With this privacy statement, we inform you about how we collect and process personal data in the context of our business relationships with our residents, business partners, and our online presence. Responsible for the data processing described in this privacy statement is:

AVIATHOR GMBH, Huebstrasse 3, 6370 Oberdorf-NW, office@aviathor.com, +41 78 627 21 12

If you provide AVIATHOR GMBH with personal data of other individuals (whom you represent as the responsible party), you must ensure that the person concerned is aware of this privacy statement of AVIATHOR GMBH. If you provide AVIATHOR GMBH with personal data, we assume that you do so within the permissible scope, have informed the concerned parties accordingly, and that the relevant personal data are accurate.

As far as our website is concerned, we take no responsibility and decline all liability for links from our website to third-party websites. Clicking on an external link is entirely at your own risk and responsibility.

In our data processing, we adhere to the legal foundations of the Swiss Federal Act on Data Protection (FADP) and the European General Data Protection Regulation (GDPR), insofar as they are applicable to you.

Collection/Processing of Personal Data, as well as Type/Purpose of Use

Collection and Processing of Personal Data

Personal data refers to all information relating to an identified or identifiable natural person. Primarily, we process personal data that we receive in the context of our business relationships with our clients and business partners due to a contract or other contractual relationship or through correspondence (electronically or by mail) from them and other involved parties, or that we collect through the operation of our website or other applications.

We primarily collect your data directly from you. Where permitted, we also receive personal data from publicly accessible sources (e.g., media, internet) and public registers (e.g., tax registers, commercial registers, etc.). Due to our activities, data can also be provided to us by third parties, in particular by their employees, possible agents, authorities, etc. It is possible that we receive information about you in the course of correspondence and meetings with third parties and from people in your environment (e.g., references, your address for deliveries, powers of attorney, information for compliance with legal requirements, information from banks, insurance companies, sales and other partners) so that we can conclude or execute contracts with you.

The scope of the data we store depends on the existence and nature of the contractual relationship or our business relationship with you. Normally, this includes name, address, date of birth, citizenship, marital status, email address, homepage, telephone numbers, and your professional activity. Concerning the clients, further (also particularly sensitive) personal data may be collected, such as attending physician, health insurance details, and data on health status.

The data processing is justified by your consent, the agreement of a contract or pre-contractual measures, compliance with legal requirements, our interests, and other relevant legal bases.

We specifically point out that we outsource various business activities to ensure our services. In particular, financial services, quality management, and the IT sector could be outsourced. In this context, it is unavoidable that we pass on the data we have received directly from you, a customer/business partner, or third parties to third parties. It also happens that in the context of the outsourced activities, particularly sensitive personal data, e.g., data about health conditions or treatments, are processed and passed on. The data received by us are used only for the purpose agreed upon in the contract, namely to provide the service to the clients themselves. If we commission third parties with the processing of your data, we ensure in these contractual cases that they also comply with data protection regulations.

Visit Our Website

When accessing our website www.aviathor.com, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automatically deleted:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access was made (referrer URL)
• Browser used and, if applicable, the operating system of your computer as well as the name of your access provider

The aforementioned data are used by us to ensure a smooth connection of the website, comfortable use of our website, evaluation of system security and stability, as well as for further administrative purposes. The data processing is justified by a predominantly legitimate interest resulting from the above-listed purposes. In no case do we use the collected data for the purpose of drawing conclusions about you.

Furthermore, we use cookies as well as analysis services when visiting our website. Further explanations can be found under section 5.1 ff. of this privacy policy.

Purpose and Legal Basis of Data Processing

We process your data only for specific purposes and only in legally permissible cases, namely for the fulfillment of the contract between AVIATHOR GMBH and you, to begin and maintain our business relationship with you. Furthermore, your data can be used in connection with the warranties of our operation, the assertion of legal claims (as well as defense), the prevention and investigation of criminal offenses and other misconduct.

The legal basis for data processing may include your consent, the execution of a contract or pre-contractual measures, the fulfillment of legal requirements, overriding interests of us or third parties, as well as other relevant legal grounds.

Insofar as you have given us consent to process your personal data for specific purposes, we process your data within the scope and based on this consent, provided we do not have another legal basis and we need one. A given consent can be revoked at any time, which, however, does not affect data processing that has already taken place.

Disclosure to Third Parties

In the course of providing our services and offering our website, we may need to utilize the services of third parties. In this context, it may occur that we entrust third parties with the processing of your personal data. Under certain circumstances, we may also be obliged to disclose your data to authorities or other third parties. This particularly concerns the following data transfers:

• Our service providers, including processors such as IT service providers
• Other subcontractors, dealers, suppliers, or other business partners
• Authorities, official bodies, or courts
• Interested parties in the acquisition of business units or the company

In all these cases, we strictly observe the provisions of applicable data protection laws.

