Privacy Policy

Version 05/2018

Thank you for your interest in our company. Data protection is important to us, and accordingly, we explain in this Privacy Policy how we collect and process personal data (hereinafter “personal data,” i.e., data relating to an identified or identifiable individual, such as name, address, nationality, email address, interests and hobbies, and user behavior on websites). This Privacy Policy is based on the EU General Data Protection Regulation (GDPR).

The data controller is: Dorbena beddingfabrik Aktiengesellschaft, Im Mühleholz 8, FL-9490 Vaduz

The contact information for the Data Protection Officer is as follows:
Remo Tschumper
Email: datenschutzbeauftragter@dorbena.com
Phone: 00423 / 237 77 22

We primarily limit the processing of personal data to information we receive from our customers, our partners, or other involved parties in connection with our services and products, or that we collect from users on our websites, apps, or other applications.

In particular, we collect the following personal data from you on a case-by-case basis and depending on the purpose (see below):

• Title / Designation
• First Name, Last Name
• Address
• Email address
• Phone number(s)
• Date of Birth
• Nationality
• Tax ID number
• Bank information
• IP address
• Company affiliation
• Other data related to our services and products

In addition, to the extent permitted and appropriate, we may collect and process additional data on a case-by-case basis from publicly available sources (e.g., land registry, commercial register, media, the Internet, WorldCheck) or receive such data from government agencies and institutions, from your personal circle (such as family or legal advisors), or from other third parties.

We require this data in particular to fulfill the following purposes:

• to identify you as a customer, business partner, or user of our websites
• to correspond with you
• to comply with legal requirements
• to conclude and execute service agreements, e.g., incorporation orders, retainer agreements, and asset management agreements
• to conclude and fulfill purchase and sale agreements, e.g., for the purchase of products from suppliers or sales to prospective buyers
• for invoicing
• to provide additional services from our company or, where applicable, in collaboration with third parties
• to provide you with the best possible and customized services and to further develop our range of services and products
• to communicate with third parties (e.g., the media)
• To evaluate and respond to job applications
• to promote and market our services and products (provided you have not objected to the use of your data for this purpose)
• to assert legal claims or defend our position in general
• to ensure the general operation of our business (e.g., IT, websites, apps)
• for video surveillance as a security measure for access management (including visitor logs or other access controls)
• to safeguard other security aspects

We process your personal data only if we have a legal (e.g., duty of care) or contractual (e.g., founding mandate) basis, or if the data processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. We process data beyond this only if we have your consent and you have not revoked it. Or if a legitimate interest on our part prevails (e.g., continuing to send newsletters to existing customers, provided that consent has not been revoked in this case either). Consent may be revoked at any time.

We disclose your personal data to recipients or third parties only within the scope of the purposes described above, to the extent permitted and appropriate. This may include, in particular:

• Service providers such as banks, asset management companies, insurance companies, IT providers, and printing companies
• Suppliers, retailers, transportation companies, subcontractors, or other business partners
• Government agencies, public institutions, and courts
• Associations, public-interest organizations

Such data disclosure is based either on a legal obligation (e.g., data transmission as part of the Automatic Exchange of Information), the performance of a contract (e.g., asset managers abroad), your consent, a public interest, or a legitimate interest on our part, provided that your interests or fundamental rights and freedoms regarding the protection of personal data do not take precedence.
Recipients may be located domestically or abroad. In particular, we would like to point out that we transfer personal data to countries where service providers from whom we obtain services are located (e.g., Microsoft, Google, etc.).
In the case of recipients outside our company within the EU/EEA or in countries with recognized adequacy of data protection (e.g., Switzerland), we ensure data protection by entering into so-called data processing agreements, where necessary and appropriate.
Should we transfer personal data to third countries without adequate statutory data protection, we ensure an adequate level of protection in accordance with legal requirements, for example, based on EU Standard Contractual Clauses or other instruments (e.g., Binding Corporate Rules, U.S. Privacy Shield).

In addition to the above, we provide the following information regarding the use of cookies, analytics/tracking, or other technologies in connection with the use of our websites:

When you use the website for informational purposes only (i.e., if you do not log in, register, or otherwise provide us with information to use the website), we do not collect any personal data, with the exception of the data transmitted by your browser to enable you to visit the website, which may include, in particular, the following personal data:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each instance
• Website from which the request originated
• Browser used
• Operating system and its user interface
• Language and version of the browser software

Our website, as well as various online services such as Google, uses so-called cookies. These are small text files that are stored on your device with the help of your browser. Cookies do not cause any harm.
We use them solely to make our website more user-friendly. Some cookies remain stored on your device until you delete them. They allow us to recognize your browser the next time you visit.
If you do not wish this to happen, you can configure your browser to notify you when cookies are set and to allow them only on a case-by-case basis. However, please note that in this case, you may not be able to use all features of our websites to their full extent.

