Data Protection Notice of SUNSTAR Europe SA

1. What is this Data Protection Notice about?

The SUNSTAR Group (also "we" and "us") collects and processes personal data concerning you and other individuals ("third parties"). We use the word "data" here interchangeably with "personal data."

The "SUNSTAR Group" includes SUNSTAR Europe S.A., Route de Pallatex 11, 1163 Etoy, Switzerland, its parent company, its subsidiaries, and other Sunstar entities. A list of these can be found here

In this Data Protection Notice, we describe how we process your data when you visit and search our customer sites, such as https://www.sunstargum.com and our other websites (collectively described as "website"), when you obtain services or products from us, interact with us about a contract, communicate with us, or otherwise contact us.

2. Who has access to SUNSTAR’s customer data and why?

For the other purposes in Section 4, we may disclose your personal data to other companies, including group affiliates (2.1), e-commerce companies, and other service providers (2.2).

2.1. Intragroup data sharing

SUNSTAR Europe S.A. in Switzerland is the primary receiver of your data and is thus primarily responsible as a data controller for processing it under this Data Protection Notice.

Playbrush will share personal data with other group companies for specific business processes outlined in this section.

We reserve the right to inform you otherwise if a deviation from the following data-sharing principles applies in a specific case. We might inform you in additional Data Protection Notices, on a form, or in a contract.

2.1.1. Playbrush and affiliates

Our parent company lists all Sunstar Group companies and member affiliates here. According to this Data Protection Notice, these group companies may use the data for the same purposes as SUNSTAR Europe S.A. (see Section 4). We may also disclose health and related data to our group companies.

As part of their joint responsibility under data protection law, the group companies agreed on who would fulfil specific obligations under the General Data Protection Regulation (GDPR). This agreement outlines who will handle specific tasks related to the rights of individuals whose data is being processed and the information that must be provided, as stated in Articles 13 and 14 of the GDPR. This agreement is necessary since personal data may be processed in different process sections and systems by our group companies when you use the websites, apps, and products. Even if there is a joint responsibility, each company in the group will still be responsible for meeting their specific obligations regarding data protection for the parts of the process they manage.

Affected parties can contact SUNSTAR Europe S.A. (privacy@ch.sunstar.com) directly as a contact and information point.

2.2. E-commerce and sub-service providers

We work with service providers in Switzerland and abroad who process your data for us. In some cases, they may share responsibility for managing your data with us or use the data we provide as separate controllers. These service providers could include, for example, IT providers, shipping companies, advertising service providers, login service providers, banks, insurance companies, debt collection companies, credit information agencies, or address verification providers. Your data may also include health data.

Contractual partners: This refers to our other contractual partners where these contracts result in data being disclosed. For example, they receive registration data about issued and redeemed vouchers, invitations, etc. If you work for one of these contractual partners, we may also disclose your data to that partner. These partners receiving data also include contractual partners who do marketing and advertising for us and to whom we may disclose data about you for analysis and marketing purposes. These may again be service recipients but also sponsors and online advertising providers. We allow these partners to send or show you advertising based on your data only with your consent. For online advertising and online advertising partners, see Section 12. We will inform you of other marketing partners in the respective registrations, vouchers, or invitations.

2.3. Authorities and other recipients

• Authorities: We may disclose personal data to agencies, courts, and other authorities in Switzerland and abroad if we are required to do so by law or if it appears necessary to protect our interests. This may include health data. These authorities act as data controllers.
• Other persons: This means other cases where interactions with third parties follow from the purposes set out in Section 4.

All these categories of data recipients may involve third parties, so your data may also be disclosed to them. We can restrict the processing by certain third parties (for example, IT providers) but not by others (for example, authorities, banks, etc.).

