Privacy policy of Neurozentrum Bern AG
1. What is this privacy policy about?
Neurozentrum Bern AG (hereinafter also “we”, “us”) obtains and processes personal data about you or other people (so-called “third parties”). We use the term “data” here to mean “personal data” or “data about people”.
In this privacy policy we describe what we do with your data when you use our website at https://nzbern.ch (hereinafter referred to as the “website“), use our services, engage with us via a contract, communicate with us or interact with us in any other way. If necessary, we will inform you of additional data processing activities not mentioned in this privacy policy by sending you a timely written notice. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual conditions, additional privacy policies, forms and notices.
If you provide us with data about other people such as family members, work colleagues, etc., we will assume that you are authorized to do so and that this data is correct. By transmitting data via third parties, you confirm this. Please also ensure that these third parties have been informed of this privacy policy.
2. Who is responsible for processing your data?
Under data protection law, Neurozentrum Bern AG, based in Bern, is responsible for the data processing described in this privacy policy, unless otherwise stated in individual cases, e.g. in additional privacy policies, on forms or in contracts.
You can contact us if you have any concerns about data protection and to exercise your rights in accordance with Section 10 as follows:
Neurozentrum Bern AG
Schänzlistrasse 45
CH-3013 Bern
neurozentrum@nzbern.ch
3. What data do we process?
We process different categories of data about you. The most important categories are as follows:
Technical data: When you use our website or other electronic facilities (e.g. free WiFi), we collect the IP address of your device and other technical data to ensure the functionality and security of these facilities. This data also includes logs that record the use of our systems. We generally retain technical data for six months. This period may be longer if this is necessary to comply with legal or contractual requirements or for technical reasons. To ensure the functionality of these facilities, we may also assign you or your device an individual code (e.g. in the form of a cookie, see section 11). The technical data themselves cannot be used to find out your identity. However, data relating to user accounts, registrations, access controls or processing of contracts may be linked to other categories of data (and thus possibly to you personally).
Registration data: Certain facilities and services (e.g. free WiFi access) can only be used with a user account or after registration, which can be done directly with us or via our external login service providers. You will need to provide us with specific information and we will collect information about your use of the facility or service. Registration data may be collected during checks on accessing certain facilities. We usually retain registration data for 12 months after the end of your use of the service or the termination of the user account. This period may be longer if this is necessary to comply with legal or contractual requirements or for technical reasons.
Communication data: If you contact us via the contact form, by email, telephone, letter or other means of communication, we collect the data exchanged between you and us, including your contact details and incidental data relating to the communication. If we want or need to determine your identity, for example when you request information, we collect identification data you (e.g. a copy of an ID card). We generally retain this data for 12 months after the last communication with you. This period may be longer if the data is needed as evidence, to comply with legal or contractual requirements or for technical reasons. Emails and written correspondence are generally retained for at least 10 years.
Master data: We refer to master data as the basic data that we need in addition to the contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes. This includes your name, contact details and information e.g. about your role and function, your bank details, your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person for a business partner), or because we want to contact you for our own purposes or on behalf of a contractual partner (e.g. in the context of marketing and advertising, with invitations to events, newsletters, etc.). We receive master data from you (e.g. when you start the business relationship), from entities you work for, or from third parties such as our contractual partners, associations and from publicly accessible sources such as public registers or the internet (websites, social media etc.). We may also process health data and information about third parties as part of master data. We usually store this data for 10 years from the last communication with you, but at least from the end of the contract. This period may be longer if the data is needed as evidence, to comply with legal or contractual requirements or for technical reasons.
Contract data: This is data that is collected in connection with the conclusion or performance of a contract, e.g. information about contracts and the services that have been or will be provided, as well as data collected prior to conclusion of a contract. This data is used when information is required or used, or for processing and obtaining information about reactions (e.g. complaints, information about satisfaction, etc.). This also includes health data and information about third parties, e.g. about inherited diseases in the family. We generally collect this data from you, from contractual partners and from third parties involved in processing the contract, but also from third-party sources (e.g. public authorities, credit rating providers) and from publicly accessible sources. We usually retain this data for 10 years after the last contractual activity, and at least from the end of the contract. This period may be longer if the data is needed as evidence, to comply with legal or contractual requirements or for technical reasons.
