DATA PROTECTION STATEMENT

Your trust is important to us, hence we take the subject of data protection seriously and pay attention to the necessary security. It goes without saying that we comply with the statutory provisions of the Federal Data Protection Act (DSG), the Implement-ing Ordinance on the Federal Data Protection Act (VDSG), the Telecommunications Act (FMG) and other possibly applicable data protection provisions of Swiss and EU law, in particular the General Data Protection Regulation (GDPR).

The data controller as per Art. 4 Subsec. 7 EU General Data Protection Regulation (GDPR) is Lyreco Switzerland AG of 8953 Dietikon, Riedstrasse 4.

To enable you to know which personal data are collected by us and the use they are put to, please note the following information:

1. Access to Our Website

When visiting our website, our servers temporarily record every access in the form of a log-in file. The following technical data are logged automatically, essentially with eve-ry connection to a webserver:

- the IP address of the accessing server,

- the registered holder of the IP address range (as a rule, your Internet provider),

- the date and time of access,

- the website from which access was made (the so-called referrer URL) and possibly the search term used,

- the name and URL of the downloaded file,

- the status code (e.g. an error report),

- the operating system of your computer,

- the browser used by you (type, version and language),

- the transfer protocol (e.g. HTTP/1.1) and

- possibly your user name from registration or authentication.

The collection and processing of these data are needed to allow the use of our website (establishment of a connection), to ensure long- term system security and stability and to permit the optimization of our online offer as well as for statistical purposes.

2. Opening a Customer Account

To issue an order in the Online Shop, the opening of a customer account is man-datory. To register a customer account, we require the following data:

- Company name

- First and surname of contact person

- Company address

- Shipping address

- Billing address

- Telephone number

- Email address

- User name

- Password

These data are required to provide the customer with direct password-protected access to his basic data stored by us. This allows the customer to view all previ-ous as well as current orders, and to manage or update his personal data.

3. Purchasing in the Online Shop

If you wish to order from our Online Shop, we require the following data to con-clude a contract:

- Company name

- First and surname of contact person

- Billing address (and shipping address if different from the former))

- Payment data (depending on the payment method selected)

- Log-in data, i.e. email address, password, user name and telephone number (for registered customers)

If not stated otherwise in the present Data Protection Statement, or assuming you have granted your explicit consent, we will use the afore-mentioned data to exe-cute the contract, viz. to process your orders, ship the ordered products and en-sure correct payment.

4. Newsletter

In the regularly published newsletter of Lyreco Switzerland AG, readers are in-formed of our products and services, and are given the latest information around the topic of office products and workplace design.

Lyreco Switzerland AG warrants the confidential treatment of your data. When so desired, you may at any time unsubscribe from the newsletter using the link “Un-subscribe Newsletter” included in every issue.

5. Entry into Contact

When contacting us by email or via a contact form, the data supplied by you (your email address, possibly your name and telephone number) are stored to permit attending to your enquiries. We delete the data logged in this connection as soon as they are no longer required or restrict their processing if statutory archiving obligations require their storage.

6. Data Transfers to Third Parties and Processing Location

We transfer your personal data to third parties only with your explicit consent, in the presence of a legal obligation to do so or when this is required for the assertion of our rights, in particular for the enforcement of claims resulting from our contractual rela-tionship.

In addition, we transfer your data to a third party when this is required as part of the website use or for contract performance (also outside the website), viz. for processing your orders. This includes e.g. the logistics forwarder commissioned to ship ordered products. Besides, your personal data are transmitted to the following recipient: Lyreco Management SAS, Marly (F). Data processing takes places exclusively within Switzerland and the EU.

When we finance a delivery in advance, e.g. with a purchase on invoice basis, we may to safeguard our legitimate interest obtain a credit report from a credit bureau based on a mathematical-statistical process. For this purpose, we transfer the personal data needed for a credit enquiry to a credit bureau [Creditreform, Teufener Strasse 36, 9000 St. Gallen] and use the data received back by us to compute the statistical proba-bility of a default which permits a well-founded decision on whether to establish, con-tinue or terminate the contractual relationship. The credit report may contain proba-bility values (so-called credit scores) computed on the basis of scienti- fically proven mathematical-statistical processes arrived at by including the address data among other items. Your legitimate interests are protected in line with the statutory provi-sions,

Finally, with payment by credit card on our website, we transfer your credit card data to your card issuer as well as to the credit card acquirer. Regarding the processing of your credit card data by these third parties, we suggest you also study the general terms of sale and the data protection statement of your card issuer.

7. Transfer of Data Abroad

We are entitled to transfer your personal data for the purpose of the services listed in this Data Protection Statement also to third parties (commissioned services providers) domiciled abroad. These are committed to data protection to the same extent as our-selves. If the data protection level does not correspond to Swiss and/or EU level, we ensure by way of contractual undertakings that the degree of protection of your per-sonal data corresponds to that of Switzerland and/or the EU at any time.

8. Cookies

Cookies help in many ways to make your visit to our website simpler, more convenient and sensible. Cookies are data files which are automatically stored by your web brows-er on the hard disk of your PC whenever you visit our website.

