Data Protection Advisor

1. Preamble

1.1 Purpose

This Privacy Policy specifies how and for what purposes Transstahl SA processes personal data concerning you (hereinafter "you") that you have provided to us or that we have collected from you.

1.2 Definitions

According to Article 5 paragraph a of the LPD, "personal data" means any data and information concerning an identified or identifiable natural person, or that directly or indirectly allows for the unique identification of a person, whether in physical or electronic form. This includes

• name

• unique identifiers

• location data

• any other data about identity

• physical

• genetic

• psychological

• economic

• cultural or

• social of a person.

According to Article 5 paragraph c of the LPD, the processing of the following personal data falls into the category of "sensitive data":

• data on opinions or religious, philosophical,

political or trade union activities,

• data on health, intimate sphere or racial or ethnic origin,

• genetic data,

• biometric data identifying a natural person uniquely,

• data on legal or administrative proceedings and sanctions,

• data on social assistance measures

1.3 Responsible parties and contact details

Name and address of the persons responsible for processing your personal data:

Transstahl SA

Peter Mattenberger

Data Protection Advisor

Riedstrasse 1

CH-8953 Dietikon

Phone: +41 44 743 22 89

Email: peter.mattenberger@pestalozzi.com

Please contact this person for any questions regarding data protection.

2. Origin and categories of data

2.1 Origin and categories

We primarily process personal data that we receive from our clients, prospects, visitors, and business partners or collect in the course of our activities. We may also process personal data obtained from publicly accessible sources (e.g., websites or public registers such as the commercial register, etc.). Finally, it is also possible that we receive your personal data from business partners, authorities, public services, and other third parties.

The personal data we process includes, in particular and depending on the case, contact details (e.g., name, address, title, gender, date of birth, phone number, and email address), financial information for payment purposes (e.g., bank account details), data on the use of our website (e.g., IP address), and information of all kinds resulting from our correspondence, contacts, and interactions with you.

2.2 Purpose of processing

In principle, we process your personal data for purposes required to conduct our activities and provide our services. This includes, in particular, the following purposes:

• Communication with you, including providing you with information or being able to process your requests, as well as informing you about our new developments;

• Concluding a contract with you, your employer, and your clients and its execution (including billing);

• Operating the infrastructure, including the website or applications used, to make our services available to you, evaluate them, and improve them;

• Using cookies or other tools on the website;

• Marketing (e.g., mailings, with unsubscribe link, events), newsletters, maintaining relationships;

• Market analysis, planning, product and service development;

• Statistics;

• Compliance (adhering to national and international legislation, industry standards, directives, etc.);

• Legal procedures, investigations;

• Maintaining security, access controls;

• Management, risk management;

• Business transactions (e.g., M&A);

• Media activities, PR, publications;

• Services to shareholders, Investor Relations;

• Training, initial and continuing education;

• Security measures for IT systems and buildings (such as access controls, visitor lists, network and email controls, telephone recordings);

• Combating crime and fraud.

2.3 Duration of processing

We process and retain your personal data,

• as long as necessary for the purpose of processing;

• as long as we have a legitimate interest in their retention (enforcement or defense of rights, for archival purposes, and to ensure IT security);

• as long as they are subject to a legal retention obligation (e.g., CO or Olico).

2.4 Recipients of the data

With authorization, we may transmit personal data to the following categories of recipients:

• Suppliers to whom we outsource certain services (e.g., IT service providers and hosts, photographers, payment service providers, etc.);

• Resellers, subcontractors, and other business partners and companies in the Pestalozzi group;

• Auditors;

• National and foreign authorities, state services, or courts;

• Third parties who collect data about you via the website or application.

2.5 Third parties

Third parties who perform services on behalf of Transstahl SA are referred to hereinafter as "subcontractors". Transstahl SA establishes contracts with its subcontractors that guarantee the required requirements and measures to ensure compliance with data protection provisions. Subcontractors will take the necessary security measures to protect your personal data and will be trained by Transstahl SA to process only the data that has been explicitly specified to them as subcontractors.

If you would like more information about our subcontractors, please contact the Data Protection Advisor whose contact details are provided in paragraph 1.3.

2.5.1 International data transfer

In principle, we process your personal data in Switzerland. In certain cases (e.g., in the case of collaboration with certain providers or the use of certain software applications), it is nevertheless possible that your personal data may be transferred abroad. In this context, Transstahl prioritizes partners located in EU member states and in the EEA as much as possible. If this is not possible, the data may be transferred to third countries, including the United States.

If we transfer data to a country that does not have an adequate legislative framework for data protection (so-called unsafe third countries), we ensure, as required by law, to establish a sufficient level of protection through corresponding contractual provisions, or we rely on legal derogatory provisions based on consent, contract execution, assertion, exercise, or enforcement of rights, overriding public interests, publicly disclosed personal data, or preservation of the integrity of the data subject. Nevertheless, we emphasize that data transferred abroad are no longer protected by Swiss law, and that a transmission of this data to authorities and other third parties may be required under foreign legislation and orders from authorities.

3. Data security

We have taken technical and organizational security measures to protect your personal data against loss, destruction, manipulation, and unauthorized access. These security measures are regularly updated and optimized, in line with technological advancements. When you use a service from our website or our e-shop, we collect your personal data. To ensure they do not fall into the wrong hands, we encrypt them using appropriate technical measures.

4. Technical tools

A list of the tools used on our websites to analyze or process data is available in the .

5. Protection of personal data

The Pestalozzi group places great importance on the security of your personal data. Aiming to protect not only your private sphere but also our business partners, clients, and candidates, we manage your personal data in complete confidentiality and in compliance with the provisions of the applicable data protection legislation.

6. Your rights

6.1 Information, rectification, and deletion

Under the applicable data protection legislation, and if provided for, you have the right to obtain free information about the processed data, their rectification, deletion, and limitation of their processing. You also have the right to object to the processing of your data and to require that certain of your personal data be transmitted to you for transfer to another data controller (data portability).

6.2 Revocation

If data processing is based on your consent, you can revoke the consent granted at any time with effect for the future. However, this does not affect the lawfulness of the processing carried out based on your consent before its revocation.

6.3 Contact

To exercise your rights as per paragraphs 6.1 and 6.2, please contact peter.mattenberger@pestalozzi.com.

6.4 Legal application

Any affected person also has the right to assert their rights legally or to submit a complaint to the competent supervisory authority. In Switzerland, the competent supervisory authority is the Federal Data Protection and Transparency Officer (http://www.edoeb.admin.ch).

7. Modifications to this Privacy Policy

We expressly reserve the right to modify this Privacy Policy at any time. If such modifications are made, we will immediately publish the modified version of the Privacy Policy on our website. The applicable version of the Privacy Policy is the one published on our website. Please note that privacy policies and data protection measures, e.g., from Google, may change at any time.

8 Miscellaneous

If certain provisions of these Terms of Use and data protection should prove to be null or unenforceable, the validity and enforceability of the other provisions of the Terms of Use and data protection will not be affected. For any questions and disputes related to the use of Transstahl's services, and within the limits permitted by law, Swiss law applies exclusively, to the express exclusion of the provisions regarding conflicts of laws. Subject to mandatory provisions regarding conflicts of laws. The exclusive jurisdiction is assigned to the courts of Dietikon, subject to mandatory provisions regarding jurisdiction.