General Privacy Policy.

1. Scope

This privacy policy provides information on how timeSensor AG processes personal data when you visit our Swiss websites, in particular timesensor.ch and the associated language versions, or use the functions offered there.

It applies exclusively to our websites and the associated online offers. Personal data that timeSensor AG processes on behalf of its customers within the framework of timeSensor LEGAL 365 is subject to the respective contractual agreements and is not the subject of this privacy policy.

The Swiss Federal Act on Data Protection (FADP) applies primarily to the processing of personal data. Insofar as the European Union's General Data Protection Regulation (GDPR) is applicable, we additionally take its requirements into account.

2. Responsible Body

The body responsible for the processing of personal data on this website is:

timeSensor AG Zugerstrasse 76A 6340 Baar Switzerland

Email: datenschutz@timesensor.ch Website: https://www.timesensor.ch

3. Data Protection Representation in the European Union

Insofar as the GDPR is applicable, our data protection representative according to Art. 27 GDPR is an additional point of contact for data subjects and supervisory authorities in the European Union:

InfiniSafe GmbH Richard-Strauss-Strasse 71 D-81679 Munich Germany Email: datenschutz@infinisafe.de

4. Principles of Data Processing

We process personal data only to the extent necessary for the operation of our website, the processing of inquiries, the arrangement and implementation of demo appointments, the sending of our newsletter, communication with interested parties and customers, and for the improvement of our online offer.

In doing so, we particularly observe the principles of lawfulness, proportionality, purpose limitation, transparency, data accuracy, and data security. We take appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, and unauthorized disclosure.

5. Hosting and Server Log Files

Our website is hosted by ah,ja! Andi Jacomet, Monbijoustrasse 27, 3011 Bern, Switzerland. According to the hosting provider, the servers used and the independent backups are located in Switzerland. Contractual agreements exist with the hosting provider to protect the processed data.

When you access our website, the web server automatically records technical information required for the provision, stability, and security of the website. This may include the following data in particular:

• IP address of the accessing device
• Date and time of access
• Accessed page or file
• Referrer URL
• Browser type and browser version
• Operating system used
• Hostname of the accessing device
• Amount of data transferred and access status

This data is processed for the technical provision of the website, for the detection and defense against attacks, for error analysis, and to ensure stable operation. A merger with other data sources does not generally take place, unless this is necessary to clarify a security incident.

Log data is only stored for as long as is necessary for secure operation, error analysis, and the clarification of any security incidents. Insofar as the GDPR is applicable, processing is based on our legitimate interest in a secure and functional website in accordance with Art. 6 Para. 1 lit. f GDPR.

6. Encrypted Data Transmission

Our website uses TLS encryption. This protects data transmitted between your browser and our web server against unauthorized reading during transmission. You can usually recognize an encrypted connection by the address starting with https:// and the lock symbol in the address bar of your browser.

7. Cookies and Similar Technologies

Our website uses cookies and comparable technologies. Cookies are small files that are stored on your end device or can read information from your end device.

We use technically necessary cookies to ensure basic functions, security, and a reliable display of the website. In addition, cookies and similar technologies can be used for reach measurement, statistical evaluations, and the display of external content.

For the cookies and services described here, no prior consent is generally required under Swiss law. However, in accordance with Art. 45c lit. b of the Swiss Telecommunications Act, we inform you about the processing, its purpose, and your option to refuse processing. You can block cookies in whole or in part in your browser settings, delete cookies already stored, or use the cookie settings offered on our website. If you deactivate cookies, individual functions of the website may be restricted.

Different requirements may apply for access to websites that are explicitly directed at persons in the European Union or the European Economic Area.

8. Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager helps us to manage website tags centrally and to integrate other services technically.

Google Tag Manager itself does not create its own evaluations of the behavior of website visitors. However, when the service is accessed, technical connection data, in particular the IP address, may be transmitted to Google. The Google services described below can be triggered via Google Tag Manager.

Further information can be found in Google's privacy policy.

9. Google Analytics 4

We use Google Analytics 4, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us understand how our website is used. For this purpose, the following information in particular can be processed:

• Accessed pages and content
• Time, duration, and approximate region of a visit
• Interactions such as clicks and scrolling movements
• Origin of a visit, for example via a search engine or a linking website
• Technical information about the browser, operating system, device, and screen size
• Randomly generated online identifiers and cookie identifiers

According to Google, IP addresses of users from Switzerland and the European Union are not logged or stored. The IP address is used to derive an approximate geographical region and is then discarded.

We use the information obtained to statistically evaluate the reach and use of our website, to improve content, and to identify technical or design problems. We do not use Google Analytics to directly identify individual visitors.

