PRIVACY
STATEMENT

1. Overview and scope

This privacy policy provides information on how and for what purposes alpsteinfotograf (hereinafter also referred to as “we“) processes your personal data (hereinafter “you“), which you disclose to us or which we collect from you. This privacy policy is not exhaustive; other privacy policies or general terms and conditions and similar documents may regulate further specific data protection-relevant matters.

«Personal data» means any information relating to an identified or identifiable natural person.

2. Responsible party and contact person

The name and address of the controller are as follows:

Alpsteinfotograf
Chris Widmer
Hauptstrasse 55
9434 AU/SG
info@alpsteinfotograf.ch

If you have any questions about data protection, please contact our contact person at the above address.

3. Data origin and data categories

In principle, we only process the personal data that we receive or collect from our customers or end customers, interested parties, business partners, participants in events and website visitors in the course of our business activities. To the extent permitted, we also obtain certain data from publicly accessible sources (e.g. debt collection registers, commercial registers, media, the Internet) or receive such data from authorities or other third parties. If you provide us with personal data of other persons, we ask you to ensure that these persons are aware of this privacy policy and only share their personal data with us if you have been permitted to do so and if the corresponding personal data is correct.

The personal data or categories of personal data processed by us include, depending on the case, in particular personal details and contact data (e.g. name, address, telephone number and e-mail address); identification and background information (e.g. date of birth, gender, language, customer number, job title, title, function); contract data that we receive or collect in connection with the initiation, conclusion and processing of contracts with you (e.g. services or products requested or used by you and related behavioral and transaction data); financial or transaction data (e.g. information on means of payment, such as debit or credit cards, bank account details, etc. or other payment transaction data, information on your payment order and information on the payment recipient or beneficiary and the purpose of payment); communication data (e.g. e-mails, correspondence, chat messages, social media posts, comments on websites, telephone calls, video conferences, proof of identity, customer feedback and reviews and marginal data); documentation data or data from your contacts with third parties (e.g. consultation or meeting minutes, file notes, references); preference and marketing data (e.g. data on the use of our website or other digital offerings, data in connection with the marketing of products and services, such as newsletter sign-ups / cancellations[SJ1] , documents received and special activities, personal preferences and interests); Public data that can be obtained about you (e.g. land register and commercial register data, data from the media and the Internet); data in connection with proceedings or investigations by authorities, official bodies, courts, organizations or other bodies; data for compliance with legal requirements, such as in connection with the fight against money laundering; image and sound recordings (e.g. photos, videos and sound recordings, including image and sound recordings of events, recordings from video surveillance systems and recordings of telephone and video conference calls) and technical data (e.g. IP address and other device IDs, identification numbers assigned to your device by cookies and similar technologies

4. Purpose of processing and legal basis

4.1 General within the Scope of our Business Activities

We process your personal data primarily for those processing purposes that are necessary in connection with our business activities and the provision of our services and the offering of products. We may process your personal data in particular for the following purposes:

• to communicate with you, in particular to be able to provide you with information or process your concerns, to be able to authenticate and identify you, for customer service and customer care;
• for contract processing, namely in connection with the initiation, conclusion and processing of contractual relationships of all kinds, including via the applications you use. This includes all data processing that is necessary or expedient in order to conclude, execute and, if necessary, enforce a contract, such as processing to decide whether and how (e.g. with which payment options) we enter into a contract with you (including creditworthiness checks), to provide contractually agreed services, to invoice our services and generally for bookkeeping, processing applications (e.g. managing and evaluating applications, conducting interviews including creating personality profiles, obtaining references), to enforce legal claims from contracts (debt collection, legal proceedings, etc.);

• to offer you our products, sell them and improve them, and to make available our services and digital offerings (e.g. website and applications) and to evaluate and improve them;
• um sie über neuere Entwicklungen zu informieren (z.B. Newsletter) [SJ1] oder Ihnen andere Informationen zu unseren Produkten und Dienstleistungen zukommen zu lassen;
• um Events durchzuführen und Sie hierzu einzuladen;
• for customer care and for marketing purposes, e.g. to send you written and electronic communications and offers and to carry out marketing campaigns. These may be our own offers or offers from our partners. We may also process your personal data partly automatically with the aim of evaluating certain personal aspects (profiling) or creating a pre-selection when you request a product or service. We may use profiling in particular to inform you in a targeted manner about products or services (e.g. newsletters);
• to carry out customer surveys;
• in connection with bookkeeping, the archiving of data and the management of our archives;