3. What data do we process?

We process various categories of data about you. The main categories of data are the following:

• Technical data: When you use our website or other online offerings, we collect technical data and the IP address of your terminal device. We need this information to ensure the functionality and security of our site and offerings. This data includes logs recording the use of our systems as well as data related to the use of our brushes. We generally keep technical data for 6 months. To ensure the functionality of these offerings, we may also assign an individual code to you or your terminal device (for example, as a cookie, see Section 12). Technical data on its own does not permit us to identify you or draw direct conclusions about your identity. However, technical data may be linked with other categories of data, such as user accounts, registrations, access controls, or contract performance. Technical data, together with these other categories of data, may potentially allow us to identify you.
• Registration data: Certain offerings, such as competitions and services, login areas of our website, newsletters, etc., can only be used with a user account or registration. This registration or user account can be created directly with us or through our third-party service providers. You must provide us with specific data for such a registration or account, and we will collect data about the use of the offering or service. If you redeem a voucher issued by the Playbrush or the SUNSTAR group with us, we may require specific data from you at that time. If we issue a voucher to you for one of our contractual partners, we may share or receive some of your registration data from the relevant contractual partner (see Section 7). Registration data may be required for access control to certain facilities. We generally keep registration data for 12 months from when you stop using the service or close the user account.
• Communication data: When you contact us via the contact form, by email, telephone, chat, letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the communication metadata. We will tell you specifically if we record or listen to telephone conversations or video conferences, for example, for training and quality assurance purposes. Such recordings may only be made and used following our internal policies. You will be informed when such recordings are made, for example, by a notification during the video conference. If you do not want to be recorded, please notify us or leave the (video) conference. Please turn off your camera if you do not want your image recorded. If we must determine your identity, for example, for a request for information, press access, etc., we collect data to identify you (for example, a copy of an ID document). We generally keep this data for 12 months from our last exchange. This period may be longer where required for evidence, to comply with legal or contractual requirements, or for technical reasons. Emails in mailboxes and written correspondence are generally kept for at least 10 years if they relate to an order, warranty, or may otherwise influence the financial position of Sunstar. We will usually keep recordings of (video) conferences for 12 months. We generally store Chats for 12 months.
• Master data: Master data means the basic data that we need in addition to contract data (see below) for the performance of our contractual and other business relationships or for marketing and promotional purposes. This may include information such as name and contact details, as well as other information such as your role and function, your bank details, your date of birth, customer history, powers of attorney, signature authorisations, and declarations of consent. We process your master data: if you are a customer or other business contact; work for a customer or other business contact (for example, as a contact person of the business partner); because we wish to address you for our own or a contractual partner’s purposes (for example as part of marketing and advertising, with invitations to events, vouchers, newsletters, etc.). We receive master data from you (for example, when you make a purchase or as part of a registration), from parties you work for, from third parties such as contractual partners, associations, and address brokers, or from public sources such as public registers or the internet (websites, social media, etc.). We may also process information about third parties as part of master data. We may collect master data from our shareholders and investors. We generally keep master data for 10 years from the last exchange between us or after the end of the contract. This period may be longer if  data is to be used as evidence, to comply with legal or contractual requirements, or for technical reasons. For contact information used only for marketing and advertising, the retention period is usually much shorter, usually no more than 2 years from the last contact.
• Contract data: This means data that is collected during the conclusion or performance of a contract, for example, information about the contracts and the services provided or to be provided, data from the period leading up to the conclusion of a contract, information required or used for performing a contract, and feedback information (for example complaints, feedback about satisfaction, etc.). This may include health data and information about third parties. We generally collect this data from you, from contractual partners and third parties involved in the performance of the contract, and also from third-party sources and public sources. We generally keep this data for 10 years from the last contract activity or from the end of the contract. This period may be longer where necessary if data is to be used as evidence, to comply with legal or contractual requirements, or for technical reasons.
• Behavioural and preference data: Depending on our relationship with you, we try to get to know you better and tailor our products, services, and offers to you. For this purpose, we collect and process data about your behaviour and preferences. We do so by evaluating information about your behaviour in our domain. We may also supplement this information with third-party information, including from public sources. Based on this data, we can, for example, determine the likelihood that you will use certain services or behave in a certain way. The data processed for this purpose is already known to us (for example, where and when you use our services), or we collect it by recording your behaviour (for example, how you navigate our website). We anonymise or delete this data when it is no longer relevant for the purposes pursued. Anonymising data means it can no longer be linked to an individual. Depending on the nature of the data it is usually between 2 weeks and 24 months (for product and service preferences). This period may be longer if data is to be used as evidence, to comply with legal or contractual requirements, or for technical reasons. We describe how tracking works on our website in Section 12.
• Other data: We also collect data from you in other situations. For example, we process data possibly relating to you (such as files, evidence, etc.) in administrative or judicial proceedings. We may also collect data for health protection (for example, as part of health protection concepts). We may obtain or create photos, videos, and sound recordings in which you may be identifiable (for example, at events, with security cameras, etc.). We may also collect data about who enters certain buildings, who has access rights and when (including about access controls, based on registration data, or lists of visitors, etc.), who participates in events or campaigns (for example, competitions), and who uses our infrastructure and systems and when.
• In addition, we collect and process data about our shareholders and other investors. This includes master data, information for registers, data about the exercise of their rights, and about events (for example, general meetings). The retention period for this data depends on the processing purpose and is limited to what is necessary. This ranges from a few days for many security cameras to a few weeks for contact tracing and visitor data, to several years or more for reports about events with images.

