The WinGD group (also «we», «us») collects and processes personal data that concern you but also other individuals («third parties»). We use the word «data» here interchangeably with «personal data». 

The WinGD group» means Winterthur Gas & Diesel Ltd. and its subsidiaries and group companies. A list of these subsidiaries and group companies can be found here https://www.wingd.com/en/about-wingd/our-office-locations/  

In this Privacy Notice, we describe what we do with your data when you use www.wingd.com, our other websites or apps (collectively «website»), obtain services or products from us, interact with us in relation to a project / (potential) contract (including job applications), communicate with us or otherwise deal with us. When appropriate we will provide a just-in-time notice to cover any additional processing activities not mentioned in this Privacy Notice. In addition, we may inform you about the processing of your data separately, for example in consent forms, terms and conditions, additional privacy notices, forms and other notices.

If you disclose data to us or share data with us about other individuals, such as family members, co-workers, etc., we assume that you are authorised to do so and that the relevant data is accurate. When you share data about others with us, you confirm that. Please make sure that these individuals have been informed about this Privacy Notice. 

Winterthur Gas & Diesel Ltd., Winterthur, Switzerland («WinGD») is the controller for the WinGD group’s processing under this Privacy Notice, unless we tell you otherwise in an individual case, for example in additional privacy notices, on a form or in a contract. Other subsidiaries of WinGD may also receive and process your personal data, either in the capacity of controller or processor; this Notice applies equally to them. 

You may contact us for data protection concerns and to exercise your rights under Section 11 as follows:

Winterthur Gas & Diesel Ltd, P.O. Box 414, Schützenstrasse 3; 8401 Winterthur; dataprotection@wingd.com

We process various categories of data about you. The main categories of data are the following: 

Much of the data set out in this Section 3 is provided to us by you (through forms, when you communicate with us, in relation to contracts, when you use the website, etc.). You are not obliged or required to disclose data to us except in certain cases, for example within the framework of binding health protection concepts (legal obligations). If you wish to enter into contracts with us or use our services, you must also provide us with certain data, in particular master data, contract data and registration data, as part of your contractual obligation under the relevant contract. When using our website, the processing of technical data cannot be avoided. If you wish to gain access to certain systems or buildings, you must also provide us with registration data. However, in the case of preference data, you generally have the option of objecting or not giving consent.

As far as it is not unlawful we also collect data from public sources (for example debt collection registers, land registers, commercial registers, the media, or the internet including social media) or receive data from other companies within our group, from public authorities and from other third parties (such as credit agencies, address brokers, associations, contractual partners, background search providers, internet analytics services, etc.). 

We process your data for the purposes explained below. Further information is set out in Sections 12 and 13 for online services. These purposes and their objectives represent interests of us and potentially of third parties. You can find further information on the legal basis of our processing in Section 5.

We process your data for purposes related to communication with you, in particular in relation to responding to inquiries (including job applications) and the exercise of your rights (Section 11) and to enable us to contact you (e.g. by email, telephone, messenger services, chats, social media, letter or even fax) in case of queries. For this purpose, we use in particular communication data and master data, and registration data in relation to offers and services that you use. We keep this data to document our communication with you, for training purposes, for quality assurance and for follow-up inquiries. 

We process data for the conclusion, administration and performance of contractual relationships  current and future employees, customers, suppliers, subcontractors and other parties in projects or parties in legal proceedings. In particular, we process data relating to the customer or the persons for whose benefit the customer has received a service. This may include involving third parties, such as logistics companies, security service providers, advertising service providers, banks, insurance companies, background search providers or credit information providers, who may in turn provide data to us. In the run-up of a business relationship, personal data is collected from potential customers or other contractual partners (for example in an order form or a contract) or results from a communication.

We process data for marketing purposes and relationship management, for example to send our customers and other contractual partners personalized advertising for products and services from us and from third parties (for example from advertising partners). This may happen in the form of newsletters and other regular contacts (electronically, by e-mail or by telephone), through other channels for which we have contact information from you, but also as part of marketing campaigns (for example events, contests, etc.) and may also include free services (for example invitations, etc.). You can object to such contacts at any time (see at the end of this Section 4) or refuse or withdraw consent to be contacted for marketing purposes. With your consent, we can target our online advertising on the internet more specifically to you (see Section 12). In the context of relationship management, we may also operate a customer relationship management system («CRM») in which we keep the data of customers, suppliers and other business partners that is required for relationship management, for example data about contact persons, relationship history (for example information about products and services purchased or supplied, interactions, etc.), interests, marketing measures (newsletters, invitations to events, etc.) and other information. 

