DATA PROTECTION DECLARATION

I. Name and address of the responsible person
The responsible company in the sense of the data protection provisions is: 

Montana Building Systems Ltd.
Durisolstrasse 11
5612 Villmergen
Switzerland
Tel.: +41 56 619 85 85
E-mail: info@montana-ag.ch
Website: www.montana-ag.ch / www.holorib.de

II. Name and address of the authorised data protection officer
The authorised data protection officer of the responsible person is the Managing Director of Montana Building Systems Ltd.

III. General information about data processing

1. Scope of processing of personal data
We process personal data of our users only where this is required for the provision of a functioning website or for our contents and performances. In accordance with regulations we only process personal data of our users after the consent of the user. An exception applies in those cases in which it is not possible to obtain prior consent for material reasons and the processing of the data is permitted on legal grounds.

2. Legal basis for processing of personal data
Art. 13 para. of the Swiss data protection act (DPA) or Art 6 para. 1 lit. a of the EU General Data Protection Regulation (GDPR) form the legal basis for our obtaining consent from the affected party to the processing of personal data.
Art. 13 para. 2 lit. a DPA or Art. 6 para. 1 lit. b GDPR form the legal basis for the processing of personal data which is required for the fulfilment of a contract wherein the contract person is the affected person. This also applies for processing which is required for the implementation of pre-contract measures.
Art. 13 para. 1 DPA or Art. 6 para. 1 lit. c GDPR form the legal basis when the processing of personal data is required for the fulfilment of a legal duty to which our company is subject.
Art. 6 para. 1 lit. d GDPR forms the legal basis if essential interests of the affected person or of another legal entity require the processing of personal data.
Art. 13 para. 1 DPA or Art. 6 para. 1 lit. f GDPR form the legal basis for the processing of such data if said processing is required for the preservation of an authorised interest of our company or of a third person and if said interests do not outweigh the interests, basic rights and basic freedoms of the affected party.

3. Data deletion and storage duration
The personal data of the affected person shall be deleted or blocked as soon as the purpose of saving no longer applies. Data may also be stored if provided for by the legislator in ordinances, laws or other directives, to which the responsible persons are subject. Data shall also be blocked or deleted if a storage deadline specified by the cited standards expires unless there is a need to save the data for longer for a contract conclusion or for the fulfilment of a contract.

IV. Provision of the website and production of logfiles

1. Description and scope of the data processing
Every time our Internet site is visited, our system collects automated data and information about the computer system of the user's computer. The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's Internet service provider
• The user's IP address
• The date and time of access
• Websites from which the user's system accesses our website
• Websites which the user's system activates via our website

This data is also saved in the logfiles of our system. This data is not stored together with the user's other personal data.

2. Purpose of data processing
Temporary saving of the IP address by the system is necessary to enable delivery of the website to the user's computer. The user's IP address must be saved for the duration of the session. 
Saving takes place in logfiles which ensure the operability of the website. The data is also used for optimising the website and for ensuring the safety of our information technology system. We do not analyse the data for marketing purposes in this context.

3. How long is the data saved?
The logfiles are never deleted.

4. Opt-out and removal option
The collection of data for the provision of the website and the storing of the data in logfiles is an essential requirement for the operation of the internet site. There is consequently no opt-out option on the part of the user.

V. Use of cookies

1. Description and scope of the data processing
Our website uses cookies. Cookies are text files which are saved in the Internet browser and/or from the Internet browser on the user's computer system. If a user activates a website, a cookie can be stored on the user's operating system. This cookie includes a characteristic array of characters which enable unique identification of the browser the next time the website is activated. We also use cookies on our website which enable analysis of the surfing behaviour of the user. In this way the following data may be transmitted:

• Entered search terms
• Frequency of page activations
• Use of website functions

The user data obtained in this way is technically pseudonymised. It is not therefore possible to connect the data to the activating user. The data is not stored together with other personal data of the user.
When activating our website, the user is informed by an info-banner about the use of cookies for analysis purposes and is referred to this data protection declaration.
 
2. Purpose of data processing
Analysis cookies are used to improve the quality of our website and its content for you. Analysis cookies tell us how the website is being used so that we can continuously improve our offer.
 
3. Duration of storage, opt-out and removal option
Cookies are saved on the user's computer and transferred by the computer to our page. As a user therefore you also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or limit the transfer of cookies. Previously saved cookies can be deleted at any time. This can also take place automatically. If you deactivate cookies for our website it is possible that you may not be able to use all the website functions fully.