There may also be a transfer of your personal data to companies abroad. These companies are obligated to data protection to the same extent as we are. If the level of data protection in the country to which data is transferred does not correspond to that of Switzerland or the European Union, we ensure contractually that the same protection as in Switzerland or the European Union is guaranteed. This can be achieved through standard data protection clauses of the European Commission or a supervisory authority, or approved and certified codes of conduct together with binding and enforceable commitments of the recipient, or approved certification mechanisms together with binding and enforceable commitments of the recipient.

Retention Period / Deletion

We store your personal data for as long as necessary to fulfill the various purposes for which the data were collected and as permitted by applicable law, for example, for the duration of the entire business relationship (from initiation, processing to the termination of the contract, and beyond as per the legal retention and documentation obligations).

We will store your personal data as long as there are legal retention obligations or the limitation periods for potential legal claims have not yet expired.

We note that regular backups are made of all electronically stored data. Even after the final deletion of the electronic data, it could potentially be restored from the backups.

Data Security

We take appropriate technical and organizational security measures to protect your personal data against unauthorized access and misuse. This includes the adoption of internal policies, internal training, appropriate IT and network security solutions, access controls, and restrictions, etc. The data is exclusively hosted on Swiss servers.

For data transmission on our website, the SSL procedure (Secure Socket Layer; "https") is used.

Submission of Personal Data

You have the option to contact us via email. In doing so, your email address, the date, the content of your email, and the subject, as well as the contact details you have provided, will be stored for the purpose of processing your request and in case of follow-up questions with us, for as long as it is necessary to complete your request or we are required by law to do so.

The use of emails is technically not secure; it may happen that emails are not delivered. When transmitting emails, they may cross national borders, even if both sender and recipient are in the same country. The confidentiality of emails cannot be guaranteed without adequate encryption. Therefore, unencrypted emails are not suitable for the transmission of confidential information.

By submitting an email, you agree to communicate via email, acknowledging the risks described.

Your Rights

Access, Correction

You have the right at any time to free information about your personal data processed by us. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients of your data, the planned storage duration, etc. You also have the right to correction of incorrect data.

Please contact us for this purpose. You can find our contact details in section 1.1 of this privacy policy.

Revocation/Objection and Deletion

If data processing is based on your consent, you can revoke your consent at any time and request the deletion of your personal data. Furthermore, you may be able to restrict the processing of your personal data or object to it. Under certain circumstances, you may also have the right to retrieve the data you have provided to us (right to data portability).

If you wish to make use of these rights, please contact us. You can find our contact details in section 1.1 of this privacy policy.

However, please note that we are legally obligated to keep booking receipts for at least 10 business years or longer due to commercial and tax laws. Therefore, we cannot delete or edit the personal data contained in these documents. Your request for deletion will thus be complied with only after the retention period has expired.

If there are still services outstanding at the time of receiving your objection, revocation, and deletion request, your personal data will continue to be processed until the complete termination of the business relationship. Your data protection revocation explicitly has no impact on the processing of existing contractual relationships and is not considered an extraordinary reason for termination.

Adjustments to This Privacy Policy

We reserve the right to change this privacy policy at any time without prior notice and to inform customers, residents, business partners, and users about the changes in a suitable manner.

Changes to this privacy policy are effective from the time of their publication on our website. The version published on our website at any given time is applicable. The processing of personal data collected under an older privacy policy will be conducted in accordance with this current privacy policy.

Contact Point for Questions

If you have any questions regarding this privacy policy or concerning your personal data, we are happy to assist you at office@aviathor.com.

Special Notes Regarding Visiting Our Website

Cookies

We use cookies on our website. These are small files automatically created by your browser and stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not harm your device, nor do they contain viruses, Trojans, or other malware.

Cookies store information related to the specific device used. However, this does not mean that we directly learn your identity.

The use of cookies serves to make the use of our offerings more pleasant for you. For instance, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted after you leave our site.

Furthermore, we also use temporary cookies to optimize user-friendliness, which are stored on your device for a specific predetermined period. If you visit our site again to use our services, it will automatically recognize that you have been with us before and what inputs and settings you have made, so you do not have to enter them again.

Additionally, we use cookies to statistically record the use of our website and to optimize the user experience; these analyses are not personal. These cookies allow us to automatically recognize on your next visit that you have already been with us. These cookies are automatically deleted after a defined period.

The data processed by cookies are necessary for the mentioned purposes to protect our legitimate interests and those of third parties.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice appears before a new cookie is created. The complete deactivation of cookies may mean that you cannot use all the features of our website.

Google Services

The tracking measures and Google services listed below and used by us are necessary to protect our legitimate interests and those of third parties. We use the tracking measures to ensure a needs-based design and the continuous optimization of our website. On the other hand, we use the tracking measures to statistically record the use of our website and to optimize the user experience; these analyses are not personal.

The respective data processing purposes and data categories can be found in the corresponding tracking tools.