For example, we use cookies to permit the basket function across several pages and to temporarily store entries filled into a website form to avoid having to repeat the entry when calling up another web page. Cookies may also be used to allow identifying you on the website as a registered user without the need for a renewed log-in when call-ing up another webpage.

Most web browsers accept cookies automatically. You may, however, configure your browser in such a way that no cookies are stored on our computer or that a message is displayed each time a new cookie is placed.

Please note that the deactivation of cookies may result in that not all functions of our website are available in full.

9. Tracking Tools

a. General

With a view to an appropriate design and the ongoing optimization of our website, we employ the web analysis services of Google Analytics. In this connection, pseudony-mised user profiles are created from short text files stored on your computer (so-called cookies). The information on your website use generated by these cookies is then transmitted to the servers of the service provider where it is stored and evaluat-ed on our behalf. In addition to the data listed in Item 1, we may also receive the fol-lowing information:

- the navigation path taken by website visitor,

- the time spent on a website or webpage,

- the webpage from which the website is exited,

- the country, region or city from which access is made,

- the terminal device (type, version, pixel density, resolution, width and height of browser window) and

- whether new or repeat visitor to the website.

This information is used to evaluate user conduct, compile reports on website activi-ties and to provide further services in connection with website use and Internet use generally for the purpose of market research and enhanced website design. Data will only be trans- ferred to third parties when legally required or to duly contracted data processors.

b. Google Analytics

The supplier of Google Analytics is Google Inc., a holding company with seat in the USA. Prior to the data transfer to this provider, the IP address is truncated by activating the anonymization feature of our this website (“anonymizeIP“) within member states of the Euro- pean Union or member states to the treaty on the European Economic Ar-ea. The anonymized IP address transmitted by your browser to Google Analytics is not merged with other Google data. Only in exceptions is the complete IP address trans-mitted to a Google server in the USA and truncated there. In these cases, we ensure through contractual undertakings that an adequate data protection level is observed by Google Inc. According to Google Inc., IP addresses are in no case aggregated with other data concerning that user.

Further information on the web analysis service employed by us can be found on the website of Google Analytics. Instructions on how to prevent the processing of your data by the web analysis service can be found under http://tools.google.com/dlpage/gaoptout?hl=de.

10. Note on Data Transfers to the USA

For the sake of completeness, we advise users with domicile or business seat in Swit-zerland that surveillance measures by US aut- horities are in force in the USA which generally allow the storage of personal data of any person transmitted from Switzer-land to the USA. This occurs without any discrimination, restriction or exception as to the objective pursued and without an objective criterion that would permit limiting access by US authorities to specific strictly limited purposes to legitimize access to these data or their sub- sequent use. We furthermore point out that no legal remedy is available in the USA for data subjects from Switzerland that entitles

them to access these data or to demand their deletion or correction, and that no effective legal rem-edy exists against the rights of data access by US authorities in general. We explicitly point out this legal and factual situation so that data subjects may make an informed decision on whether or not to grant consent to the use of their data.

For users domiciled in a member state of the EU, we point out that for the reasons quoted in this paragraph among others, the USA do not in the view of the European Union have an adequate data protection level. When stated in this Data Protection Statement that data recipients are domiciled in the USA (as e.g. Google), we will en-sure that personal data processed by our partners are protected to an adequate de-gree either through contractual undertakings with these companies or by requiring their certification under the EU or the Swiss-US privacy shield.

11. Data Processing Basis

When processing personal data for the above purposes, we are guided among other things by your acceptance of the present Data Protection Statement, by our obligation to contract performance and our legitimate interest in among other things the maintenance and management of our business relationship, and the communication with you, our business partner, via our company or hosted events.

12. Right to Information, Correction, Deletion and Processing Restriction; Right to Data Portability

You have the right to demand information on your personal data stored by us. In addi-tion, you have the right to the correction of incorrect data and the right to the dele-tion of your personal data provided there is no statutory archiving obligation or oppos-ing cir- cumstances under which we are permitted to process the data.

You furthermore have the right to demand the surrender of the data previously sup-plied to us. At your request, we will also transfer the data to a third party of your choice. You have the right to have the data transferred in a commonly used data for-mat (right to data portability).

When legitimate processing is based on your consent, you have the right to revoke the latter at any time.

You may contact us for the above-mentioned purposes at any time using the email address ch.dataprotection@lyreco.com. To process your request, we may demand the supply of identification at our discretion.

13. Data Security

We employ suitable technical and organizational security measures to protect your personal data stored with us from manipulation, partial or complete loss and unauthor-ized access by third parties. Our security measures are constantly improved to reflect the current state of the art.

14. Data Storage

We store personal data only as long as these are required for the above tracking and analysis services, and for further processing in our legitimate interest. Contract data are stored longer as this is required by a statutory archiving obligation. Archiving obli-gations requiring us to store the data are a function of accounting and tax provisions under law. According to them, business correspondence, concluded contracts and accounting vouchers must be retained for up to 10 years.

15. Right of Complaint to a Supervisory Authority

You have the right to file a complaint with a supervisory authority for data protection at any time.