your experience on our website: www.produceshop.com

1. CATEGORIES OF PERSONAL DATA SUBJECT TO PROCESSING | DEFINITIONS

The personal data provided – or otherwise acquired in accordance with current legislative and contractual provisions – related to, connected to, and/or instrumental in evaluating your experience on our site, will be processed in accordance with privacy regulations and applicable confidentiality obligations.

Below, we provide some definitions useful in reading this document:

• Personal data: all information related to an identified or identifiable person.

• Data subjects: natural or legal persons whose data is subject to processing (hereinafter also referred to as “You”).

• Processing: any operation related to personal data, regardless of the means and procedures used, and specifically the collection, storage, use, review, communication, archiving, or destruction of data.

• Communication: namely, making personal data accessible, for example by allowing access, transmission, or publication.

Types of Data Processed

The computer systems and software procedures used to operate this website acquire, in their normal operation, some personal data whose transmission is implicit in the communication protocols of the Internet. These are pieces of information that are not collected to be associated with identified data subjects, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the user’s operating system and computer environment.

This data is used solely to obtain statistical information about the use of the site and to check its correct functioning. The data could be used, only upon request of the competent authorities, for the ascertainment of responsibility in case of hypothetical computer crimes against the site. The optional, explicit, and voluntary sending of electronic mail to the addresses indicated on this site involves the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the message.

In particular, we will process the following personal data: navigation data (for more information on the data collected with Cookies, please refer to the dedicated paragraph within this information); data provided directly by the data subject (e.g., for access to the reserved area: email address; for purchasing products: payment data).

2. IDENTITY AND CONTACTS OF THE DATA CONTROLLER

The entity that determines the purposes and means of this processing is MBK Fincom SA, CHE-472.557.344, a Swiss company located at Via al Molino 31, 6926 Montagnola – Collina d’Oro.

Contact: [email protected]

2.1 IDENTITY AND CONTACTS OF THE DPO

The Data Controller has appointed a Data Protection Officer (DPO): Proliance GmbH / www.datenschutzexperte.de, located at Leopoldstraße 21 – 80802 Munich, Germany.

Contact: [email protected]

3. PROCESSING METHODS

Personal data is processed both manually and with automated tools, for the time strictly necessary to achieve the purposes for which it was collected.

Data processing operations include: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, conducted either manually or electronically with storage in a specially prepared electronic database to fulfill the obligations and for the purposes mentioned above.

The personal data contained in the aforementioned information system, as well as those stored in the electronic archives of the Data Controller, are processed in compliance with the provisions of the current Federal Legislation on personal data processing (LPD) and the European Regulation (GDPR) on security measures, in order to minimize the risks of destruction, loss, alteration, unauthorized disclosure or access, either accidental or unlawful, or processing not in accordance with the purposes of the collection.

In accordance with Art. 8 LPD and Arts. 1,2,3, OPDa, as well as Art. 32 of the GDPR, specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access.

3.1 AUTOMATED DECISION-MAKING PROCESS

There are no fully automated decision-making processes, as per Art. 21 cpv 3 and Art. 22 c.2 GDPR.

4. PURPOSES OF PROCESSING

The processing of data has the following listed purposes. Also specified are the relevant legal bases/justifications, the period of data retention, and the necessity or otherwise of providing the data. The retention period for personal data is determined by the terms of retention prescribed by law (e.g., commercial and tax law). The corresponding data is routinely deleted upon expiry of the respective period. If the data is necessary for the performance of a contract or for the initiation of a contract, or if we have a legitimate interest in further retention, the data will be deleted if no longer necessary for these purposes or if you exercise your right of withdrawal or objection. It should be noted that the provision of personal data for the decision on the conclusion of a contract, its performance, or for the implementation of pre-contractual measures is voluntary. However, we can only make a decision in the context of contractual measures if you provide us with the personal data necessary for the conclusion of the contract, its performance, or the pre-contractual measures.

a) Enable browsing on this site and its proper use;

Activities strictly necessary for the user’s navigation on this Internet site and for controlling its correct functioning. For data processed with technical cookies, please consult the Cookie section.