• for training and education: We may process your personal data to conduct internal training courses and to train and further educate our employees;
• when selling receivables, e.g. if we provide the acquirer with information about the reason for and amount of the receivable and, if applicable, the creditworthiness and behavior of the debtor;
• for security measures, namely for IT and building security (such as access controls, preventing, defending against and investigating cyber attacks and malware attacks, network and mail scanners, video surveillance, telephone recordings) and to prevent and investigate criminal offenses and other misconduct or to carry out internal investigations, for evidentiary purposes, data analyses, evaluation of system-side recordings of the use of our systems (log data);
• in connection with corporate transactions or other corporate law actions (e.g. due diligence, management of share registers, etc.);
• for the assertion of legal claims and defense in connection with legal disputes and official proceedings in Switzerland and abroad, including the clarification of prospects of litigation and other legal, economic and other issues ;

• to comply with our legal and internal requirements and rules at home and abroad, including compliance with orders from a court or authority ;
• Reporting, namely the disclosure to other group companies of alpsteinfotograf;
• we may process your personal data for other purposes that are necessary to protect our legitimate interests.

We process your personal data for the above-mentioned purposes, depending on the situation, in particular based on the following legal bases:

• the processing of personal data is necessary for the performance of a contract with you or pre-contractual measures;
• You have given your consent to the processing of personal data concerning you;
• the processing of personal data is necessary for compliance with a legal obligation;
• the processing is necessary to protect the vital interests of the data subject or another natural person; or
• we have a legitimate interest in processing the personal data, whereby our legitimate interests may include the following interests in particular: in good customer service, maintaining contact and communication with customers even outside of a contract; in advertising and marketing activities; to improve our products and services and develop new ones; in the prevention, combating and investigation of crimes; in the protection of customers, employees and other persons as well as our data, trade secrets and assets; in ensuring adequate security (both physical and digital); in ensuring and organizing business operations, including the operation and further development of websites and other systems; in business management and development; in the sale or purchase of companies, parts of companies and other assets; in the enforcement or defense of legal claims; in compliance with Swiss and foreign law as well as other rules applicable to us.

4.2 Contacting Us

You can contact us via the e-mail address and telephone number provided, the contact form[SJ1] or in other ways (e.g. handing over a business card). The personal data you send to us will be stored by us and processed to handle your request. The legal basis for this processing of personal data is your consent and our legitimate interest in processing your request.

If you contact us by e-mail, you authorize us to reply to you via the same channel. Please note that unencrypted e-mails are transmitted via the open Internet, which means that it cannot be ruled out that they can be viewed, accessed and manipulated by third parties. We exclude – to the extent permitted by law – any liability that you may incur, in particular as a result of incorrect transmission, falsification of content or disruption of the network (interruptions, overloading, illegal interference, blocking).

Telephone and video conference calls with us may be recorded; we will inform you of this at the beginning of the call. If you do not want us to record such calls, you can cancel the call at any time and contact us in other ways (e.g. by e-mail or post).

4.3 Newsletter

4.3.1 Subscribing and Unsubscribing from our Newsletter

If you subscribe to our newsletter, we will use your e-mail address and other contact details to send you the newsletter.

You can subscribe to our newsletter with your consent. Mandatory information for sending the newsletter is [your first name, your last name and your e-mail address]. These as well as any optional information that you have provided during registration will be stored by us after your registration and, if necessary, processed for other purposes in accordance with section 4.1 of our privacy policy. The legal bases for the processing of your data in connection with our newsletter are your consent to the sending of the newsletter and, depending on the processing purpose, the other legal bases mentioned in section 4.1. You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare the revocation by clicking on the link provided in each newsletter e-mail, by e-mail or by writing to our addresses specified in section 2.

4.3.2 Newsletter Tracking

Our newsletters contain so-called tracking pixels. A tracking pixel is a miniature graphic that is embedded in such e-mails, which are sent in HTML format, in order to enable a log file recording and a log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns. The embedded tracking pixel allows alpsteinfotograf to recognize whether and when an e-mail was opened by a data subject and which links in the e-mail were accessed by the data subject.

