Privacy Policy of COPLAX AG

The protection of your privacy and the careful, responsible handling of your data are of particular concern to us. In the following, we provide you with an overview of our privacy policy:

1. What is this privacy policy about?
2. Who is responsible for processing your data?
3. What data do we process?
4. For what purposes do we process your data?
5. On what basis do we process your data?
6. What applies to profiling and automated individual decisions?
7. Who do we disclose your data to?
8. Does your personal data also end up abroad?
9. How long do we process your data?
10. How do we protect your data?
11. What rights do you have?
12. Do we use online tracking and online advertising techniques?
13. What data do we process on our pages in social networks?
14. Can this privacy policy be changed?

1. What is this privacy policy about?
The responsible management of COPLAX AG (hereinafter referred to as "COPLAX AG" or "responsible parties", also referred to as "we" or "us") obtains and processes personal data relating to you or other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data" or "personal data". In our privacy policy, we describe how we process your data when you

• use one of our websites (with language selection German or English), in particular <https://coplax.swiss/> and <https://stylies.com> (hereinafter referred to as "COPLAX.SWISS website", " STYLIES.COM website" or "website(s)")
• refer to our services or products
• are otherwise associated with us under a contract
• communicate with us, for example, via our contact form, e-mail or telephone, or otherwise deal with us.

Our privacy policy is designed to comply with the Swiss Data Protection Act ("DPA") and its ordinance, the revised Swiss Data Protection Act ("revDPA"), as well as the requirements of
the EU General Data Protection Regulation ("GDPR"). Whether and to what extent these laws are applicable, however, depends on the individual case.

2. Who is responsible for processing your data?
COPLAX AG
Management
Tramweg 35
CH 6414 Oberarth

Phone: +41 41 766 83 30
E-mail: info@coplax.ch

3. What data do we process?
We process different categories of data about you that you provide to us. The most important categories are:

• Technical data (e.g. IP address, logs, log files, possibly behavioural and preference data)
• Communication data (e.g. name, address, email address, telephone number, date, content)
• Master data of our customers and contractual partners, such as name, date of birth, billing and delivery address, telephone number, email address, customer number, consent to receive advertising, information on purchasing power, language preferences, etc.
• Contractual data (e.g. personal and financial data [bank details] of our clientele, contract partners and service providers such as manufacturers, suppliers and distributors that are required for the processing and fulfilment of our contracts)
• other data (e.g. photos and reports about events with pictures of you) If you do not wish to provide us with certain required information about yourself, we may not be able to fulfil the intended purpose of the data processing (e.g. respond to your enquiry or provide you with our websites).

4. For what purposes do we process your data?
Essentially, we process data for the purpose of

• communicating with you, in particular to respond to your enquiries and assert your rights
• the handling of contractual relationships between us and our clientele, our manufacturers, distributors, service providers such as suppliers and freight forwarders, IT and hosting providers, employees, trustees, insurance service providers, etc.).
• the maintenance of relations
• marketing (e.g. sending newsletters)
• the security of our networks, IT and other infrastructure
• adherence to laws, directives and recommendations of authorities and internal regulations ("compliance")
• and protection of our risk management and within the framework of prudent corporate governance.
• administration, training and quality assurance, etc.

5. On what basis do we process your data?
If we ask for your consent for certain processing (e.g. for contacting you for the purpose of a requested callback or for marketing mailings on a case-by-case basis), we will inform you
separately about the corresponding purposes of the processing. However, it is not necessary to obtain your consent if we (or third parties, e.g. contractual partners) have a legitimate interest in processing your data (e.g. initiation or execution of a contract or service), or if compliance with statutory provisions has priority.

6. What applies to profiling and automated individual decisions?
We may use your data to automatically assess certain of your personal characteristics for the purposes already mentioned ("profiling"), if we want to determine preference data, but also to determine abuse and security risks, to carry out statistical analyses (e.g. with the help of Google Analytics) or for operational planning purposes. For the same purposes, we may also create profiles, i.e. we may combine behavioural and preference data, but also master and contract data and technical data assigned to you in order to better understand you as a person with your different interests and other characteristics.

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or a professional ling. If these can have legal effects or significant disadvantages for you, we generally provide for a manual review.

7. Who do we disclose your data to?
In connection with our contracts, our websites, our services and products, our legal obligations or otherwise in order to protect our legitimate interests and the further purposes, we also transfer your personal data to third parties, in particular to the following categories of recipients:

• Service providers who process your data in part on our behalf, such as transport companies (freight forwarders, freight companies) in Switzerland and abroad, a fiduciary office based in Switzerland at our IT provider in Zurich, or our hosting provider ("Hostpoint AG", in CH-8640 Rapperswil-Jona, Neue Jonastrasse 60), who is responsible for the processing of the technically required data on our website (see its privacy policy at <https://www.hostpoint.ch/hostpoint/kontakt-agb.html#datenschutz>).
• Contractual partners at home and abroad (e.g. production partners/manufacturers of our products, distributors, marketing and project partners)
• Companies in our corporate group (see e.g. <https: stylies.com>/«about us»)
• Credit agencies such as banks and credit institutions, which store your data for creditworthiness information in the event of cashless payment for our services and products
• Authorities at home and abroad (e.g. in the case of criminal investigations, processing of customs formalities, reporting obligations, legal proceedings, etc.)
• Third parties who collect data about you, e.g. via website and (social media) platforms such as LinkedIn, Xing and Youtube, or via analysis services such as Google Analytics (see point 12 f.).

