Privacy Notice pursuant to Art. 13 of Regulation (EU) 2016/679
With this document (“Privacy Notice”) the Data Controller, as defined below, wishes to inform you about the purposes and methods of the processing of your personal data and about the rights granted to you under the Swiss Federal Act on Data Protection (“FADP”) and Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Privacy Notice may be supplemented by the Data Controller where any additional services requested by you entail further processing.
Data Controller
GK Investment Holding SA
Registered office: Via Marconi, 2 – 6900 Lugano, Switzerland
Business Identification Number (UID): CHE-116.192.242
E-mail: info@gkinvest.com – Tel. +41 844 001 111
as Data Controller of the personal data collected through the website https://gkinvest.com/ (the “Website”), in the person of its legal representative pro tempore.
Types of data processed
The processing activities carried out are aimed at acquiring the following personal data:
- Identification data (e.g. name, surname, date of birth, address);
- Contact details (e.g. telephone, e-mail);
- Data voluntarily provided by completing the “Get in touch” contact form on the Website (e.g. name, surname, e-mail, any telephone number and company/organisation, subject and content of the request);
- Technical and browsing data (e.g. IP addresses, domain names of computers);
- Subject to the user’s consent, data acquired through cookies having functionalities other than the strict operation of the website.
Categories of data subjects
The processing activities carried out are addressed to the following categories of data subjects: Website Users and Visitors, Potential Clients, Clients
Purposes, Legal Basis and Retention Periods
|
Purpose |
Legal Basis |
Retention Period |
A) The processing of data is essential to ensure the proper functioning and usability of the website by users. By way of example and without limitation, such activity may include session management, traffic monitoring aimed at optimising the website’s performance, ensuring adequate response times and resolving any system errors. |
Common data
The processing is necessary for the pursuit of the legitimate interest of the Data Controller. Pursuant to Art. 6(1)(f) GDPR; corresponding justification based on the Data Controller’s overriding interest under Art. 31 FADP, in compliance with the principles of Art. 6 FADP. |
For the duration of the browsing session or in any case for a period strictly necessary to pursue the purpose (save for any need to investigate offences by the judicial authority). |
B) The processing is necessary for the use of cookies and other similar technologies. For further information please refer to the Cookie Policy accessible from the footer of the website. |
Common data
For cookies other than technical ones strictly functional to the operation of the website, the processing is based on consent. Pursuant to Art. 6(1)(a) GDPR; consent under Art. 6(6) FADP.
For further details on the use of these technologies and to manage cookie settings, please refer to the Cookie Policy. |
For further details on the use of these technologies and to manage cookie settings, please refer to the Cookie Policy. |
Processing activities beyond the browsing purposes:
Purpose |
Legal Basis |
Retention Period |
C) The processing of data is necessary to respond to requests for information, collaboration or contact sent by the user through the “Get in touch” form on the Website, as well as to manage the related correspondence. |
Common data
The processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. Pursuant to Art. 6(1)(b) GDPR; corresponding justification under Art. 31 FADP.
Where the request is not aimed at entering into a contract, the processing is based on the legitimate interest of the Data Controller in responding to the requests received. Pursuant to Art. 6(1)(f) GDPR; corresponding justification based on the Data Controller’s overriding interest under Art. 31 FADP, in compliance with the principles of Art. 6 FADP. |
For the time strictly necessary to handle the request and manage the related correspondence. In the absence of the establishment of a contractual relationship, the data are retained for a maximum period of 24 months from the last contact, save for different legal obligations or needs for the defence in legal proceedings. |
D) The processing of data is necessary for the establishment, exercise or defence of the Data Controller’s rights in legal proceedings, as well as for the exercise of debt-recovery actions against the data subject. |
Common data
Pursuit of the legitimate interest of the Data Controller. Pursuant to Art. 6(1)(f) GDPR; corresponding justification based on the Data Controller’s overriding interest under Art. 31 FADP, in compliance with the principles of Art. 6 FADP.