You provide much of the data set out in Section 3 through forms, when you communicate with us, during contracting, when you use the website, etc.

You are not obliged or required to disclose data to us except in some instances, for example, within the framework of binding health protection concepts (legal obligations). If you wish to enter contracts with us or use our services, you must also provide us with specific data, in particular master data, contract data and registration data, as part of your contractual obligation under the relevant contract. When you use our website, you cannot avoid technical data processing. If you wish to gain access to specific systems or buildings, you must also provide us with registration data. However, in the case of behavioural and preference data, you generally have the option of objecting or not giving consent.

As long as it is not unlawful, we also collect data from public sources or receive data from other companies within our group, public authorities, and third parties (such as credit agencies, address brokers, associations, contractual partners, internet analytics services, etc.).

Note to Amazon Privacy Notice

Amazon already informed you about the collection and storage of your personal data and the type and purpose of its use in their data protection notice. Amazon obtained any required consent to process this data during your registration. We do not collect any further personal data from you beyond the personal data provided by Amazon. Amazon transmits your personal data to us so that we can perform the contract. This personal data transmitted to us by Amazon is stored and processed by us under this Data Protection Notice.

The Amazon platform is responsible for all further data processing on its platform that goes beyond the data processing described in this Data Protection Notice, including the payment methods provided on the Amazon Website. For more information about Amazon’s data processing, see Amazon’s Privacy Notice.

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for online services is in Section 12. These purposes and their objectives represent our interests and potentially those of third parties. You can find additional information on the legal basis of our processing in Section 5.

We process your data for purposes related to communicating with you, responding to inquiries, exercising your rights (Section 10), and enabling us to contact you in case of queries. We use communication and master data for this purpose and registration data with regard to offers and services you use. We keep this data to document our communication with you for training, quality assurance, and follow-up inquiries.

We process data for the conclusion, administration, and performance of contractual relationships.

For example, we process data for marketing purposes and relationship management to send our customers and other contractual partners personalised advertising for products and services from us and third parties (for example, advertising partners). This may happen in the form of newsletters and other regular contacts (electronically, by email, or by telephone), through other channels for which we have contact information from you, and also as part of marketing campaigns, which may include free services. You can object to such communications at any time or refuse or withdraw consent to be contacted for marketing purposes. We can target our internet advertising more specifically to you with your consent. Finally, we also wish to enable our contractual partners to contact our customers and other partners for marketing.

SUNSTAR uses newsletter tracking in its marketing emails. The reactions of those receiving emails (opening, clicking on text and image links, downloading images with an email program) are recorded and stored.

This data processing aims to improve the quality of our emails and optimise our offers. The legal basis for data processing is our legitimate interest in ensuring that recipients receive only relevant information and that we can delete non-interested recipients from the list.

This tracking will not occur if you have disabled or turned off the image display by default in your email program. In this case, the newsletter will not display completely, and you may be unable to use all the features. As soon as you have the pictures displayed, this tracking is activated.

We further process your data for market research, to improve our services and operations, for product development, and to provide technical support for users (contract fulfilment).

We may also process your data for security, access control purposes, and fraud prevention and detection (legitimate interest in the security and integrity of the systems).

We process personal data to comply with laws, directives, recommendations from authorities, and internal regulations («Compliance»).