Finally, we also wish to enable our contractual partners to contact our customers and other contractual partners for marketing purposes (see Section 7).

We further process your data for market research, to improve our services and operations, and for product development. 

We may also process your data for security and access control purposes. We continuously review and improve the appropriate security of our IT and other infrastructure (for example buildings). We therefore process data, for example, for monitoring, inspection, analysis and testing of our networks and IT infrastructures, for system and error checks, for documentation purposes and in the context of backups. Access controls include electronic system access controls (for example logging into user accounts), as well as physical access controls (for example building access). For security purposes (to prevent and investigate incidents), we also keep access protocols and visitor lists and use surveillance systems (for example security cameras). We will inform you about surveillance systems at the relevant locations through appropriate signage.

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations («Compliance»). This includes receiving and processing complaints and other reports, monitoring communications, conducting internal investigations or disclosing documents to an authority if we have sufficient reasons to do so or are legally obliged to do so. We may also process your personal data in relation to external investigations, for example by a law enforcement or supervisory authority or by a mandated private entity.

We also process data for the purposes of our risk management and as part of our corporate governance, including business organization and development. 

We may process your data for further purposes, for example as part of our internal processes and administration or for quality assurance purposes and trainings and educational purposes, for protecting our rights (for example to enforce claims in or out of court, and before authorities in Switzerland and abroad, or to defend ourselves against claims, for example by preserving evidence, conducting legal assessments and participating in court or administrative proceedings) and evaluating and improving internal processes. 

Where we ask for your consent for certain processing activities (for example for accessing your personal data during job application processes, for the processing of sensitive personal data, for marketing mailings, for personalised motion profiles and for advertising management and behaviour analysis on the website), we will inform you separately about the relevant processing purposes. You may withdraw your consent at any time with effect for the future by providing us written notice (by mail) or, unless otherwise noted or agreed, by sending an e-mail to us; see our contact details in Section 2. For withdrawing consent for online tracking, see Section 12. Where you have a user account, you may also withdraw consent or contact us also through the relevant website or other service, as applicable. Once we have received notification of withdrawal of consent, we will no longer process your information for the purpose(s) you consented to, unless we have another legal basis to do so. Withdrawal of consent does not, however, affect the lawfulness of the processing based on the consent prior to withdrawal.

Where we do not ask for consent for processing, the processing of your personal data relies on the requirement of the processing for initiating or performing a contract with you (or the entity you represent) or on our or a third-party legitimate interest in the particular processing, in particular in pursuing the purposes and objectives set out in Section 4 and in implementing related measures. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognised as a legal basis by applicable data protection law (for example in the case of the GDPR, the laws in the EEA and in the case of the DPA, Swiss law). This also includes the marketing of our products and services, the interest in better understanding our markets and in managing and further developing our company, including its operations, safely and efficiently.

Where we receive sensitive personal data (for example health data, data about political opinions, religious or philosophical beliefs, and biometric data for identification purposes), we may process your data on other legal basis, for example, in the event of a dispute, as required in relation to a potential litigation or for the enforcement or defense of legal claims. In some cases, other legal basis may apply, which we will communicate to you separately as necessary.

We may automatically evaluate personal aspects relating to you («profiling») based on your data (Section 3) for the purposes set out in Section 4, where we wish to determine preference data (e.g. to determine which other products or offerings are likely to be of interest to you based on your purchases), but also in order to detect misuse and security risks, to perform statistical analysis or for operational planning. We may also create profiles for these purposes, i.e. we may combine preference data, but also master data, contract data and technical data relating to you in order to better understand you as a person with your various interests and other characteristics. 

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. Where these can produce legal effects concerning you or similarly significantly affect you, we generally ensure human review. 

In relation to our contracts, the website, our services and products, our legal obligations or otherwise with protecting our legitimate interests and the other purposes set out in Section 4, we may disclose your personal data to third parties, in particular to the following categories of recipients: 

All these categories of recipients may involve third parties, so that your data may also be disclosed to them. We can restrict the processing by certain third parties (for example IT providers), but not by others (for example authorities, banks, etc.).

Your data will continue to be subject to adequate data protection in Switzerland and the rest of Europe, even after disclosure. For disclosure to other countries, the provisions of Section 8 apply. If you do not wish certain data to be disclosed, please let us know so that we can review if and to what extent we can accommodate your concern (Section 2).

In addition, we enable certain third parties to collect personal data from you on our website and at events organized by us (for example press photographers, providers of tools on our website, etc.). Where we have no control over these data collections, these third parties are sole controllers. If you have concerns or wish to exercise your data protection rights, please contact these third parties directly. See Section 12 for the website.