Web Hosting

This website is hosted by an external service provider (hoster). This website is hosted on GPC Google Cloud Platform, Belgium, Europe-West1-b zone. The personal data collected on this website are stored on the hoster’s servers. This data may include, but is not limited to, IP addresses, contact requests, meta and communication data, web page accesses, and other data generated by a website. We collect the listed data to ensure a correct connection to the website and an error-free provision of our services. The processing of this data is strictly necessary to make the website available. The legal basis for data processing is our legitimate or predominant interest in the correct presentation and functionality of our website, according to art. 31 cpv 2 LPD and Art. 6 Para. 1 letter f GDPR. We have entered into a data processing agreement with the provider in accordance with the requirements of Art. 28 GDPR, committing ourselves to protect our customers’ data and not to transmit it to third parties. Furthermore, it is specified that, according to the LPD and the Federal Commissioner for Data Protection and Transparency, Belgium is a third country that provides adequate guarantees for the transfer of personal data. The list of adequate countries can be checked at the following link: https://www.fedlex.admin.ch/eli/oc/2022/568/it#annex_1/lvl_u1

Server Log Files

When you visit our website, it is technically necessary that data be transmitted to our web server via your Internet browser. The following data is recorded during an active connection for communication between your Internet browser and our web server: 1) Date and time of the request, 2) Name of the requested file, 3) Page from which the file was requested, 4) Access status, 5) Web browser and operating system used, 6) Full IP address of the requesting computer, 7) Amount of data transmitted. We collect the listed data to ensure a correct connection to the website and an error-free provision of our services. The processing of this data is strictly necessary to make the website available. Log files are processed to assess system security and stability and for administrative purposes. The legal basis for data processing is our legitimate or predominant interest in protecting and functioning our website, according to art. 31 cpv 2 LPD and art. 6, paragraph 1, letter f GDPR. For technical security reasons, especially to prevent attacks on our web server, we may temporarily store this data. At the latest after 30 days, the data is anonymized by shortening the IP address at the domain level, so that it is no longer possible to establish a reference to the individual user. These data are not evaluated in an anonymous form except for statistical purposes. These data are not combined with data from other data sources.

b) Obtain anonymous statistical information on the use of the site;

Please consult the Cookie section.

c) Account creation: request by the Data Subject to register on the site;

Customer Profile Registration

You have the option to create a customer account in our online store to order goods. During the registration and creation of the customer account, we collect and use the following personal data: a) first and last name, and title, b) email address, c) address, d) date and time of registration. Additionally, voluntary information may be provided. The mandatory information, provided for the purpose of registration, is marked in the input mask with an asterisk as a required field. The legal basis of the data necessary for the creation of the customer account and for ordering goods is our legitimate or predominant interest and execution of pre-contractual measures. Your data will be deleted as soon as your user account on our website is deleted and as long as there are no legal obligations for retention. A modification and/or deletion of your customer account, including the data you provided, can be made after logging in directly to your user account and deactivating your account or by sending a message to our email address provided above.

d) Allow the data subject to purchase products on the site;

Request for Quotation or Estimate Form

On our website, you have the opportunity to send us a request for a quotation or estimate. If you submit the form, the information you provide, including contact details (name, email address, phone number, VAT number) that you enter, will be stored by us for the purpose of processing your request and responding to it, in execution of pre-contractual and contractual measures or based on our legitimate or predominant interest. We do not use the data you provide for other purposes. The data will be processed for the time necessary to provide the requested feedback and, in any case, no longer than two years from the last access to the reserved area.

Order Form

You have the opportunity to send us an order form to conclude the purchase of an item. If you submit the form, the information you provide, including contact details (name, email address, phone number, VAT number) that you enter, will be stored by us for the purpose of processing your request and responding to it.