We also process data for risk management and as part of our corporate governance, including business organisation and development.

We may process your data for further purposes, as part of our internal processes and administration, or for quality assurance and training.

5. On what basis do we process your data?

Where we ask for your consent for certain processing activities (for example, for processing sensitive personal data, marketing mailings, and advertising management and behaviour analysis on the website), we will inform you separately about the relevant processing purposes. You may withdraw your consent at any time. You can do this by providing us with written notice (by mail) or, unless otherwise noted or agreed, by emailing us or selecting the appropriate setting in our apps and cookies management. This will affect tracking from that time onwards. For withdrawing consent for online tracking, see Section 10. Where you have a user account, you may also withdraw consent or contact us through the relevant website or other service. Once we have received notification of withdrawal of consent, we will no longer process your information for the purpose(s) you consented to unless we have another legal basis to do so. Withdrawing consent does not affect the lawfulness of the processing based on the consent before you withdrew it.

Where we do not ask for consent for processing your personal data, it relies on the processing requirement for initiating or performing a contract with you (or the entity you represent) or on our or a third party's legitimate interest, particularly in pursuing the purposes and objectives set out in Section 4 and implementing related measures. Our legitimate interests also include compliance with legal regulations not based on applicable data protection law. This includes the marketing of our products and services, the interest in understanding our markets better and managing and further developing our company, including its operations, safely and efficiently.

Where we receive sensitive personal data (for example, health data, data about political opinions, religious or philosophical beliefs, and biometric data for identification purposes), we may process your data on other legal bases, for example, in the event of a dispute, as required in relation to potential litigation or for the enforcement or defence of legal claims. In some cases, other legal bases may apply, which we will communicate to you separately as necessary.

6. What applies in the case of profiling and automated individual decisions?

We may automatically evaluate personal aspects relating to you («profiling») based on your data (Section 3) for the purposes set out in Section 4, where we wish to determine preference data, but also to detect misuse and security risks, to perform statistical analysis, or for operational planning. We may also create profiles for these purposes.

We pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. Where these profiles can have legal implications or significantly affect you, we generally ensure that a human reviews them.

In certain situations, it may be necessary to automate discretionary decisions that have legal implications or significantly affect you («automated individual decisions») to improve the efficiency and consistency of decision-making processes. In these cases, we will inform you accordingly and take the measures the applicable law requires.

7. Is your personal data disclosed abroad?

We disclose data to other parties during our business operation. These are not all located in Switzerland. Your data may, therefore, be processed in Europe, the UK, the USA, and, in some cases, any country in the world.

If a recipient is located in a country without adequate statutory data protection, we require the recipient to comply with data protection requirements by entering Standard Contractual Clauses. This is unless the recipient is subject to a legally accepted set of rules to ensure data protection and unless we cannot rely on an exception. An exception may apply, for example, in case of legal proceedings abroad, but also in cases of overriding public interest or if the performance of a contract requires disclosure, if you have consented, or if data has been made available generally by you, and you have not objected against the processing.

8. How long do we process your data?

We process your data for as long as our processing purposes, the legal retention periods, and our legitimate interests in the documentation and keeping evidence require it, or storage is a technical requirement. You will find further information on the respective storage and processing periods for the individual data categories in Section 3 and for cookies in Section 11. If there are no contrary legal or contractual obligations, we will delete or anonymise your data as part of our usual processes once the storage or processing period has expired.

9. How do we protect your data?

We take appropriate security measures to maintain the required security of your personal data, ensure its confidentiality, integrity, and availability, protect it against unauthorised or unlawful processing, and mitigate the risk of loss, accidental alteration, unauthorised disclosure, or access.

10. What are your rights?

Applicable data protection laws grant you the right to object to the processing of your data in some circumstances, for direct marketing purposes, for profiling carried out for direct marketing purposes, and for other legitimate interests in data processing.

To help you control the processing of your personal data, you have the following rights concerning our data processing, depending on the applicable data protection law:

• The right to request information from us about whether and what data we process from you.
• The right to have us correct data if it is inaccurate.
• The right to request the erasure of data.
• The right to request that we provide specific personal data in a commonly used electronic format or transfer it to another controller.
• The right to withdraw consent, where our processing is based on your consent.
• The right to receive, upon request, further information that helps exercise these rights.
• The right to express your point of view in case of automated individual decisions (Section 6) and to request that a human review the decision.

