Data protection

Version 1.1 - February 11, 2025

Privacy policy

This privacy policy ("Privacy policy") explains how we process and protect your personal data when you use this website or our services offered via https://www.odcus.com/ (together "our services„).

The website is operated by ODCUS AG, Grabenstrasse 15a, 6340 Baar, Switzerland (the "The company", the "Company", "we„, „our" or "us") is operated. The company is the controller for the data processing described below.

Unless otherwise defined in this Privacy Policy, the definitions used in this Privacy Policy have the same meaning as in the Swiss Federal Act on Data Protection ("DSG") or in the EU General Data Protection Regulation ("GDPR").

1. personal data that we collect

When you use our services, we may collect or receive personal data for a number of purposes in connection with our business operations. This includes the following:

• Usage and analysis data (e.g.: identifiers, number of clicks, tracking data)
• Contact details (e.g.: name, address, telephone number, date of birth)
• Payment data (e.g.: billing information, account information)
• Request details (e.g.: details and content of your requests to us)
• Website visitor data (e.g.: IP address, log files, device ID)

There is no obligation to provide your personal data. However, please note that our services cannot be provided if you do not provide the required data that is absolutely necessary for the fulfillment of the contract between you and us.

2. how we collect personal data

We collect information about our users when they use our services, including certain actions on our website.

Direct

• About our website and electronic communication
• When you make use of our services
• When you provide us with services
• If you correspond with us electronically
• When you browse, fill in a form or make an inquiry when using our services

Indirect

• Through public sources
• From public registers (e.g. commercial registers), news articles and internet searches
• When our business clients engage us to provide professional services and share personal data that they control as part of that engagement
• From external service providers

3. legal bases and purposes of data processing

Our legal basis for collecting and using the personal information described in this Privacy Policy depends on the personal information we collect and the specific purposes for which we collect it.

ContractTo fulfill our (pre-)contractual obligations or to take measures in connection with a contract with you. In particular:

• To support you with inquiries
• In order to provide our services

ConsentWe may rely on your voluntary consent given at the time of providing your personal data. In particular:

• To analyze, improve and personalize the use of our services and communication with us
• To set optional cookies and similar technologies on your end device

Legitimate interestsWe may rely on legitimate interests based on our assessment that the processing is fair and proportionate and does not override your interests or fundamental rights and freedoms. In detail:

• To set technically necessary cookies and similar technologies on your end device
• To develop new services
• To maintain and improve our services and to prevent, find and address security vulnerabilities

Necessity to comply with legal obligations: To fulfill legal obligations and obligations in the public interest. In particular:

• To inform you about changes to our services and our privacy policy
• To comply with the applicable regulations and laws
• For the legal enforcement of claims and rights

4. storage periods

We retain personal data for as long as it is needed for the purposes for which it was collected and in accordance with legal and regulatory requirements or contractual agreements. After this period has expired, we delete your personal data or anonymize it completely.

5. recipients of personal data

We commission third-party companies ("Service provider") to facilitate the operation of our services, to help analyze the use of the services or to provide necessary services such as payment and the provision of IT services. These third parties will only have access to your personal data to the extent necessary to perform these tasks.

Type(s) of service provider(s) that may access your personal data:

• Specialist consultants we use such as accountants, auditors and lawyers
• Third parties that we engage in the course of providing our services to you, such as consultants, banks and other payment service providers, KYC/AML service providers and postal and courier services
• Third parties who support us with IT and software solutions
• Third parties who support us in gaining customer insights and marketing activities

6. data transfers to third countries

We and/or our service providers may transfer your personal data to the following locations and process it there:

• EU and EEA
• USA

We may use service providers that are partly located in so-called third countries (outside the European Union or the European Economic Area or Switzerland) or process personal data there, i.e. in countries whose level of data protection does not correspond to that of the EU or Switzerland.

We protect your personal data in accordance with our contractual obligations and the applicable data protection laws when we transfer data abroad.

Such protective measures may include

• Transfers to countries that offer an adequate level of protection according to the Federal Council and countries for which an adequacy decision has been issued by the European Commission
• Application of standard contractual clauses, binding corporate rules or other standard contractual obligations that ensure adequate data protection

If a transfer to a third country takes place and there is no adequacy decision or suitable guarantees, it is possible and there is a risk that authorities in the third country (e.g. intelligence services) may gain access to the transferred data and that the enforceability of the data subject's rights cannot be guaranteed.