Other data: We also collect data from you in other situations. For example, data is generated in connection with official or judicial proceedings (such as files, evidence, etc.) which may also relate to you. We may also collect data for public health reasons (e.g. as part of public health measures). We may receive or produce photos, videos and audio recordings in which you may be recognizable (e.g. on occasions, etc.). The retention period of this data depends on the purpose and is limited to what is necessary.
You provide us with a lot of the data mentioned in this Section 3 yourself (e.g. via forms, as part of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, except in specific situations, e.g. within the framework of mandatory public health measures (legal obligations). If you want to conclude contracts with us or use our services, you will also have to provide us with data as part of your contractual obligation in accordance with the relevant contract, specifically master, contract and registration data. Using our website inevitably results in the processing of technical data.
Unless this is not permitted, we also obtain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, media or the internet including social media) or receive data from authorities and other third parties.
4. For what purposes do we process your data?
We process your data for the purposes that we explain below. Further information for the online domain can be found in Sections 11 and 12. These purposes and the aims on which they are based represent our legitimate interests and, if applicable, those of third parties. You can find further information on the legal basis for our data processing in Section 5.
We process your data for purposes related to communication with you, in particular to answer inquiries and assert your rights (Section 10) and to contact you if you have any questions. For this purpose, we specifically use communication data and master data in connection with the offers and services you use. We retain this data to document our communications with you, for training purposes, for quality assurance and for information requests.
We process data for the recording, administration and processing of contractual relationships.
We process data for marketing purposes and for relationship management, e.g. to send our customers and other contractual partners personalized advertising about services provided by us or by third parties affiliated with us. This may take place, for example, in the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, or as part of individual marketing campaigns (e.g. events). You can refuse such contacts at any time (see at the end of this section 4) refuse to give consent or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 11).
We also process your data for market research and to improve our services and operations.
We may also process your data for security purposes and for access control.
We process personal data to comply with legislation, orders and recommendations from authorities and with internal regulations (“compliance”).
We also process data for the purposes of our risk management procedures and as part of prudent corporate governance, including business organization and corporate development.
We may process your data for additional purposes, e.g. as part of our internal processes and administration.
5. On what basis do we process your data?
If we ask you to give your consent for a specific form of data processing, we will inform you separately about the purposes of this data processing. You can revoke your consent at any time by sending us a written notice (by post) or, unless otherwise stated or agreed, by email; our contact details can be found in Section 2. Your revocation will continue to have effect for the future. For revocation of your consent for online tracking, see Section 11. As soon as we have received notification of the revocation of your consent, we will no longer process your data for the purposes for which you originally gave your consent, unless we have another legal basis to do so. Revoking your consent will not affect the lawfulness of the data processing carried out based on your consent given before it was revoked.
When we do not ask you for your consent for data processing, we will base the processing of your personal data on the fact that the processing is necessary for the initiation or processing of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in this, in particular in order to pursue the purposes and associated aims described above in section 4 and to be able to take corresponding measures. Our legitimate interests also include compliance with legal requirements, insofar as these are not already recognized as a legal basis under the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and Switzerland). This also includes the marketing of our services, our interest in understanding our markets better and the safe and efficient management and further development of our company, including business operations.
If we receive sensitive data (e.g. health data, information about political, religious or philosophical views or biometric data for identification), we may also process your data on other legal bases, for example the need for data processing in the event of any legal proceedings or the enforcement or defense of legal claims. Other legal reasons may apply in individual cases, and we will communicate these to you separately if necessary.
6. Who do we share your data with?
In connection with our contracts, the website, our services, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in Section 4, we also transmit your personal data to third parties, in particular to the following categories of recipients:
Service providers: We work with service providers at home and abroad who process data about you on our behalf or under joint responsibility with us, or who receive data about you from us under their own responsibility (e.g. IT providers, banks, insurance companies, address verifiers). This may also include health data.