If you wish to exercise the rights mentioned above regarding us (or with one of our group companies), please contact us in writing at our premises or, unless otherwise specified or agreed, by email; you will find our contact details in Section 13. For us to be able to prevent misuse, we need to identify you.

You also have these rights in relation to other parties that cooperate with us as controllers. If you wish to exercise your rights concerning their processing, please contact them directly. You will find information on our key partners and service providers in Section 2 and additional information in Section 12.

Please note that conditions, exceptions, or restrictions apply to these rights under applicable data protection law (for example, to protect third parties or trade secrets). We will inform you accordingly, where applicable.

If you disagree with how we handle your rights or our data protection practices, please let us know (Section 2). If you are in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your country’s competent data protection supervisory authority. You can find a list of authorities in the EEA here: EDPB Overview EU-Member States. You can reach the UK supervisory authority here: Contact UK DPA.

11. Do we use online tracking and online advertising techniques?

We use various techniques on our website that allow us and third parties we engage to recognise you while you use our website and possibly track you over several visits. This section informs you about this.

In essence, we wish to know when you access our website (through your system) rather than other users so that we can ensure the website’s functionality and carry out analysis and personalisation. We do not intend to determine your identity, even if that is possible where we or third parties we engage can identify you by combination with registration data. However, even without registration data, the technologies we use are designed so that you are recognised as an individual visitor each time you access the website, for example, by our server (or third-party servers) that assign a specific identification number to you or your browser (so-called «cookie»).

We use these technologies on our website and may allow certain third parties to do so as well. However, depending on the purpose of these technologies, we may ask for consent before using them. You can access your current settings through the consent banner. You can also set your browser to block or deceive certain types of cookies or alternative technologies or to delete existing cookies. You can also add software to your browser that blocks certain third-party tracking. You can find more information on the help pages of your browser (usually with the keyword «Data Protection») or the websites of the third parties set out below.

We distinguish the following categories of «cookies» (including other technologies such as fingerprinting):

• Necessary cookies: Some cookies are necessary for the website’s functioning or specific features. For example, they ensure you can move between pages without losing information entered in a form. They also ensure that you stay logged in. These cookies exist temporarily only («session cookies»). If you block them, the website may not work correctly. Other cookies are necessary for the server to store options or information you have entered beyond a session (i.e. a visit to the website) if you use this function (for example, language settings, consents, automatic login functionality, etc.). These cookies have an expiration date of up to 24 months.
• Performance cookies: To optimise our website and related offers and better adapt them to the users’ needs, we use cookies to record and analyse the use of our website, potentially beyond one session. We use third-party analytics services for this purpose. We have listed them below. Before we use such cookies, we ask for your consent. You can withdraw consent at any time through the cookie settings. Performance cookies also have an expiration date of up to 24 months. You can find details on the websites of the third-party providers.
• Marketing Cookies: We and our advertising partners are interested in targeting advertising as precisely as possible, i.e. only showing specific adverts to those we wish to address. We have listed our advertising partners below. For this purpose, we and our advertising partners – if you consent – use cookies to record the content accessed or the contracts concluded. This allows us and our advertising partners to display advertisements that we think will interest you on our website but also on other websites that display advertisements from us or our advertising partners. These cookies expire in a few days or up to 12 months, depending on the circumstances. You will be shown related advertisements if you consent to using these cookies. If you do not agree to them, you will not see fewer advertisements, but simply any other advertisement that might be less relevant to you.

In addition to marketing cookies, we use other technologies to control online advertising on other websites, reducing advertising wastage.

We currently use offers from the service providers and advertising partners (where they use data from you or cookies set on your computer for advertising purposes) listed at the end of this notice.