Such personal data collected via the tracking pixels contained in the newsletters are stored and evaluated by us in order to optimize the newsletter dispatch and to better adapt the content of future newsletters to the interests of the data subject. This personal data will not be passed on to third parties. Data subjects are entitled at any time to revoke the separate declaration of consent given via the double opt-in procedure. After a revocation, this personal data will be deleted by us. Alpsteinfotograf automatically interprets unsubscribing from the newsletter as a revocation.

4.4 Events

We use photographers at our events to document the events. The images are also used in connection with the events in alpsteinfotograf’s communication channels. These include (list not exhaustive): Event gallery, website, social media channels, , magazine for customers , annual report. Guests can report their objection to the use to the event managers on site at the beginning of the event.

4.5 Applications

You can submit your application for a position with us by post or e-mail. The application documents and all personal data disclosed to us in connection therewith will be treated by us as strictly confidential and processed only for the purpose of processing your application for employment with us. Without your consent to the contrary, your application dossier will either be returned to you or deleted/destroyed after the conclusion of the application process, unless it is subject to a statutory retention obligation. If an employment relationship is established, the application dossier will be included in the personnel dossier. The legal bases for the processing of your data are your consent, the fulfillment of the contract with you and our legitimate interests.

4.6 when Visiting our Website

Our website records a range of user information with each visit, which is stored in the log files of the server. The information recorded includes, among other things, the IP address, the date and time of access, the time zone difference to GMT time zone, the name and URL of the file accessed, the website from which the access is made, the browser used and the operating system used. The collection of this information or data is technically necessary to display our website to you and to ensure its stability and security. This information is also collected to improve the website and analyze its use.

4.6.1 Cookies and other Services from Third-Party Providers

Our website may use so-called cookies and other services from third-party providers. Cookies are text files that are stored in the Internet browser or by the Internet browser on the computer system of the user or a mobile device. The cookie contains a characteristic string that enables a unique identification of the browser or the mobile device when the website is accessed again.

The purpose of using cookies is, on the one hand, to enable and simplify the use of our website for you. Some functions of our website cannot be offered without the use of cookies (so-called technically necessary cookies). On the other hand, we also use cookies/tools for the analysis of user behavior on our website, namely for reach measurement, as well as finally for marketing purposes.

The other third-party services are services integrated on our website, which may result in your data being disclosed to the third-party provider via the use of our website and/or the services of the third-party provider (e.g. social media plug-ins, Google Maps, YouTube, etc.).

4.6.1.1 Technically Necessary Cookies

Technically necessary cookies are required for our website to function. Therefore, these cookies cannot be deactivated in our systems. They usually record important actions, such as the number of requests made, the processing of your privacy settings or the completion of forms. You can block these cookies in your browser, but some parts of our website may then no longer function.

The legal basis for data processing when using technically necessary cookies is our legitimate interest, which lies primarily in ensuring the functionality and improvement of our website.

4.6.1.2 Analytical and Marketing Cookies and Third-Party Services

Analytical cookies enable us to analyze visitor behavior and traffic sources so that we can measure the performance of our website and improve the user experience. They help us to recognize which pages are popular and show how visitors move around our website.

Marketing cookies enable us to deliver advertising that is relevant to you. These cookies may remember that you have visited our website and share this information with other companies, including other advertisers.

We specifically use the following analysis and marketing cookies and third-party services:

Cookie/Service	Provider and privacy policy
Google Analytics	Google Ireland Ltd.
Google Syndication	Google Ireland Ltd.
Google Tag	Google Ireland Ltd.
Hu-manity	Hu-manity.co

You can object to the use of cookies, for example (i) by selecting the appropriate settings in your browser, (ii) by using appropriate cookie blocker software (e.g. ghostery etc.), (iii) by add-ons for your browser (e.g. “NoScript” etc.) or (iv) by downloading and installing the browser plug-in available under this link for Google cookies. We use the so-called Google Consent Mode V2, i.e. before you give your consent, no data (not even so-called pings for data modeling) is sent to Google. Data is only transmitted after you have given your consent.

The legal basis for data processing when using analysis and marketing cookies is our legitimate interest and your consent.

4.6.2 Third-party Plug-Ins

We may use the plug-ins listed in the table below on our website. We use the so-called two-click solution, whereby no personal data is initially passed on to the providers of the plug-ins when you visit our website. Only when you click on the marked plug-in field and thereby activate it, the plug-in provider receives the information that you have accessed the relevant website from us. In addition, the data mentioned under item 3 of this declaration is transmitted. The legal basis for the processing of your data in connection with social media plug-ins is our legitimate interest in enabling our users to use the social media plug-ins.