Contractual partners including customers: This refers to our customers and other contractual partners because this data sharing occurs as a result of these contracts. If you work for such a contractual partner yourself, we may also share data about you with them in this context. This may also include health data.
Public authorities: We can pass on personal data to official bodies, courts and other public authorities in Switzerland and abroad if we are legally obliged or authorized to do so or if this appears necessary to protect our interests. This may also include health data. The authorities are responsible for processing data about you that they receive from us.
Other people: This refers to other situations where third parties are involved as a result of the purposes in accordance with Section 4 (e.g. service users).
All of these categories of recipients may in turn involve third parties so that your data may also become accessible to them. We can restrict processing by some third parties (e.g. IT providers), but not by other third parties (e.g. public authorities, banks, etc.).
We reserve the right to disclose this data even if it is confidential data (unless we have expressly agreed with you that we will not pass on this data to certain third parties unless we are legally required to do so). Regardless of this, your data will continue to be subject to appropriate data protection even after disclosure in Switzerland and the rest of Europe. The provisions of Section 8 apply to disclosures in other countries. If you do not want certain data to be shared, please let us know so that we can check whether and to what extent we can accommodate you (Section 2).
We also enable certain third parties to collect personal data about you on our website and at our events (e.g. media photographers, providers of tools that we have integrated on our website, etc.). To the extent that we are not significantly involved in this data collection, these third parties are solely responsible for it. If you have any concerns or want to assert your data protection rights, please contact these third parties directly. See Section 11 regarding the website.
7. Does your personal data also go abroad?
As explained in Section 6, we also disclose data to other parties. These are not only in Switzerland. Your data may therefore also be processed in Europe, but in exceptional cases it may be processed in every country in the world.
If a recipient is located in a country where there is no adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection regulations (for this purpose we use the revised Standard Contractual Clauses from the European Commission, which can be found here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?) unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we are unable to rely on a provision to create an exception. An exception may apply in particular in legal proceedings abroad, but also in cases of overriding public interests or if the execution of a contract requires such disclosure, if you have given your consent or if it concerns data that you have made generally accessible and if you have not objected to processing of this data.
Please also note that data exchanged over the Internet is often routed via third countries. Your data can therefore end up abroad even if the sender and recipient are in the same country.
8. For how long do we process your data?
We process your data for as long as required for our data processing purposes, legal retention periods and legitimate interests in processing for documentation and evidence, or for as long as storage is required for technical reasons. Further information on the respective storage and processing periods can be found under the individual data categories in Section 3 or for the cookie categories in Section 11. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the end of the storage period or processing period as part of our usual processes.
9. How do we protect your data?
We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, accidental alteration, unwanted disclosure or unauthorized access.
10. What rights do you have?
You have the right under data protection law to object to the processing of your data under certain circumstances, particularly processing for direct marketing purposes and based on other legitimate interests in processing.
To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing under the applicable data protection law:
The right to request information from us on whether we process data about you and what data we process about you;
The right to have us correct data if it is inaccurate;
The right to request deletion of data;
The right to ask us to release certain personal data in a common electronic format or to transfer it to another person responsible;
The right to revoke your consent, to the extent that our processing is based on your consent;
The right to request further information that is needed to exercise these rights.
If you wish to exercise the above-mentioned rights in relation to us, please contact us in writing, at our offices or, unless otherwise stated or agreed, by email; our contact details can be found in Section 2. To prevent misuse, we must be able to identify you (e.g. with a copy of your ID, unless this is possible otherwise).
Please note that these rights are subject to preconditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly if necessary.
You also have the same rights in relation to other bodies that work with us under their own responsibility. Please contact them directly if you wish to exercise your rights in relation to data processing by them. Information about our main cooperation partners and service providers can be found in Section 7, and there is further information in Section 12.
If you do not agree with our handling of your rights or data protection, please let us know (Section 2). In particular, if you are located in the EEA, the UK or Switzerland, you also have the right to complain to your country’s data protection supervisory authority.
11. Do we use online tracking and online advertising techniques?
We use various techniques on our website that allow us and third parties engaged by us to recognize you when you use it and under certain circumstances to track you across multiple visits. In this section we will inform you about this.