5.1 Google Analytics

We use Google Analytics on our websites. Google Analytics is a web analytics service provided by Google Inc. in the United States and uses cookies. Web analytics refers to the collection, gathering, and evaluation of data regarding the behavior of website visitors. Among other things, a web analytics service collects data on which website a user came from to access a website, which subpages of the website were accessed, and how often and for how long a subpage was viewed. Web analytics is primarily used to optimize a website and to conduct a cost-benefit analysis of online advertising.
The purpose of Google Analytics is to analyze visitor traffic on our website. Google uses the data and information collected, among other things, to evaluate the use of our website, to compile online reports for us that illustrate activity on our website, and to provide other services related to the use of our website.
Google may combine your behavior with that on other websites you have visited. If you are a registered Google user, Google will recognize you accordingly. In such cases, Google’s privacy policy applies to the further processing of personal data. Cookies are used to store personal information, such as the time of access, the location from which access originated, and the frequency of visits to our website by the data subject. Each time you visit our website, this personal data—including the IP address of the internet connection used by the data subject—is transmitted to Google in the United States. Google may, under certain circumstances, share this personal data, collected through technical means, with third parties.

In addition, a cookie already set by Google Analytics can be deleted at any time via the web browser or other software programs. See http://tools.google.com/dlpage/gaoptout?hl=de

For further information, please contact Google directly, in particular via the following links:
www.google.de/intl/de/policies/privacy/
www.google.com/analytics/terms/de.html
www.google.com/intl/de_de/analytics/

5.2 Google Ads

The data controller has integrated Google Ads into this website. Google Ads is an online advertising service that allows advertisers to place ads both in Google’s search results and on the Google Display Network. Google Ads enables an advertiser to specify certain keywords in advance, so that an ad is displayed in Google’s search results only when a user enters a keyword-relevant search query into the search engine. On the Google Display Network, ads are distributed across thematically relevant websites using an automated algorithm and in accordance with the previously specified keywords.
The operator of the Google Ads services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
The purpose of Google Ads is to promote our website by displaying interest-based advertisements on third-party websites and in Google search results, as well as by displaying third-party advertisements on our website.
Furthermore, the data subject has the option to opt out of interest-based advertising by Google. To do so, the data subject must access the link www.google.de/settings/ads from each of the web browsers they use and configure the desired settings there.
Further information and Google’s applicable privacy policy can be found at https://www.google.de/intl/de/policies/privacy.

5.3 Google Fonts

Use of Google Fonts:
Google Fonts is a service provided by Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), which grants us access to a font library; we use these fonts to design our website. To display the fonts we use, your browser must establish a connection to a Google server in the U.S. and download the font required for our website. As a result, Google receives the information that our website has been accessed from your IP address. For more information about Google Fonts, please refer to Google’s privacy policy, which you can access here: https://policies.google.com/privacy?hl=en

5.4 Newsletter

On the Dorbena AG website, users are given the opportunity to subscribe to our company’s newsletter. The personal data transmitted to the data controller when subscribing to the newsletter is determined by the input form used for this purpose.
Dorbena informs its customers and business partners at regular intervals via a newsletter about the company’s offers. In principle, the data subject can only receive our company’s newsletter if (1) the data subject has a valid email address and (2) the data subject registers to receive the newsletter. For legal reasons, a confirmation email is sent via the double-opt-in procedure to the email address initially provided by a data subject for the newsletter. This confirmation email serves to verify whether the owner of the email address, as the data subject, has authorized receipt of the newsletter.
When subscribing to the newsletter, we also store the IP address assigned by the Internet service provider (ISP) to the computer system used by the data subject at the time of registration, as well as the date and time of registration. The collection of this data is necessary to be able to trace any (potential) misuse of a data subject’s email address at a later date and therefore serves to provide legal protection for the data controller.
The personal data collected as part of a newsletter subscription is used exclusively for sending our newsletter. Furthermore, newsletter subscribers may be informed by email if this is necessary for the operation of the newsletter service or for related registration purposes, as might be the case with changes to the newsletter content or alterations to the technical conditions. Personal data collected as part of the newsletter service is not disclosed to third parties. The data subject may cancel their subscription to our newsletter at any time. Consent to the storage of personal data, which the data subject has provided to us for the purpose of sending the newsletter, may be revoked at any time. A link for revoking consent is included in every newsletter. Furthermore, you may unsubscribe from the newsletter at any time directly on the data controller’s website or notify the data controller of your wish to unsubscribe by other means.