12. What data do we process on our social network pages?

We may operate pages and other online presences («fan pages», «channels», «profiles», etc.) on social networks and other platforms operated by third parties and collect the data about you described in Section 3 and below. We receive this data from you and the platforms when you interact with us through our online presence (for example, when you communicate with us, comment on our content, or visit our online presence). At the same time, the platforms analyse your use of our online presence and combine this data with other data they have about you (for example, about your behaviour and preferences). They also process this data for their purposes, for marketing and market research purposes (for example, to personalise advertising), and to manage their platforms (for example, what content they show you), and, to that end, they act as controllers.

We process this data for the purposes set out in Section 4: for communication, marketing (including advertising on these platforms, including Section 11), and market research. You will find information about the applicable legal basis in Section 5. We may disseminate content you publish (for example, comments on an announcement), for example, as part of our advertising on the platform or elsewhere. We or the operators of the platforms may also delete or restrict content from or about you under their terms of use (for example, inappropriate comments).

For further information on the processing of the platform operators, please refer to the data protection information for the relevant platforms. There, you can also find out about the countries where they process your data, your rights of access and erasure of data, and other data subjects’ rights, as well as how you can exercise them or obtain further information. We currently use the following platforms:

• Facebook: On Facebook, we operate the following page. The controller operating the platform for users from Europe is Facebook Ireland Ltd., Dublin, Ireland. Their Data Protection notice is available at www.facebook.com/policy. Some of your data will be transferred to the United States. 
• Regarding the data collected and processed when visiting our site for «page insights», we are joint controllers with Facebook Ireland Ltd., Dublin, Ireland. As part of page insights, statistics are created about visitors' actions on our site (comment on posts, share content, etc.). This is explained here. It helps us understand how our page is used and how to improve it. We receive only anonymous, aggregated data. We have agreed to our data protection responsibilities according to the information here.

• Instagram: Here we operate the page. The entity responsible for operating the platform for users from Europe is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland. Their privacy policy is available here. Some of your data will be transferred to the USA. We are jointly responsible with Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland, for the data collected and processed when you visit our site to create “Instagram Insights.” As part of Page Insights, statistics are compiled about what visitors do on our site (comment on posts, forward content, etc.). We have regulated our responsibilities regarding data protection per the information here.
• LinkedIn: Here we operate the page. The entity responsible for operating the platform for users from Europe is LinkedIn Ireland Unlimited Company, Ireland. We are jointly responsible with Wilton Place, Dublin 2, Ireland, for the data collected and processed when visiting our site for the creation of “Page Insights.” As part of Page Insights, statistics are compiled about what visitors do on our site (comment on posts, forward content, etc.). This is described here. It helps us understand how our site is used and how to improve the site. We only receive anonymous, aggregated data.
• YouTube platform: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (from this point on "YouTube"). In operating our YouTube channel and Google, we use the dashboard overview from Google (the provider of the services), with which Google provides us with statistical data on the use of our YouTube page. This data is anonymous, which means that the personal data of individual users or visitors is not visible to us. You can find out what data Google uses for analysis of use on our YouTube page and what information Google provides on data processing in connection with the implemented functions here. For the YouTube platform, you can manage your selection here. You can find YouTube’s privacy policy here.

• X platform: Here, we operate the page. The controller responsible for operating the platform is Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland (from this point on, also “X”). You can reach the X data protection officer via their online contact form. For X, the X User Agreement is the governing document. It comprises the Terms of Service (here), its Privacy Policy (here) and the X Rules and Policies (here). From X, we receive the following data: Reach (tweets, retweets, impressions, page views, unique users, access to subpages), target group (demographic information), interaction (impressions, reactions, click rate, likes, shares, comments, (link) clicks, engagement rate), target group (demographic/geographic information). For X, you can manage your selection here. Additionally, the privacy policy can be found here.

13. Data Protection contact details

Data Controller

SUNSTAR Europe S.A.,

Route de Pallatex 11, 1163 Etoy, Switzerland

privacy@ch.sunstar.com

 

Representative in the EU:

SUNSTAR Deutschland GmbH

Aiterfeld 1

79677 Schönau im Schwarzwald

Germany

 

Data Protection Officer contact

You can contact our Data Protection Officer directly at:

dpo.emea@sunstar.com

Can we update this Data Protection Notice?

This Data Protection Notice is not part of a contract with you. We may update this Data Protection Notice at any time. The version published on this website is the current version.