You can refuse processing by Google Analytics by using the corresponding cookie settings on our website, blocking or deleting cookies in your browser, or installing the browser add-on to deactivate Google Analytics.

Insofar as the GDPR is applicable and no consent is required by law, we base the processing on our legitimate interest in the statistical evaluation and improvement of our website in accordance with Art. 6 Para. 1 lit. f GDPR. Insofar as applicable law requires consent, processing is based on Art. 6 Para. 1 lit. a GDPR.

We have concluded the data processing agreements provided for the service with Google. Google may also process data in the United States and other countries. Further information on how Google uses data from websites can be found under Google's information on data use.

10. YouTube

On individual pages, we embed videos from the YouTube platform. The provider for users in Switzerland and the European Economic Area is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. YouTube is a service of the Google group of companies.

When you access a page with an embedded YouTube video, a connection to the servers of YouTube and Google is established. In particular, your IP address, information about the browser and device, the page accessed, date and time, and information about your interaction with the video may be transmitted. YouTube or Google may use cookies or comparable technologies.

If you are logged into your Google or YouTube account at the same time, Google can assign the visit and your interactions to your account. You can reduce this by logging out of your Google or YouTube account before visiting our website and configuring your browser's cookie settings accordingly.

We embed YouTube videos to clearly explain product functions and other content. Insofar as the GDPR is applicable and no consent is required by law, the processing is based on our legitimate interest in a clear and user-friendly presentation of our content in accordance with Art. 6 Para. 1 lit. f GDPR. Insofar as applicable law requires consent, processing is based on Art. 6 Para. 1 lit. a GDPR.

Further information can be found in Google's privacy policy.

11. Demo Appointments via Zoho Bookings

We use Zoho Bookings to arrange a personal presentation. The service is provided by the Zoho group of companies. The contact person for data protection issues in Europe is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands.

When you book an appointment via "book a demo", we process exclusively the information that you enter yourself in the booking form, as well as the information required for the organization of the appointment. This may include in particular:

• Law firm or company name
• First name and last name
• Postal code and city
• Email address
• Telephone number
• Desired date and time zone
• Your message and voluntary additional information

We use this data to organize your appointment, prepare the requested presentation, contact you, and process any pre-contractual questions. The provision of the information marked as mandatory fields is necessary so that we can process your appointment. Use for newsletters or other promotional emails only takes place if you have separately consented to this or if there is another legal basis.

Zoho additionally processes technical data that may arise when accessing and using the booking service. This includes, for example, IP address, browser and device information, date and time, as well as usage and log data. We have only limited influence on this technical processing by Zoho.

The data you enter remains stored for as long as is necessary for the processing of your inquiry, the implementation of the demo appointment, and the subsequent communication. If a contract is concluded or if data is part of business-relevant correspondence, longer statutory retention periods may apply.

Zoho may process personal data within the Zoho group of companies as well as through engaged sub-processors in the European Union, the United States, and other countries. According to Zoho, suitable contractual data protection guarantees are used for this. Further information can be found in Zoho's privacy policy.

Insofar as the GDPR is applicable, the processing of the data you enter is carried out to implement pre-contractual measures at your request in accordance with Art. 6 Para. 1 lit. b GDPR. Insofar as processing is additionally required for the organization and security of the service, it may be based on our legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR.

12. Newsletter via Mailchimp

You can subscribe to our newsletter to receive information about our products, services, events, webinars, and news from timeSensor AG. The newsletter is only sent to persons who have registered for it and consented to its receipt.

For registration and sending, we use Mailchimp, a service of The Rocket Science Group LLC d/b/a Mailchimp, 675 Ponce De Leon Avenue NE, Suite 5000, Atlanta, GA 30308, USA. Mailchimp processes the data on our behalf insofar as this is necessary for the management of the recipient list, the sending, and the evaluation of the newsletter.

When registering, the following data in particular can be processed:

• Email address
• Voluntary information such as first name, last name, company, language, or interests
• Time, source, and technical status of the registration
• IP address and other technical log data

Proof of consent given

Registration takes place with your express consent. To verify the registration and to document the consent, we can send you a confirmation email with a personal link. In this so-called double opt-in procedure, the registration is only completed when you click the link. Mailchimp supports both single opt-in and double opt-in. Before starting the newsletter registration, we determine the procedure actually used and configure it accordingly.

Success and Reach Measurement

Our newsletters sent with Mailchimp contain technologies for measuring opens and clicks. When opening an HTML newsletter, a small, invisible image, a so-called web beacon or tracking pixel, can be loaded from a Mailchimp server. Links in the newsletter can be designed as individual tracking links.