Special categories of data
Establishment, exercise or defence of a legal claim. Pursuant to Art. 9(2)(f) GDPR; sensitive personal data under Art. 5(c) FADP, processed for the establishment, exercise or defence of a legal claim (Art. 31 FADP).
|
For the entire duration of the dispute, until expiry of the time limits for bringing appeals. |
E) The processing is necessary to manage data subjects’ requests to exercise their rights pursuant to Arts. 15 et seq. GDPR. |
Common data
Compliance with a legal obligation to which the Data Controller is subject. Pursuant to Art. 6(1)(c) GDPR; processing required by law as a justification under Art. 31 FADP. |
The data will be retained for a maximum of 5 years from the request (save for disputes). |
Processing Methods
The processing of data is carried out by electronic means. Pursuant to the FADP, the processing is carried out in compliance with the principles of lawfulness, good faith and proportionality (Arts. 6 et seq. FADP).
Transfer of data outside the EU
The Data Controller is established in Switzerland, a third country in relation to the European Union for which the European Commission has recognised an adequate level of protection of personal data (adequacy decision pursuant to Art. 45 GDPR). Your Personal Data are therefore processed in Switzerland and, where necessary, within the European Union and the European Economic Area.
Any transfers of Personal Data to third countries other than Switzerland will take place only where:
- there is an adequacy decision adopted by the European Commission or the Swiss Federal Council with regard to the country of destination (Art. 16(1) FADP);
- in the absence thereof, appropriate safeguards are in place, such as Standard Contractual Clauses, pursuant to Art. 46 GDPR and Art. 16(2) FADP;
- or one of the derogations set out in Art. 49 GDPR and Art. 17 FADP applies.
Recipients of the processing
Personal data may be shared with service providers strictly related and functional to the Data Controller’s activities, who typically act as processors pursuant to Art. 28 GDPR and Art. 9 FADP. The full list may be obtained by contacting the Data Controller at the addresses indicated above.
Data Subject Rights – complaint to the supervisory authority
In relation to the processing described in this Privacy Notice, as a data subject you may, under the conditions provided for by the GDPR, exercise the rights set out in Articles 15 to 22 GDPR, as well as the corresponding rights provided for in Arts. 25 et seq. FADP, and in particular the following rights:
- right of access – Article 15 GDPR (corresponding to Art. 25 FADP): the right to obtain confirmation as to whether or not personal data concerning you are being processed and, in that case, to obtain access to your personal data;
- right to rectification – Article 16 GDPR (corresponding to Art. 32(1) FADP): the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
- right to erasure (right to be forgotten) – Article 17 GDPR (corresponding to Art. 32(2)(c) FADP): the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise or defence of a legal claim.
- right to restriction of processing – Article 18 GDPR (cf. Art. 32 FADP): the right to obtain restriction of processing where: a) the data subject contests the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use; c) the personal data are needed by the data subject for the establishment, exercise or defence of a legal claim; d) the data subject has objected to the processing pending verification as to whether the legitimate grounds of the Data Controller override those of the data subject.
- right to data portability – Article 20 GDPR (corresponding to Art. 28 FADP): the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you provided to the Data Controller, and the right to transmit them to another controller without hindrance, where the processing is based on consent and carried out by automated means. In addition, the right to have your personal data transmitted directly from this controller to another controller where technically feasible;
- right to object – Article 21 GDPR (cf. Art. 32 FADP): the right to object, at any time, to the processing of personal data concerning you based on legitimate interest, including profiling, unless the Data Controller has compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of a legal claim.
- right not to be subject to automated decision-making – Article 22 GDPR (corresponding to Art. 21 FADP): the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless it is necessary for entering into or performing a contract or you have given your consent. In any event, no automated decision-making will concern your personal data and you may at any time obtain human intervention on the part of the Data Controller, express your point of view and contest the decision.
- right to lodge a complaint to the competent data protection supervisory authorities (in Switzerland, the Federal Data Protection and Information Commissioner – FDPIC, www.edoeb.admin.ch; for data subjects in the European Union, the supervisory authority of their State of residence, for example in Italy the Garante per la protezione dei dati personali: http://www.garanteprivacy.it;
- to withdraw consent given on each occasion and as easily as it was given, without affecting the lawfulness of processing based on consent given before its withdrawal (Art. 6(6) FADP).
The above rights may be exercised vis-à-vis the Data Controller by contacting the references indicated above.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, including due to their repetitive character, the Data Controller may charge a reasonable fee taking into account the administrative costs of handling your request, or refuse to act on the request.
Finally, please note that the Data Controller may request further information necessary to confirm the identity of the data subject.