The processing of the personal data provided is based exclusively according to Art. 31 cpv 2 letter a. and Art. 6 para. 1 letter b) GDPR, as it is aimed at the conclusion of a contractual relationship with us. The data will be processed for the time necessary to provide the requested feedback and, in any case, no longer than two years from the last access to the reserved area. The right to object is reserved.

e) Institutional purposes in compliance with legal obligations, related to the activity of MBK Fincom SA and compliance with national and/or community regulations and standards;

f) Request for information by the Data Subject about products or assistance in pre or post-sale phases;

Contact Form and Email Contact

If you send us requests via our contact form or by email, your data from the contact form or email, including the contact details you provide, will be stored for the purpose of processing your request and any subsequent questions. To contact us, it is necessary to provide an email address. The name and phone number are optional. The legal basis for the processing of data is our legitimate or predominant interest in responding to your request or the execution of pre-contractual measures. The data will be processed for the time necessary to provide the requested feedback and, in any case, no longer than two years from the request. You can object to the processing of your personal data at any time.

Customer Support Form

You can send us support requests via our customer support form. If you submit the form, the information you provide, including contact details (name, email address, phone number, VAT number) that you enter, will be stored by us for the purpose of processing your request and responding to it.

The processing of the personal data provided is carried out according to Art. 31 cpv 2 letter a and Art. 6 para. 1 letter b) GDPR. We do not use the data you provide for other purposes. The data will be processed for the time necessary to provide the requested feedback.

Photographic and Video Material

With some of our specific applications for services, the user can share photos and/or videos with us to communicate with us or personalize services (for example, the use of photographic and video material for assistance, the use of photo and video capture devices of the VR system). All materials will be stored by us for the purpose of processing the request and responding to it.

The processing of the personal data provided is carried out according to Art. 31 cpv 2 letter a and Art. 6 para. 1 letter b) GDPR. We do not use the data you provide for other purposes.

Form to Suggest New Products

On our website, you can send us a suggestion for new products to add to our catalog. If you submit the form, the information you provide, including contact details (email address) that you enter, will be stored by us for the purpose of processing your request and responding.

The processing of the personal data provided is carried out according to Art. 31 cpv 2 letter a and Art. 6 para. 1 letter f) GDPR, given our legitimate or predominant interest in responding to your questions. We do not use the data you provide for other purposes.

Become Our Supplier Form

You can apply as a supplier for the product classes of your interest, using the form on our website. If you submit the form, the information you provide, including contact details (name, company name, email address, phone number) that you enter, will be stored by us for the purpose of processing your request and responding to it.

The processing of the personal data provided is carried out according to Art. 31 cpv 2 letter a. and Art. 6 para. 1 letter b) GDPR, if aimed at the conclusion of a contractual relationship with us. We do not use the data you provide for other purposes. The data will be processed for the time necessary to provide the requested feedback and, in any case, no longer than 1 year from the request.

g) Commercial communication activities (direct marketing): promotion and advertising in general, including sending newsletters and promoting new offers, also via letters, phone, SMS, etc.;

Commercial Communication and Newsletters

If you wish to receive our marketing communications, including the newsletter offered on our website, with regular information about our offers and products, we need your email address as mandatory information. In the first phase, you will receive an email with a link to confirm that, as the holder of the corresponding email address, you wish to receive the newsletter in the future. With the confirmation, you give us your consent according to Art. 31 cpv 1 LPD and Art. 6 para. 1 letter a GDPR that we can use your personal data for the purpose of sending the desired newsletter.