This allows delivery, non-delivery, opening, time of opening, clicked links, time of click, as well as technical information such as IP address, browser, device, or email program to be recorded and assigned to the respective recipient profile. We use this information to evaluate the reach and use of our newsletters and to improve content and sending times. The evaluation may be technically inaccurate, for example if an email program loads or blocks images automatically.

Insofar as the GDPR is applicable, the sending of the newsletter and the personalized success and reach measurement are based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR. The consent text during registration informs about the success and reach measurement used. You can deactivate the automatic loading of external images in your email program. Clicks on links designed as tracking links can still be recorded.

Unsubscribe and Storage Period

You can revoke your consent at any time with effect for the future and unsubscribe from the newsletter via the unsubscribe link in each message or by notifying datenschutz@timesensor.ch. After unsubscribing, you will not receive any further newsletters. Necessary notifications within the framework of a contractual relationship remain unaffected by this.

After unsubscribing, we can store the email address in a blocklist so that no further newsletters are sent to this address. We can keep proofs of registration and consent for as long as this is necessary to fulfill legal obligations or to defend against claims. Other newsletter data will be deleted or anonymized when it is no longer needed for the stated purposes.

Mailchimp may process personal data in the United States and other countries. According to Mailchimp, the group of companies is certified under the Swiss-U.S. Data Privacy Framework. In addition, Mailchimp's data processing addendum provides adapted standard contractual clauses for transfers from Switzerland. Further information can be found in Mailchimp's privacy information and in the data processing addendum.

13. Contacting us by Email or Telephone

If you contact us by email or telephone, we process the information you provide to answer your inquiry and to conduct further communication with you. This includes in particular your contact details, the content of your message, and any documents or information that you voluntarily transmit to us.

The data is only stored for as long as is necessary to process the inquiry. Statutory retention obligations and the storage of business-relevant correspondence remain reserved. Insofar as the GDPR is applicable, processing takes place depending on the content of the inquiry on the basis of Art. 6 Para. 1 lit. b or lit. f GDPR.

14. Recipients and Processors

We only pass on personal data if this is necessary for the purposes described in this privacy policy, if there is a legal obligation, or if you have consented to the disclosure.

Possible recipients include in particular:

• Hosting and IT service providers
• Providers of analysis and statistics services
• Providers of embedded media content
• Providers of appointment booking and communication services
• Providers for newsletter sending and reach measurement
• Advisors and authorities, insofar as there is a legal obligation or a legitimate reason

Commissioned service providers may only process personal data for the agreed purposes and within the framework of the contractual and legal requirements.

15. Disclosure of Personal Data Abroad

Individual service providers, in particular Google, Zoho, and Mailchimp, may process personal data outside of Switzerland or pass it on to companies in other countries. This may also include countries whose data protection law does not guarantee an adequate level of data protection from a Swiss perspective.

In such cases, we base the disclosure on an adequacy decision, on the certification of the receiving organization under a recognized data protection framework, or on suitable guarantees, in particular recognized standard data protection clauses. Insofar as necessary, additional technical or organizational protective measures are taken.

Further information on the guarantees used can be requested via datenschutz@timesensor.ch.

16. Storage Period

We store personal data only for as long as is necessary for the respective processing purpose. In addition, we may store data if this is necessary to fulfill statutory retention obligations, to assert or defend against legal claims, to ensure IT security, or to document granted or rejected settings.

Subsequently, the data is deleted or anonymized, insofar as there is no legal or contractual obligation for further storage. Data in backup copies is removed within the framework of the planned deletion cycles.

17. Your Rights

Within the framework of the applicable data protection law, you can assert the following rights in particular:

• Information about the personal data processed by us
• Correction of incorrect or incomplete data
• Deletion of personal data, insofar as no retention obligation or other legal basis stands in the way
• Restriction of or objection to certain data processing, insofar as the applicable law provides for this
• Handover or transfer of certain personal data in a common electronic format
• Revocation of a granted consent with effect for the future

To exercise your rights, you can contact us at datenschutz@timesensor.ch. We may request suitable proof of your identity to protect personal data from unauthorized disclosure.

Data subjects can also contact the Federal Data Protection and Information Commissioner (FDPIC). Insofar as the GDPR is applicable, there is also the right to complain to a competent data protection supervisory authority in the European Union.

18. Automated Individual Decisions

In connection with the use of this website, we generally do not make any exclusively automated individual decisions that have legal consequences for you or significantly affect you in a comparable way.

19. Changes to this Privacy Policy

We may adapt this privacy policy if our website, the services used, or the legal requirements change. The current version published on this website applies in each case.

As of September 2026