Google Analytics

For the purpose of tailoring our website to needs and ongoing optimization, we use Google Analytics, a web analysis service of Google Inc. (https://www.google.com/intl/en/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter "Google"), or comparable services. In this context, pseudonymized user profiles are created, and cookies (see section 5.1) are used. The information generated by the cookie about your use of this website (such as browser type/version, operating system used, referrer URL (the previously visited page), hostname of the accessing computer (IP address), time of the server request) is transmitted to a Google server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activities, and to provide other services related to website and internet use for the purposes of market research and tailoring these internet pages to users' needs. This information may also be transferred to third parties if required by law or if third parties process this data on behalf of Google. Your IP address will not be merged with other Google data.

You may refuse the use of cookies by selecting the appropriate settings on your browser; however, please note that if you do this, you may not be able to use the full functionality of this website.

You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and from processing this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en).
As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on https://tools.google.com/dlpage/gaoptout. An opt-out cookie will be set to prevent future collection of your data when visiting this website. The opt-out cookie is valid only in this browser and only for our website and will be stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.

Further information on data protection in connection with Google Analytics can be found, for example, in the Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=en).

Facebook

On our website, we use social media plugins from Facebook to make their use more personal. For this purpose, we utilize the "LIKE" or "SHARE" button. This is an offering from Facebook. When you visit a page of our website that contains such a plugin, your browser establishes a direct connection with Facebook's servers. The content of the plugin is transmitted directly to your browser by Facebook and integrated into the webpage. By integrating the plugins, Facebook receives the information that your browser has accessed the corresponding page of our web presence, even if you do not have a Facebook account or are not currently logged in to Facebook. This information (including your IP address) is transmitted from your browser directly to a Facebook server in the USA and stored there.

If you are logged into Facebook, Facebook can directly associate the visit to our website with your Facebook account. If you interact with the plugins, for example by pressing the "LIKE" or "SHARE" button, the corresponding information is also transmitted directly to a Facebook server and stored there. The information is also published on Facebook and displayed to your Facebook friends.

Facebook may use this information for the purposes of advertising, market research, and tailoring Facebook pages to your needs. To this end, Facebook creates usage, interest, and relationship profiles, e.g., to evaluate your use of our website with respect to the advertisements displayed to you on Facebook, to inform other Facebook users about your activities on our website, and to provide other services associated with the use of Facebook. If you do not want Facebook to associate the data collected through our web presence with your Facebook account, you must log out of Facebook before visiting our website.

For information on the purpose and scope of data collection and the further processing and use of data by Facebook, as well as your rights in this regard and settings options for protecting your privacy, please refer to Facebook's privacy policy (https://www.facebook.com/about/privacy/).

Twitter

On our website, we have integrated plugins from the short message network of Twitter Inc. (Twitter). The Twitter plugins (tweet button) can be recognized by the Twitter logo on our page. An overview of tweet buttons can be found here (https://about.twitter.com/resources/buttons).

When you visit a page of our web presence that contains such a plugin, a direct connection is established between your browser and the Twitter server.

Twitter thereby receives the information that you have visited our page with your IP address. If you click the Twitter "tweet button" while you are logged into your Twitter account, you can link the contents of our pages to your Twitter profile. This allows Twitter to assign the visit to our pages to your user account.

We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Twitter. If you do not wish Twitter to be able to associate your visit to our pages, please log out of your Twitter user account.

For more information, please refer to Twitter's privacy policy (https://twitter.com/privacy).

LinkedIn

Our website integrates plugins from LinkedIn. You can identify the LinkedIn plugins by the LinkedIn logo on our page (for more information about the LinkedIn plugin, see https://developer.linkedin.com/plugins).

When you visit a page of our website that contains such a plugin, a direct connection is established between your browser and the LinkedIn server.

LinkedIn thereby receives the information that you have visited our site with your IP address. If you click on the LinkedIn button while you are logged into your LinkedIn account, you can link the contents of our pages on your LinkedIn profile. This allows LinkedIn to associate the visit to our pages with your user account.

For more information, please see LinkedIn's privacy policy (https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy) and cookie policy (https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy).

XING

Our website integrates plugins from XING. You can identify the XING plugins by the XING logo on our page (for more information about the XING plugin, see https://dev.xing.com/plugins).

When you visit a page of our website that contains such a plugin, a direct connection is established between your browser and the XING server.

XING thereby receives the information that you have visited our site with your IP address. If you click on the XING button while you are logged into your XING account, you can link the contents of our pages on your XING profile. This allows XING to associate the visit to our pages with your user account.

For more information, please see XING's privacy policy (https://privacy.xing.com/de/datenschutzerklaerung).

SBB CFF FFS

On the contact page of our website, you will find a link to the SBB timetable. By clicking on the link, a direct connection is established between your browser and the SBB server (https://www.sbb.ch/de/home.html), and thus personal data is transmitted.

For the purpose and scope of data collection and the further processing and use of data by SBB, as well as your related rights and settings options for protecting your privacy, please refer to the privacy policy of SBB (https://www.sbb.ch/de/meta/legallines/datenschutz.html)