Please note that, at the time of registering for the newsletter, in addition to the email address required for sending the newsletter, we also store the IP address through which you registered for the newsletter, as well as the date and time of registration and confirmation, in order to be able to trace possible abuses at a later date. The legal basis of this processing is our legitimate interest according to Art. 31 cpv 2 letter a and Art. 6 para. 1 letter f GDPR. You can unsubscribe from the newsletter at any time by revoking your consent via the link included in each newsletter or by sending an email to the above-mentioned manager. After cancellation, the user’s email address will be deleted from the newsletter distribution list.

h) Soft spam: sending mail communications with content similar to goods and/or services purchased by the data subject;

Soft Spam

You may receive our promotional emails with content similar to products already provided by us (soft spam). The legal basis of this processing is our legitimate interest according to Art. 31 cpv 2 letter a and Art. 6 para. 1 letter f GDPR. You can unsubscribe from the newsletter at any time, opposing the processing.

i) Research and statistical processing, also in anonymous form, as well as studies and market research, for the purpose of profiling users, even with electronic tools;

j) Conducting checks on customer satisfaction;

The legal basis of this processing is our legitimate interest according to Art. 31 cpv 2 letter a and Art. 6 para. 1 letter f GDPR.

5. COOKIES

Our website uses so-called “cookies”. Cookies are small text files that are temporarily stored on your end device for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on the user’s device until they are deleted by the user themselves or until the web browser offers an automatic solution. Many cookies are technically necessary, as some website functions would not work without them (e.g., the shopping cart function or language settings). Other cookies are used to evaluate user behavior or to display advertisements.

The processing of personal data through other cookies is based on consent in accordance with Art. 31 cpv 1 LPD and Art. 6 para. 1 letter a) GDPR. Consent can be revoked at any time with effect for the future. In cases where such cookies are used for analysis and optimization purposes, we will inform you separately in this privacy notice and request your specific consent.

You can set your browser to be informed about the setting of cookies, to allow cookies only in certain cases, to exclude the acceptance of cookies for certain cases or in general, and to activate the automatic deletion of cookies when closing the browser.

Cookie settings can be managed at the following links for each browser:

It is also possible to individually manage the cookies of many companies and functions used for advertising. For this purpose, use the special user tools available at https://www.aboutads.info/choices/ or http://www.youronlinechoices.com/uk/your-ad-choices. Many browsers also offer a so-called “Do Not Track” function. By activating this function, the browser communicates to advertising networks, websites, and applications that you do not want to be “tracked” for behavioral advertising and similar purposes.

Furthermore, it is possible to prevent the loading of so-called scripts by default. “NoScript” allows the execution of JavaScript, Java, and other plugins only on trusted domains of your choice. Information and instructions on how to modify this function can be obtained from your browser provider (for example, for Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/noscript/). Please note that if you disable cookies, the functionality of our website may be limited.

Modification of Cookie Settings

It is possible to revoke or modify your cookie settings at any time. To do this, access the cookie settings again via the dedicated link. You will find it in the center at the bottom of the footer on our website.

Google Ads

On our website, we use “Google Ads”, a service provided by Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland (hereinafter “Google”). We use Google Ads for marketing and optimization purposes, particularly to display relevant and interesting ads to the user. If you have given us your consent under Art. 31 cpv. 1 LPD and Art. 6 para. 1 letter a GDPR, we can use Google Ads to draw attention to our interesting offers using advertising material on external websites. These advertisements are provided by Google through so-called “AdServers”. For this purpose, we use AdServer cookies, which allow the measurement of certain parameters for success, such as ad impressions or user clicks. If you reach our website through a Google ad, Google Ads will store a cookie on your PC. These cookies usually expire after 30 days and are not intended to personally identify you. The following information is typically stored as analysis values for this cookie: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), opt-out information (indication that the user no longer wishes to be contacted). These cookies enable Google to recognize the user’s web browser. If a user visits certain pages of an advertiser’s website and the cookie stored on their computer has not expired, Google and the advertiser can tell that the user clicked on the ad and was redirected to that page. Each advertiser has a different cookie associated with them. Consequently, cookies cannot be tracked through the websites of advertisers. We ourselves do not collect and process any personal data in the context of the aforementioned advertising measures. We only receive statistical evaluations from Google. Thanks to these evaluations, we can recognize which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material, in particular, we cannot identify users based on this information. Through the marketing tools used, your browser automatically establishes a direct connection with Google’s server. We have no influence on the extent and further use of the data collected by Google through the use of Google Ads. To our knowledge, Google receives the information that you have accessed the relevant part of our website or clicked on one of our advertisements. If you have a user account with Google and are registered, Google can assign the visit to your user account. Even if you are not registered with Google or have not logged in, it is possible that Google may find out and save your IP address. Since personal data is transferred to the United States, additional adequate safeguards are required to ensure the level of data protection expected by GDPR. To ensure this, we have entered into standard contractual clauses with the provider under Art. 46 Paragraph 2 letter c GDPR. These oblige the recipient of the data in the United States to process the data according to the European level of protection. In cases where this cannot be guaranteed even with this contractual extension, we try to obtain additional provisions and commitments from the recipient in the United States. Further information on the use of data by Google, settings, and opt-out options, and data protection are available on the following Google websites:

Privacy policy: https://policies.google.com/privacy

Google website statistics: https://services.google.com/sitestats/en.html

You can prevent the installation of cookies by deleting existing cookies and deactivating the storage of cookies in the settings of your web browser. Please note that in this case, you may not be able to use all the functions of our website fully. You can also prevent the storage of cookies by setting your web browser to block cookies from the domain “www.googleadservices.com” (https://www.google.de/settings/ads). We would like to point out that this setting will be deleted if you delete cookies. Additionally, you can deactivate interest-based advertisements by clicking on the link http://optout.aboutads.info. Please note that this setting will also be deleted if you delete cookies.

Google Analytics

Our website uses Google Analytics, an internet analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses so-called “cookies” and web beacons. Google will use this information on behalf of this website’s operator to evaluate users’ use of the website and to compile reports on website activity. Google will also use this information to provide the website operator with additional services related to the use of the website and the internet. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The processing is based on your consent. We only use Google Analytics with IP anonymization activated. This means that your IP address will be further processed by Google only in a shortened form. We have entered into a data processing agreement with the service provider, in which we oblige them to protect our customers’ data and not to transmit them to third parties. Since personal data is transferred to the United States, additional adequate safeguards are required to ensure the level of data protection expected by the GDPR. To ensure this, we have entered into standard contractual clauses with the provider according to Art. 46 paragraph 2 lit. c. GDPR. These clauses oblige the recipient of the data in the United States to process the data according to the European level of protection. In cases where this cannot be guaranteed even with this contractual extension, we try to obtain additional provisions and commitments from the recipient in the United States. The terms of use of Google Analytics and information on data protection are available at the following links:

http://www.google.com/analytics/terms/

https://policies.google.com/privacy

The data will be deleted as soon as they are no longer needed for the purpose for which they were collected. Data related to users and events associated with cookies, user IDs (e.g., user ID), and advertising IDs (e.g., DoubleClick cookies, Android advertising ID, IDFA) will be deleted within 14 months of collection. Please note, however, that in this case, it may not be possible to use all the functions of this website without limitations. It is also possible to prevent Google from collecting data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plugin available at https://tools.google.com/dlpage/gaoptout.

6. RECIPIENTS OF PERSONAL DATA

We may share personal information with employees and/or personnel acting under the authority of the Data Controller (duly instructed for this purpose), as well as third parties bound to the Controller by a contractual relationship, for the purpose of fulfilling contractual obligations and satisfying one or more of the already mentioned processing purposes. Such third parties will process the provided data as data processors or as independent data controllers. Specifically, we may share the personal data collected with the following categories of recipients: a) entities that provide services related to the operation of this website, the IT system of the Controller, and telecommunications networks (e.g., hosting providers, webmasters); b) assistance and consultancy companies (e.g., web & digital marketing agencies); c) competent authorities for compliance with legal obligations and/or provisions of public bodies, upon request; d) electronic payment service providers; e) couriers and freight forwarders.