We have no influence on the data collected and data processing operations of the plug-in providers. These are subject to the respective data protection declarations of the third-party providers. Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the data protection declarations of these providers provided below.

Plug-in	Provider and privacy policy
Instagram	Meta Platforms Ireland Limited

5. Disclosure of personal data to recipients and abroad

5.1 Disclosure of Personal Data to Recipients

In addition to the data disclosures expressly mentioned in this privacy policy, we may, to the extent permitted, disclose personal data to the following categories of recipients:

• Providers to whom we have outsourced certain services (e.g. IT and hosting providers, advertising and marketing services, event management, accounting, debt collection services, photographers, etc.) as well as other suppliers and subcontractors;
• Payment service providers (e.g. banks, debit and credit card providers, TWINT, etc.);
• Consulting service providers (e.g. tax advisors, legal advisors and representatives);
• Auditors;
• Business partners;
• Authorized representatives;
• Insurances, social insurances;
• Third-party providers of software applications that are used by customers or end customers in connection with our services or products;
• Credit agencies that store this data for creditworthiness information;
• Third parties who collect data about you via websites;
• Potential buyers or investors in the event of corporate transactions or other corporate actions;
• Domestic and foreign authorities, agencies or courts.

5.2 Disclosure of Personal Data Abroad

In principle, we process your personal data in Switzerland. However, in exceptional cases, your personal data may also be transferred abroad in certain cases (e.g. when using certain service providers or using certain software applications), primarily to the member states of the European Union and the European Economic Area, but also partly to other countries worldwide, in particular to the USA (primarily in connection with cookies, social media plug-ins and other software applications from third-party providers).

If we transfer data to a country without adequate legal data protection, we will, as required by law, ensure an adequate level of protection by using appropriate contracts (namely on the basis of the so-called standard contractual clauses of the European Commission) or rely on the legal exceptions of consent, contract execution, the establishment, exercise or enforcement of legal claims, overriding public interests, published personal data or because it is necessary to protect the integrity of the data subjects. Nevertheless, we would like to point out that data transferred abroad is no longer protected by Swiss law and foreign laws and official orders may require the disclosure of this data to authorities and other third parties.

6. Retention period

We process and store your personal data for as long as it is necessary for the fulfillment of our contractual and legal obligations or otherwise for the purposes pursued with the processing or another legal basis (e.g. statutory retention periods) exists for this. We retain personal data that we possess on the basis of a contractual relationship with you at least as long as the contractual relationship exists and limitation periods for possible claims by us are running or contractual retention obligations exist. As soon as your personal data is no longer required for the above-mentioned purposes, it will generally and as far as possible be passively set, deleted or anonymized.

7. Your rights

Within the framework of the data protection law applicable to you and to the extent provided therein, you have the right to information, correction, deletion, the right to restriction of data processing and otherwise to object to our data processing as well as to the release of certain personal data for the purpose of transfer to another location (so-called data portability). Please note, however, that we reserve the right to assert the legally provided restrictions on our part, for example if we are obliged to store or process certain data, have an overriding interest in doing so (insofar as we may invoke it) or require it for the assertion of claims. If costs are incurred for you, we will inform you in advance.

If data processing is based on your consent, you can revoke this at any time with effect for the future after you have given your consent. However, the lawfulness of the processing carried out on the basis of the consent until revocation is not affected.

The exercise of such rights usually requires you to clearly prove your identity (e.g. by providing a copy of your ID if your identity is otherwise not clear or cannot be verified). To assert your rights, you can contact us at the address given in section 2 of this privacy policy.

In addition, every data subject has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb).

8. Data security

We take appropriate security measures of a technical and organizational nature to maintain the security of your personal data, in particular to protect it against unauthorized or unlawful processing and to counteract the risk of loss, unintentional alteration, unwanted disclosure or unauthorized access. Like all companies, however, we cannot rule out data security breaches with absolute certainty, because certain residual risks are unavoidable. As part of our security measures, we use firewalls, logging and encryption in particular, have authorization concepts and have implemented further protective measures to ensure the most complete possible protection of personal data.

9. Amendment of this privacy policy

We expressly reserve the right to amend this privacy policy at any time. If such adjustments are made, we will immediately publish the amended privacy policy on our website. The privacy policy published on our website is valid in each case.

September 2025