Essentially we need to be able to distinguish between access by you (via your system) and access by other users so that we can ensure the functionality of the website and carry out evaluations and personalization. We do not wish to find out your identity, even if we are able to do so, in situations where we or third parties we engage can identify you using the combination with registration data. Even without registration data, the technologies used are designed in such a way that you are recognized as an individual visitor each time you access the page, for example by our server (or the servers of third parties) assigning a specific identification number (so-called “cookie”) to you or your browser.
We use these techniques on our website and allow certain third parties to do the same. You can program your browser so that it blocks certain cookies or alternative technologies, gives misleading responses or deletes existing cookies. You can also enhance your browser by adding software that blocks tracking by certain third parties. Further information can be found on the help pages of your browser (usually under the keyword “data protection”) or on the third-party websites that we list below.
A distinction is made between the following cookies (techniques with comparable functions such as fingerprinting are included here):
Necessary cookies: Some cookies are necessary for the website to function as such or for certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you stay logged in. These cookies only exist temporarily (“session cookies”). If you block them, the website may not work. Other cookies are necessary to allow the server to store decisions or entries you make across more than one session (i.e. visit to the website) if you use this function (e.g. selected language, consent, automatic login function, etc.) . These cookies have an expiry date of up to 24 months.
Performance cookies: In order to optimize our website and corresponding facilities and tailor them to meet the needs of users better, we use cookies to record and analyze the use of our website, in some cases beyond a single session. We do this by using third-party analysis services. We have listed these below. Performance cookies also have an expiry date of up to 24 months. Details can be found on the third-party websites.
Marketing cookies: We and our advertising contractual partners have an interest in controlling advertising to specific target groups, i.e. if possible, only showing an advertisement to those we wish to address. We have listed our advertising contract partners below. For this purpose, we and our advertising contract partners – if you consent – also use cookies that allow recording of the content accessed or contracts concluded. This enables us and our advertising partners to display advertising that we believe will interest you on our website, but also on other websites that display advertising from us or our advertising partners. Depending on the situation, these cookies have an expiry period of a few days to 12 months. If you agree to the use of these cookies, you will be shown corresponding advertising. If you do not consent to these cookies, you will not see less advertising, but you will simply see different advertising.
We may also include other facilities provided by third parties on our website, in particular from social media providers. These facilities are disabled by default. As soon as you activate them (e.g. by clicking a switch), the relevant providers can see that you are on our website. If you have an account with the social media provider, they can assign this information to you and thus track your use of online offerings. These social media providers process this data under their own responsibility. We currently use facilities from the following service providers and advertising contract partners (insofar as they use your data or cookies sent to you to control advertising):
Google Analytics: Google Ireland (based in Ireland) is the provider of the “Google Analytics” service and acts as our Google Ireland relies on Google LLC (based in the USA) as its order processor (both “Google“). Google tracks the behavior of visitors using performance cookies (see above) on our website (duration, frequency of pages accessed, geographical origin of access, etc.) and creates reports for us on the use of our website on this basis. We have configured the service so that the IP addresses of visitors to Google in Europe are truncated before being forwarded to the USA and therefore cannot be traced back. We have turned off the “Data sharing” and “Signals” settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google may find out the identity of visitors from this data for its own purposes, create personal profiles and link the data to the Google accounts of these people. If you agree to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (in particular website and app usage data, device information and individual IDs) to the USA and other countries. Information about Google Analytics data protection can be found here [https://support.google.com/analytics/answer/6004245] and if you have a Google account, You can find further information about processing by Google here [https://policies.google.com/technologies/partner-sites?hl=de].
Google Maps: We incorporate the maps from the “Google Maps” service provided by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.
Google Fonts: We incorporate the fonts (“Google Fonts”) from the provider Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.
Google Recaptcha: We include the function for detecting bots, e.g. when making entries in online forms (“ReCaptcha”) from the provider Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA . Privacy Policy: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.
12. Can this privacy policy be changed?
This privacy policy does not form part of a contract with you. We can update this privacy policy at any time. The version published on this website is the current version.
Last updated: March 7, 2024