8. Does your personal data also end up abroad?
Your data will generally be processed and stored in Switzerland. Under certain circumstances, your data may also be processed in Europe, but in exceptional cases in any country in the world (see point 7). Our contractual partners (product manufacturers, dealers or subcontractors, etc.) may also have their registered office outside Switzerland or the European Union. If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection, provided that is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption provision. For this purpose, we use the revised standard contractual clauses of the European Union (Commission Implementing Decision (EU) 2021/914 and 915 of 4 June 2021, available at <https://eur-lex.europa.eu/homepage.html>).

9. How long do we process your data?
We process your data for as long as required by our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes, or if storage is technically necessary. If there are no legal or contractual obligations to the contrary, we delete or anonymise your data after the storage or processing period has expired as part of our normal processes.

10. How do we protect your data?
We take appropriate technical and organisational security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counteract the risks of loss, unintentional modification, unintentional disclosure or unauthorised access (e.g. by encrypting your data in the contact form, use of a firewall, logging, access restrictions, unannounced checks, periodic renewal of passwords, compliance rules, directives, training of our employees, order data agreements, etc.).

11. What rights do you have?
This includes the right of access, the right to rectify incorrect data, the right to erasure of data, the right to obtain certain personal data in a commonly used electronic format, the right to withdraw your consent, as well as the right to ask for further information necessary to exercise these rights. Please note, however, that we reserve the right to assert the restrictions provided for by law on our part, for example if we are obliged to retain or process certain data, have an overriding interest in doing so (insofar as we are entitled to rely on this) or require it for the assertion of claims. Write to us!

12. Do we use online tracking and online advertising techniques?
On our websites, we use technologies with which we and third parties called in by us (our hosting provider and, if applicable, our IT service provider) can recognise you when you use them and, under certain circumstances, also track you over several visits. For this purpose, we use technically necessary temporary cookies (so-called "session cookies" in the form of recognition numbers). In essence, this is so that we or our hosting provider can distinguish your access (via your system) from access by other users, so that we can ensure the functionality of the website. We do not want to infer your identity, even if we could do so (for example, on the basis of your registration data, but also without registration data). Furthermore, the use of marketing cookies for the purpose of targeted advertising is
possible from a technical point of view. In order to optimise our websites and corresponding offers and to better adapt them to the needs of our users, we currently use performance cookies to record and analyse the use of our website, possibly even beyond the session. This is done through the use of third-party analytics services (see below). Depending on the purpose of these technologies, we may
ask for your consent (opt-out option) before they are used. We currently use the integrated service "ReCAPTCHA" from Google in order to be able to distinguish you as a user of our web pages from a robot programme. In addition, we use the analysis service "Google Analytics" from the provider Google Ireland (based in Ireland) on a case-by-case basis in order to be able to evaluate your user behaviour (including
frequency of pages accessed, duration, geographical origin of access, etc.) with the help of performance cookies. If you agree to the use of Google Analytics, you explicitly consent to such processing, which may also include the transfer of personal data (in particular your abbreviated IP address, website usage data, device information and individual IDs) to the USA and other countries. Information on Google Analytics data protection can be found here <https:// support.google.com/analytics/answer/ 6004245> and, if you have a Google account, you can find further details on processing by Google here <https://policies.google.
com/technologies/partner-sites?hl=de>.

By confirming the cookie button on our websites, you agree to our terms of use or consent to the use of this technology (note: the selection for your consent to the use of cookies is preset to "technically necessary cookies"). If you do not want this, you must set your browser or e-mail program accordingly.

13. What data do we process on our social network pages?
We may operate pages and other online presences ("fan pages", "channels", "profiles" etc.) on social networks (e.g. Facebook, Instagram, LinkedIn) and other platforms (e.g. Youtube) operated by third parties and collect the data about you described in section 3 there. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). We process this data in particular for the purpose of communicating with and maintaining relationships with our customers, as well as our contractual partners, and on a
case-by-case basis for marketing purposes. We are currently present on Instagram (e.g. @stylies.of.switzerland), LinkedIn, Xing and Youtoube. Instagram Europe belongs to Facebook Ireland Limited. The latter is a company registered under Irish law (of the parent company "Meta", in the USA), which also collects personal data for its own purposes. The responsible body for the operation of the platform for users from Europe is Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. Their privacy policy is available at <www.facebook.com/policy>. Some of your data will be transferred to the USA. For further information on the processing of the operators, please refer to the data protection notices of LinkedIn (<https://privacy.linkedin.com/de-de>), Xing (<https://privacy.xing.com>) and YouTube (<https://www.youtube.com/intl/ALL_de/howyoutubeworks/policies/>). There you can also find out in which countries they process your data, what rights of access, deletion and other rights you have and how you can exercise these rights or obtain further information.

14. Can this privacy policy be changed?
Our privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on our website is the current version.

Last updated: 25th August 2023