7. TRANSFER OF PERSONAL DATA OUTSIDE THE CONFEDERATION

The site is based in Belgium (hosting) and, therefore, the personal data processed will be both stored in Switzerland and transferred outside the Swiss Confederation, to a country considered adequate by the Federal Council for the communication of personal data (see, Annex 1 of the OPDa https://www.fedlex.admin.ch/eli/oc/2022/568/it).

In case of communication of personal data to other foreign countries, not included in Annex 1 of the OPDa, the transfer will be carried out in accordance with the provisions of the LPD and OPDa and, in particular, on the following bases:

• in the presence of adequate guarantees, specifically contractual measures, aimed at ensuring adequate protection abroad;

• the processing is directly related to the conclusion or execution of a contract and the data being processed concerns the other party;

• the communication takes place within the same legal entity or company or between legal entities or companies under a single management, provided that the sender and the recipient comply with rules aimed at ensuring adequate protection of the data.

8. YOUR RIGHTS

Under the LPD, you are granted the following rights (non-exhaustive list): Obtain rectification of inaccurate or outdated personal data; Be informed in writing and free of charge if personal data concerning you are being processed; Prevent the communication to third parties of any sensitive personal data; Obtain the portability of personal data or request that they be transferred to third parties; Request the restriction or blocking of data processing, the prevention of data communication to third parties, or the rectification or destruction of personal data; Request the prohibition of a specific data processing and of a specific communication of personal data to third parties, or the deletion or destruction of certain personal data; If neither the correctness nor the inaccuracy of personal data can be proven, request the addition of a note to indicate the dispute; Request that the rectification, destruction, blocking, especially the communication to third parties, as well as the note on the dispute or judgment be communicated to third parties or published; Declare the illegitimacy of the personal data processing.

Under the GDPR, you are granted the following rights: Obtain from the data controller confirmation as to whether or not personal data concerning you are being processed, and if so, access to the personal data (Access); Obtain from the data controller the rectification of inaccurate personal data concerning you (Rectification); Obtain from the data controller the erasure of personal data concerning you (Erasure); Obtain from the data controller restriction of processing (Restriction); Receive the personal data concerning you, which you have provided to a data controller, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another data controller without hindrance from the controller to which the personal data have been provided (Portability); Object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you (Objection).

Without prejudice to any other administrative or judicial remedy, if the user believes that the processing of data concerning them violates the provisions of the LPD and GDPR, they have the right to lodge a complaint with the competent Supervisory Authority (For Switzerland: Federal Data Protection and Information Commissioner; for the European Economic Area, the European Data Protection Board’s website can be consulted herehttps://edpb.europa.eu/about-edpb/about-edpb/members_it). You can exercise your rights under the LPD and GDPR (as applicable) by contacting the Data Controller at: [email protected]

9. ADDITIONAL INFORMATION

Data Security

We adopt appropriate technical and organizational measures to ensure a level of protection commensurate with the risk in accordance with Art. 8 LPD and Arts. 1, 2, 3 OPDa in conjunction with Art. 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons. This website uses SSL encryption for security reasons and to protect the transmission of confidential content.

Minors

No minor under 16 years of age may submit information to this Site without the prior consent of their parents or guardians, nor make purchases or enter into legal contracts through this site without such consent, unless this is permitted by applicable laws.

External Links to Social Media

On our website, social media (e.g., LinkedIn, Facebook, Instagram) are incorporated exclusively as links to the respective service. After clicking on the embedded text/image link, you will be redirected to the website of the respective provider. User data will only be transferred after being redirected to the respective provider. Information on the use of user personal data through the use of the website can be found in the privacy policies of the visited websites.

Communication with the DPO

When contacting our data protection officer, please specify the company to which your request refers. Unless expressly requested by the DPO or our internal privacy team, please do not attach a copy of identity documents to your request.

Changes and Updates

We reserve the right to modify this privacy policy, if necessary, in accordance with current data protection regulations. In this way, we can adapt it to legal requirements and take into account changes to our services, such as the introduction of new services. The most recent version applies to your visit.

Date of last update: 5^th December 2023