Data protection

1. Who are we?
We are swiss smile Holding AG, with registered seat at Bahnhofstrasse 110, 8001 Zurich, Switzerland, and registered with the commercial register of the canton Zurich under number CHE-113.044.674, and swiss smile Schweiz AG, with registered seat at Bahnhofstrasse 110, 8001 Zurich, Switzerland, and registered with the commercial register of the canton Zurich under number CHE-112.965.784, and Bellevue Zahnärzte AG, with registered seat at Theaterstrasse 14, 8001 Zurich, Switzerland, and registered with the commercial register of the canton Zurich under number CHE-449.666.975, and Zahnmedizinisches Zentrum Zürich Nord AG, with registered seat at Herzogenmühlestrasse 14, 8051 Zurich, Switzerland, and registered with the commercial register of the canton Zurich under number CHE-108.440.461, and Prophylaxe Zentrum Zürich AG, with registered seat at Herzogenmühlestrasse 14, 8051 Zurich, Switzerland, and registered with the commercial register of the canton Zurich under number CHE-108.281.949, and Praxis am Pilatusplatz AG, with registered seat at Pilatusstrasse 39, 6003 Lucerne, Switzerland, registered with the commercial register of the canton Lucerne under number CHE-113.680.373, and Zahnarztpraxis Dr. Beat R. Widmer AG, with registered seat at Tramstrasse 11, 5034 Suhr, Switzerland, registered with the commercial register of the canton Aargau under number CHE-379.342.614, and Klinik am Dorfplatz AG, with registered seat at Engelgasse 2474, 9053 Teufen, Switzerland, registered with the commercial register of the canton Appenzell Ausserrhoden under number CHE-108.319.730 (“swiss smile”, “we”, “us”).

In the context of the use of our website www.swiss-smile.com (the “Website”), we collect, hold, disclose and/or otherwise process personal data. Pursuant to applicable data protection and privacy legislation, we qualify as the controller with respect to the personal data that we process.

2. We know your privacy is important to you
We value your right to privacy and strive to protect your personal data in accordance with applicable data protection legislation and more specifically with the Swiss Data Protection Act (DPA) and the General Data Protection Regulation (“GDPR”).

In this website privacy policy (this “Privacy Policy”), we set forth how,in connection with the use of our Website,we collect your personal data, how and for what purposes we may use your personal data and to whom your personal data may be disclosed by us. Further, this Privacy Policy includes important information regarding your rights with respect to the processing of your personal data. Therefore, we encourage you to read this Privacy Policy very carefully.

From time to time, we may need to change this Privacy Policy. The most recent version of this Privacy Policy is available on our Website under www.swiss-smile.com/en/terms-of-use/. We encourage you to regularly review this Privacy Policy. You may also ask us to send you a copy of the most recent version of this Privacy Policy.

Attention: By using our Website and by sharing your personal data with us, you acknowledge that your personal data will be processed in the manner as described in this Privacy Policy.

Note: this does not constitute your ‘consent’ to the processing of your personal data. We do not process your personal data on the basis of your consent, unless specifically indicated.

3. Whose personal data do we collect?
In the context of our services, we may collect personal data relating to visitors of our Website and people who make an appointment or on whose behalf an appointment is made through our Website.

4. How do we collect personal data relating to you?
We may collect information about you in various ways when you visit our Website:

• automatically as soon as you visit the Website, for example when data is collected directly by our IT systems;
• directly from you when you visit our Website, which may include information you provide to us by means of contact forms on that Website;
• otherwise, for exampleby means of cookies.

5. What personal data do we collect and for what purposes do we use your personal data?
We collect the following information about you and we use it for the following purposes:

We process the data marked with an asterisk in order to execute the services we render to our clients.  For the other processing activities, we rely on our legitimate interest.

6. With whom do we share your personal data?
In the context of the purposes as listed above, we may share your personal data with service providers we use (e.g. IT service providers or marketing agencies). Your personal data can also be disclosed to our affiliated companies and investors for analytical reasons.

We will ensure that, where relevant, contractual safeguards are implemented to ensure the protection of your personal data when disclosing your personal data to a third party. For example, we will enter into data processing agreements with relevant parties (providing for restrictions on the use of your personal data and obligations with respect to the protection and security of your personal data).

The parties to whom we may disclose your personal data as referred to above are generally located in Switzerland or in countries inside the European Economic Area (“EEA”). Exceptionally, they may be located in countries outside the EEA and Switzerland, which countries may offer a lower level of data protection than the EEA and Switzerland. In such case, it shall be ensured that adequate measures are taken to ensure adequate protection of your personal data in accordance with applicable data protection legislation. Especially, we will enter into standard data protection clauses (as adopted respectively approved by the European Commission and the Swiss Federal Data Protection and Information Commissioner (“Federal Commissioner”)) with the recipient of your personal data.

Your personal data and/or person profiles shall not be rented, nor sold to third parties.