5.5 Tracking Services

Dorbena AG’s newsletters contain so-called web beacons. A web beacon is a miniature graphic embedded in emails sent in HTML format to enable log file recording and analysis. This allows for a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded web beacon, Dorbena AG can determine whether and when an email was opened by a data subject and which links contained in the email were clicked by the data subject.
Such personal data collected via the tracking pixels contained in the newsletters is stored and analyzed by the data controller to optimize newsletter distribution and to tailor the content of future newsletters even better to the data subject’s interests. This personal data is not disclosed to third parties. Data subjects are entitled at any time to revoke the separate declaration of consent provided via the double opt-in procedure. Following revocation, this personal data will be deleted by the data controller. Dorbena AG automatically interprets unsubscribing from the newsletter as a revocation.

5.6 Profiling Methods

Profiling refers to the automated processing of personal data with the aim of identifying personal characteristics and providing users with information about customized services and products. The analysis methods we use also enable us, in particular, to conduct targeted advertising.

5.7 SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content—such as orders or inquiries you send to us as the website operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar.
When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

5.8 Other Web Services

For the use of additional web services, such as social media and YouTube, their respective privacy policies—which are available on the providers’ websites—apply in addition to the General Data Protection Regulation (GDPR), which takes precedence.

We collect and process personal data from applicants for the purpose of handling the application process. Processing may take place on paper or electronically via email or by filling out a web form. If an employment contract is concluded with an applicant, the personal data received will be processed for the purpose of administering the employment relationship in compliance with legal requirements. Otherwise, the application documents will be deleted three months after a rejection has been issued, provided that no legitimate interests on our part—such as those related to a duty to provide evidence regarding equal treatment—preclude such deletion.

As a general rule, we retain your personal data only for as long as is necessary for the purposes for which it was collected in accordance with this Privacy Policy. However, we may be legally required to retain certain data for a longer period. In such cases, we will ensure that your personal data is handled in accordance with this Privacy Policy throughout the entire period.

You have the right to request information from us at any time, free of charge, regarding the personal data we have stored about you, as well as its origin, the recipients or categories of recipients to whom this personal data is disclosed, and the purpose of its storage. You also have the right to request that we correct, delete, or restrict the processing of your personal data at any time. You also have the right to data portability. Furthermore, you have the right to object at any time to our processing of your personal data. If you have given us consent to use your personal data, you may revoke this consent at any time without providing a reason. You also have the right to file a complaint directly with the Liechtenstein Data Protection Authority (www.llv.li/#/1758/datenschutzstelle). If you wish to exercise the above rights, please contact us at the address provided in paragraph 1.

We maintain up-to-date technical measures to ensure data security, in particular to protect your personal data from risks during data transmission and from access by third parties. These measures are updated as needed in accordance with the current state of the art.

10. Online Store

Order Process

All data entered by customers during the order processing are stored. This includes:

1. Last name, first name

2. Address

3. Payment information

4. Email address

Data that is absolutely necessary for delivery or order processing is shared with third-party service providers. As soon as the retention of your data is no longer necessary or required by law, it will be deleted.

PayPal

When paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—“purchase on account” or “installment payment” via PayPal, we will forward your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). This transfer is made in accordance with Article 6(1)(b) of the GDPR and only to the extent necessary for payment processing.
PayPal reserves the right to conduct a credit check for the following payment methods: credit card via PayPal, direct debit via PayPal, or—if offered—“purchase on account” or “installment payment” via PayPal. For this purpose, your payment data may be transferred to credit bureaus in accordance with Article 6(1)(f) of the GDPR, based on PayPal’s legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check—specifically, the statistical probability of default—to decide whether to provide the respective payment method. The credit report may contain probability values (so-called “score values”). To the extent that score values are included in the credit report’s results, they are based on a scientifically recognized mathematical-statistical method. The calculation of these score values takes into account, among other things but not exclusively, address data. For further information regarding data protection, including details on the credit bureaus used, please refer to PayPal’s Privacy Policy. You may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

Payrexx

If, during the ordering process, the data subject chooses to pay via the online payment service provider Payrexx (e.g., when paying by credit card, etc.), contact, order, and transaction data will be transmitted to Payrexx and its card issuers as part of the order initiated in this manner. Payrexx is a service provided by Payrexx AG, Burgstrasse 20, 3600 Thun, Switzerland. For more information on data protection at Payrexx, please visit: https://payrexx.com/de-ch/agb-rechtliches.

Credit Check

To ensure your security and that of the operator, the operator conducts a credit check before concluding a contract. In addition to reviewing past transactions with the operator and any changes to your personal information, the operator also relies on third-party service providers.

Your personal data (name, address, date of birth) will be sent to MF Group AG, 9004 St. Gallen, as part of the credit check.

As part of the ongoing technical development of our services and in accordance with the legal framework, we will also continuously update our Privacy Policy. Any changes to the Privacy Policy will be published on our website. Therefore, please review the current version of this Privacy Policy regularly. Subject to applicable laws, all changes to the Privacy Policy take effect as soon as the updated Privacy Policy is published. If we have already collected data about you and/or are subject to a legal obligation to provide information, we will additionally inform you of any material changes to our Privacy Policy and request your consent if required by law.