VI. Registration

1. Description and scope of the data processing
We offer our users the option to register with their personal data on our Internet page and in the customer portal. The data is entered into an input screen. It is transmitted to us and stored. There is no disclosure of the data to third parties. The following data is collected in the context of the registration process:

• Company
• Contact person
• Address
• Town
• Country
• Telephone number
• E-mail address
• Activity field

The following data is also stored:

• User's IP address
• Date and time of registration
• Date and time of the last visit (overwritten with the latest data)

The consent of the user for the processing of the data is obtained in the context of the registration process.

2. Purpose of data processing
Registration of the user is required for the provision of particular contents and performances of our website and for participation in certain events.

3. How long is the data saved?
The data is deleted when no longer required to achieve the purpose for which it was collected.

4. Opt-out and removal option
As the user you can un-register at any time. You can change the saved data at any time. To do so, contact us via marketing@montana-ag.ch.
If the data is required for fulfilment of a contract or to perform pre-contract measures, premature deletion of the data is only possible if deletion does not conflict with contractual or legal obligations.

VII. Contact form and e-mail contact

1. Description and scope of the data processing
There is a contact form on our website which you can use to establish contact by electronic channels. If a user fills in details in this form, the data entered is sent to and stored by us. This data is:

• Company
• Contact person
• Address
• Town
• Country
• Telephone number
• E-mail address
• Activity field

At the timing of sending, the following data is also stored:

• User's IP address
• Date and time of registration

In the context of the sending process, your consent is obtained for the processing of the data and reference is made to this data protection declaration.
Alternatively, contact is possible via the e-mail address provided. In this context there is no disclosure of the data to third parties. The data is used exclusively for processing the conversation.

2. Purpose of data processing
The personal data from the input screen is processed by us solely to establish contact. E-mail contact is subject also to the required legitimate interest in the processing of the data.
The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the safety of our information systems.

3. How long is the data saved?
The data is deleted when no longer required to achieve the purpose for which it was collected.

4. Opt-out and removal option
The user may withdraw consent for the processing of the personal data at any time. Users who contact us by e-mail may opt out of the storage of their personal data at any time. In such a case the conversation cannot proceed. The opt-out option is exercised by e-mail to marketing@montana-ag.ch.
In this case all personal data, saved in the process of establishing contact, is deleted.

VIII. Web analysis

1. Scope of processing of personal data
We use the Google Analytics tool on our website to analyse the surfing behaviour of our users. The software places a cookie on the user's computer (for cookies, see above). When individual pages of our website are actuated, the following data is stored:

• Two bytes of the IP address of the activating system of the user
• The activated website
• The website from which the user accesses the activated website (referrer)
• The sub-pages which are activated from the activated website
• The time spent on the website
• The frequency of activation of the website

The software runs exclusively on the servers of our website. The personal data of the user is only stored there. There is no disclosure of the data to third parties.
The software settings are such that the IP-addresses are not saved completely. 2 bytes of the IP address are masked (e.g.: 192.168.xxx.xxx). This abbreviated IP address cannot be linked to the activating computer.

2. Purpose of data processing
The processing of the user's personal data enables us to analyse the surfing behaviour of our users. By analysing the data collected, we can compile information about the use of the individual components of our website. This helps us to improve our website and its user-friendliness. This is also our legitimate interest in the processing of your data. By anonymising the IP address, adequate account has been taken of the interests of the user in the protection of their personal data.

3. How long is the data saved?
The data is deleted as soon as we have fulfilled our purposes in recording the said data. In our case this is after 36 months.

4. Opt-out and removal option
Cookies are saved on the user's computer and transferred by the computer to our page. As a user therefore you also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or limit the transfer of cookies. Previously saved cookies can be deleted at any time. This can also take place automatically. If you deactivate cookies for our website it is possible that you may not be able to use all the website functions fully.

IX. Rights of the affected person
If personal data about you is processed, you have the following rights with respect to the responsible person:

1. Right of information
You can request confirmation from the responsible person about whether we are processing personal data relating to you. If processing does take place, you may request the following information from the responsible person:

• the purposes for which the personal data is processed;
• the categories of personal data which are processed;
• the recipients and/or the categories of recipient, to which the personal data relating to you has or will be disclosed;
• the planned duration for which the personal data relating to you will be saved or, if concrete information is not available, the criteria for defining said duration;
• the existence of the right to correct or delete the personal data relating to you, the right to limit the processing by the responsible person or the right to opt out of said processing;

You have the right to demand information about whether the personal data relating to you will be transmitted to a non-EU country or to an international organisation. In this context you can request appropriate guarantees in relation to the transfer of data.