7. How long do we store your personal data?
Your personal data will not be stored for longer than is necessary in relation to the purposes for which we process them (we refer to the purposes as listed above in paragraph 5). Only where we are legally obliged to, or where this is necessary for defending our interests in the context of judicial proceedings (e.g. in case of a dispute), we will store the personal data for longer periods.

8. How do we protect your personal data?
We will implement the necessary administrative, technical and organisational measures for ensuring a level of security appropriate to the specific risks that we have identified. We protect your personal data against destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed. More specifically, we use HTTPS (Hypertext Transfer Protocol Secure) protocol.

Further, we seek to ensure that we keep your personal data accurate and up to date. In view thereof, we kindly request you to inform us of any changes to your personal data (such as a change in your contact details) so that we can send you for example a reminder for you appointment or your invoice.

9. What are your rights and how you can exercise them?
You have the right to:

• information about and access to your personal data;
• rectify your personal data;
• erasure of your personal data (‘right to be forgotten’);
• restriction of processing of your personal data;
• object to the processing of your personal data;
• receive your personal data in a structured, commonly used and machine readable format and to (have) transmit(ted) your personal data to another organization.

To read more about these rights, and circumstances under which you can use these rights, in particular your right to object, please see the Annex below.

Finally, you have the right to lodge a complaint with the relevant Data Protection Authority (such as the Federal Commissioner with respect to Switzerland), relating to the processing of your personal data by us.

10. Use of cookies and social media plug-ins
We use certain cookies and social media plug-ins on our Website. Some of them are essential to make our Website work, others serve to provide you a better, faster and safer user experience.

Cookies are small pieces of data that are stored on your computer or mobile device via your browser. On our Website we use the following cookies:

Further, we use social media plug-ins. These enable us to recognise you on the basis of your social media profile and to import certain data (such as the identification and contact details or your profile picture). In addition, they enable us to use social media (LinkedIn, Twitter, Facebook) ‘share’ buttons. More information in this respect is to be found in the privacy policy of your social media service. In case you do not wish to establish a connection with your social media profile, please log out before using our Website.

11. How can you manage / delete these cookies?
All major internet browsers offer the option to manage the cookies that were installed on your computer or mobile device.

In case you do not wish that this Website places cookies on your computer / mobile device, you may limit or delete these easily by adjusting you mobile or browser settings. In addition, you can set you mobile or browser settings in such a way that you get a notification every time you receive a cookie on your computer or mobile device, so that you can decide whether you wish to accept this cookie or not.

Please note that when you disable certain cookies of which we are making use, the possibility exists that certain parts of our Website will no longer function properly and you will no longer enjoy an optimal user experience.

12. Contact
If you have any questions, comments or complaints in relation to this Privacy Policy or the processing of your personal data by us, please feel free to contact us at by regular mail at the attention of swiss smile Holding AG atBahnhofstrasse 110, CH-8001 Zurich, Switzerland, or via

datenschutz@swiss-smile.com and/or telephone number +41 43 300 10 01.

Annex

Right to information and right to access your personal data

You may at any time request more information on our processing activities and the personal data that we are keeping from you.

Right to rectification of inaccurate or incomplete personal data

You have the right to require us to , without undue delay, rectify or complete any of your personal data that is inaccurate or incomplete.

Right to deletion of your personal data (‘right to be forgotten’)

You may request us to delete (part of) your personal data in the following situations:

• when the processing is no longer necessary for achieving the purposes for which they we collected or otherwise processed these; or
• when the processing was based on your consent and you have decided to withdraw that consent;
• when you have other reasonable grounds to object to the processing of your personal data;
• when we would unlawfully process your personal data;
• when your personal data have to be erased in compliance with a legal obligation directed to us.

We note that in some case, we may refuse to delete your personal data: (i) for exercising the right of freedom of expression and information; (ii) for compliance with a legal obligation; or (iii) for the establishment, exercise or defence of legal claims.

Right to restriction of processing

You may request us to (temporarily) restrict the processing of your personal data in the following situations:

• when you have contested the accuracy of your personal data, for a period enabling us to verify this accuracy; or
• when the processing appears to be unlawful and you request us the restriction of use of your data instead of the deletion of this data; or
• when we no longer need the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims; or
• pending verification whether our legitimate grounds override yours in the framework of an objection.

Right to object to the processing of your personal data (free of charge)

You may under certain circumstances object to the processing of your personal data, when such processing is based on our “legitimate interests”. If we agree, we will no longer process your personal data, unless we have compelling legitimate grounds to do so, or because such a processing is necessary.

Where we process your personal data for direct marketing purposes, you may at any time object to the processing thereof or withdraw your consent thereto. You also have the right not to be subject to profiling for direct marketing purposes.

Right to data portability

In some cases, you have the right to receive all your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller. This right applies:

• in case the processing is based on consent or on the necessity for the performance of a contract; and
• in case the processing is carried out by automated means.