6.1 Google Analytics

On our websites we use Google Analytics, a web analytics service provided by Google Ireland Limited (https://www.google.de/intl/de/about/) (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter referred to as "Google"). In this context, pseudonymized user profiles are created and cookies (see "Cookies") are used. The information generated by the cookie about your use of this website such as

1. Browser type/version,
2. operating system used,
3. Referrer URL (the previously visited page),
4. Host name of the accessing computer (IP address),
5. Time of the server request,

are transmitted to a Google server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and the needs-based design of this website. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data. The IP addresses are anonymized so that they cannot be assigned (IP masking).

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

These processing operations are only carried out if express consent is given in accordance with Art. 6 para. 1 lit. a GDPR.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on the following link: Deactivate Google Analytics. An opt-out cookie is set to prevent the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.

Further information on data protection in connection with Google Analytics can be found in the Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=de).

7. data transfer

We may disclose your personal data if we believe in good faith that such action is necessary:

• To comply with a legal obligation (i.e. where required by law or in response to legitimate requests from public authorities, such as a court or government agency)
• To protect the security of the website and defend our rights or property
• To prevent or investigate possible misconduct in connection with us

8. data security

We use appropriate technical and organizational security measures to protect your stored data from manipulation, loss or unauthorized access by third parties. Our security measures are continuously adapted in line with technological developments.

We also take internal data protection very seriously. Our employees and the service providers commissioned by us are obliged to maintain confidentiality and to comply with the applicable data protection laws. Furthermore, they are only given access to personal data to the extent that this is necessary for the fulfillment of their respective tasks or assignments.

The security of your Personal Data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% % secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. We recommend that you use anti-virus software, a firewall and other similar software to protect your system.

9. your rights

You have the following data protection rights. To exercise these rights, you can contact us at the above address or send an e-mail to contact@www.odcus.com. Please note that we may ask you to verify your identity before responding to the content of such requests.

• Right to informationYou have the right to request a copy of your personal data, which we will provide to you in electronic form.
• Right to rectificationYou have the right to ask us to correct our records if you believe they contain incorrect or incomplete information about you.
• Right to withdraw consent: If you have consented to the processing of your personal data, you have the right to withdraw this consent with effect for the future. This also applies if you wish to unsubscribe from marketing communications. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose(s) to which you originally consented, unless there is another legal basis for the processing.
• Right to erasure: You have the right to request that we delete your personal data if it is no longer required for the purposes for which it was collected or if it has been processed unlawfully.
• Right to restriction of processing: You have the right to request the restriction of the processing of your personal data if you believe that the data is incorrect, the processing is unlawful or we no longer need to process the data for the original purpose, but we cannot delete it due to a legal obligation or because you do not wish us to do so.
• Right to data portabilityYou have the right to request that we transfer your personal data to another controller in a standard format such as Excel, provided that it is data that you have provided to us and we process it on the legal basis of your consent or to fulfill our contractual obligations.
• Right to object to the processing: If the legal basis for the processing of your personal data is our legitimate interest, you have the right to object to this processing on grounds relating to your particular situation. We will comply with your request unless we have a compelling legal basis for the processing which overrides your interests or we need to continue processing the personal data for the exercise or defense of a legal claim..
• Right to lodge a complaint with a supervisory authorityYou have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. In the EU and EEA, for example, you can assert this right with a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement. You can find a list of the relevant authorities at https://edpb.europa.eu/about-edpb/about-edpb/members_de. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner, Feldeggweg 1, CH - 3003 Bern, info@edoeb.admin.ch.

10. social media and links to third-party apps and websites

Our services contain links to websites or apps that are not operated by us. If you click on a third-party link, you will be directed to that third-party website or app. We have no control over the content, privacy policies or practices of third party websites or services.

We maintain online presences in social networks in order to communicate with customers and interested parties and to provide information about our products and services. If you have an account with the same network, it is possible that the information and media you make available there can be seen by us when we access your profile, for example. In addition, the social network may allow us to contact you. As soon as we transfer personal data to our own system, we are independently responsible for this. This is then done to carry out pre-contractual measures and to fulfill a contract. The legal basis for the data processing carried out by the social networks under their own responsibility can be found in their data protection declarations. Below is a list of social networks on which we have an online presence:

• LinkedIn: Privacy policy
• YouTube: Privacy policy

11. changes to this privacy policy

We may update our privacy policy from time to time. We therefore recommend that you check this privacy policy regularly for changes.

Changes to this Privacy Policy will become effective when they are posted on this page.

12. contact us

If you have any questions about this privacy policy, please do not hesitate to contact us:

ODCUS AG,

Grabenstrasse 15a, 6340 Baar, Switzerland,

contact@odcus.com.