2. Right of correction
You have the right of correction and/or completion with respect to the responsible person insofar as the processed personal data relating to you is incorrect or incomplete. The responsible person shall make the correction immediately.

3. Right of deletion

a) Duty of deletion
You can request to the responsible person that the personal data relating to you is deleted immediately whereupon the responsible person is obliged to delete said data immediately.

b) Information to third parties
If the responsible person publishes the personal data relating to you and if said responsible person is obliged to delete said data, s/he must take appropriate measures, including technical measures using all available technology and bearing implementation costs in mind, to inform those persons responsible for processing said personal data that you, as an affected person, have requested the deletion of all links to said personal data and of copies or replications of said personal data.

4. Right to instruction
If you have asserted the right of correction, deletion or limitation of the processing with respect to the responsible person, said person is obliged to share this correction, deletion or limitation of the processing with all recipients to whom the personal data relating to you has been disclosed unless this is impossible or would be associated with unreasonable expense. You are entitled with respect to the responsible person to be instructed about said recipients.

5. Right to data transferability
According to the GDPR you have the right to access the personal data relating to you and which you have provided to the responsible person, in a structured, standard and machine-readable format. You also have the right to transfer said data to another responsible person without hindrance by the responsible person to whom the personal data was given, provided

• that the processing is based on a consent or on a contract and
• the processing is performed by an automated method.

In the exercise of this right you have moreover the right to insist that the personal data relating to you is transmitted directly from one responsible person to another responsible person insofar as this is technically feasible. This shall not affect the freedoms and rights of other persons.
The right to data transferability does not apply to the processing of personal data which has been transferred to the responsible person, if said transferability is required to fulfil a task in the public interest or is required in the exercise of public authority.

6. Right to opt out
You have the right, for reasons relating to your special situation due to a public or justifiable interest, to opt out at any time to the processing of the personal data relating to you; this also applies for profiling based on these provisions.
The responsible person shall cease to process the personal data relating to you unless s/he can prove compelling legal grounds for said processing which outweigh your interests, rights and freedoms, or wherein the processing serves the assertion, exercise or defence of legal claims.
If the personal data relating to you is processed for the purposes of direct advertising, you have the right to opt out at any time of the processing of the personal data relating to you for the purpose of such advertising; this also applies for profiling inasmuch is this is in relation to direct advertising.
If you opt out of the processing for the purposes of direct advertising, the personal data relating to you shall no longer be processed for these purposes.

7. Right to withdraw declaration of consent with regard to data protection
You have the right to withdraw your declaration of consent with regard to legal data protection at any time. Withdrawal of consent does not affect the legality of the processing which took place on the basis of your consent until the time of the withdrawal.

8. Automated decision in individual cases including Profiling
You have the right not to accept a decision made exclusively based on automated processing, including profiling, which has a legal effect or a similarly substantial negative impact on you. This does not apply if the decision

• is required for the conclusion or the fulfilment of a contract between you and the responsible person,
• is permitted based on legal directives to which the responsible person is subject and these legal directives include appropriate measures for guaranteeing your rights and freedoms and your legitimate interests or
• take place with your express consent.

Nevertheless, these decisions may not depend on special categories of personal data unless express consent or a legal principle and appropriate measures have been taken for the protection of your rights and freedoms and your legitimate interests.
In respect of the cases referred to above, the responsible person shall take appropriate measures to guarantee the rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person on the part of the responsible person, to express his or her own position and to contest the decision.

9. Right of appeal to a supervisory authority
Without prejudice to other administrative or legal remedies according to GDPR you have the right of appeal to a supervisory authority if you feel that the processing of the personal data relating to you infringes against the GDPR.
The supervisory authority with which the appeal is lodged shall instruct the appellant of the situation and the results of the appeal including the possibility of legal remedy.

10. Video surveillance
The installation of video cameras including a recording system on the premises of Montana Building Systems Ltd. is intended to enable persons in danger (e.g. working alone) to be recognised as quickly as possible so that the rescue of persons involved in an accident (e.g. at the truss ramp) can be triggered immediately and any accidents analysed in order to avoid them in the future. Recording starts as soon as there is any movement in the camera's field of vision. Furthermore, the video cameras secure the entrances and exits and other monitored areas in order to prevent possible burglary attempts and damage to property, or to clarify these. All other viewing areas are covered by software (pixelated).
Video surveillance images that identify persons are subject to the Federal Law on Data Protection (DSG; SR 235.1).
Upon entering the video-surveillance areas, persons will be informed of the video surveillance by means of clearly visible signs.

NOTICE
The German version of our Data Protection Declaration shall be decisive in the event of a dispute.