Protection des données

Date: August 2026 – Version 2.0 – Language: German (authoritative version)

1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to our privacy policy set out below.

General information on the legal basis for data processing on this website

Where you have consented to the processing of your data, we process your personal data on the basis of Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, where special categories of data as defined in Article 9(1) of the GDPR are processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. Where you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is also carried out on the basis of Section 25(1) of the TDDDG. Consent may be withdrawn at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) of the GDPR. Furthermore, we process your data, insofar as this is necessary to comply with a legal obligation, on the basis of Article 6(1)(c) of the GDPR. Data processing may also take place on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this privacy policy.

Hosting

We host the content of our website with the following provider:

Mittwald CM Service GmbH & Co. KG, Königsberger Strasse 4–6, 32339 Espelkamp – (hereinafter 'Mittwald').

For further details, please refer to Mittwald's privacy policy: https://www.mittwald.de/datenschutz.

The use of Mittwald is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data processing on behalf of a client

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

2. Information on the data controller

The data controller for data processing on this website is:

Amberg Group AG, Trockenloostrasse 21, 8105 Regensdorf-Watt, Switzerland, and – depending on your business relationship – the relevant company within the Amberg Group with which you are in contact. A list of companies with contact details can be found at amberggroup.com/contact. Terms such as 'Amberg', 'we' or 'us' in this statement refer to the relevant company within the Group that is the data controller.

For all enquiries regarding data protection, please contact us by email or by post: Amberg Group AG, Data Protection, Trockenloostrasse 21, 8105 Regensdorf-Watt, Switzerland.

3. Who this policy applies to

This policy applies to visitors to our websites (including amberggroup.com and the websites of Amberg companies, insofar as they refer to this policy), business partners, customers, suppliers, event participants, newsletter subscribers, users of the Amberg video portal and job applicants. The Swiss Data Protection Act (DSG), the EU General Data Protection Regulation (GDPR) and the country-specific provisions set out in section 16 apply.

4. What data we process

Depending on your contact with us, we process the following categories of personal data in particular:

• Technical data: IP address, date and time of access, pages visited, browser and device type, referrer URL (server log files).
• Contact and business data: name, name of the company/organisation, position, telephone number, email address, correspondence, product interest, previous employers (for business contacts).
• Contract and billing data: Data relating to transactions with customers and suppliers.
• Newsletter data: email address, subscription confirmation (double opt-in protocol), open and click-through statistics.
• Video portal registration data: First name and surname, email address, password.
• Job application data: CV, references, qualifications, answers to questions
• Event data: Registration details for events, and, where applicable, photographs and video recordings.

We process special categories of personal data exclusively where you have provided them voluntarily or where we are required to do so by law.

5. Why we process your data (purpose and legal basis)

We process personal data in compliance with the applicable data protection regulations. The processing is based on the following grounds:

• To fulfil contractual obligations or pre-contractual measures.
• On the basis of your consent (e.g. when subscribing to the newsletter or submitting application documents).
• To safeguard our legitimate interests (e.g. for system security, statistical measurement of our website's reach, or effective group organisation).
• Due to legal obligations (e.g. retention or disclosure obligations).

6. Cookies and consent management

Our website uses technically necessary cookies (e.g. to retain language settings and store your cookie preferences). Third-party content (Section 7) is loaded only with your prior consent. The settings you have selected are stored locally on your device and logged anonymously on our servers to meet statutory record-keeping obligations. You can change or withdraw your consent at any time via the 'Privacy settings' link in the footer, with effect for the future. Without your consent, statistical or marketing services will not be loaded.

7. Web analytics (Matomo, hosted locally)

This website uses the open-source web analytics service Matomo. Matomo enables us to collect and analyse data on how visitors use our website. This allows us, amongst other things, to determine when specific pages were viewed and from which region the visitors are accessing the site. We also collect various log files (e.g. IP address, referrer, browsers and operating systems used) and can measure whether our website visitors carry out certain actions (e.g. clicks, etc.).

The use of this analytics tool is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

8. Integrated third-party services

• Social media wall (Walls.io): With your consent, we embed widgets from Walls.io GmbH (Vienna, Austria) on individual pages. In doing so, your IP address and cookie information are transmitted to Walls.io.
• Videos: We embed videos partly via our own Amberg video portal (ambergvideo.com) and partly via YouTube (Google Ireland Limited, Ireland). YouTube videos are only loaded in enhanced privacy mode once you have given your consent. In doing so, data may be transmitted to Google – including to the USA.
• Links to social networks: We use plain links without tracking plugins (LinkedIn, YouTube, etc.). If you click on a link, the privacy policy of the respective provider applies. For our LinkedIn company page, we are jointly responsible with LinkedIn Ireland for the 'Page Insights' statistics.
• Amberg Video Portal: The portal (ambergvideo.com) uses only necessary/functional cookies and a CAPTCHA provided by our hosting partner, Mastersolution AG, Germany.

9. Recipients of personal data

As part of our business activities, we work with various external organisations. In some cases, this requires the transfer of personal data to these external organisations. We only disclose personal data to external parties where this is necessary for the performance of a contract, where we are legally obliged to do so, where we have a legitimate interest in the disclosure pursuant to Article 6(1)(f) of the GDPR, or where another legal basis permits the disclosure of data. When using data processors, we only disclose our customers' personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

10. Cross-border data transfers

As a globally active group of companies, we transfer personal data to our sites and service providers in the following countries: Switzerland, Germany, France, Belgium, Austria, Spain, the Czech Republic, Slovakia, India, China and Canada.

For Switzerland, the EU Member States and Canada (for commercial organisations), the legislator has determined that an adequate level of data protection exists. For data transfers to the USA, we rely on the Swiss-US Data Privacy Framework (or the EU-US DPF). Where data is transferred to countries without an adequate level of data protection, we ensure protection by entering into the European Commission's official Standard Contractual Clauses (SCCs) (including the required Swiss addendum). In addition, we carry out the legally required risk assessments (Transfer Impact Assessments) for these transfers and, where necessary, implement additional technical and organisational safeguards.

11. How we protect your data

For security reasons and to protect confidential content, this website uses SSL or TLS encryption. We also protect your data from unauthorised access, loss and misuse through appropriate state-of-the-art technical and organisational measures (TOMs). These include, in particular, access restrictions based on the 'need-to-know' principle, the logging of system accesses, and strict contractual obligations for our service providers.

12. No automated individual decision-making

We do not make any decisions based solely on automated processing that have legal or similarly significant effects on you. Should this change, we will inform you in advance and grant you the right to a human review.

13. How long we retain your data

Unless a more specific retention period is stated in this privacy policy, your personal data will remain with us until the purpose for which it is processed no longer applies. If you make a valid request for erasure or withdraw your consent to data processing, your data will be erased, provided we have no other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, erasure will take place once these grounds no longer apply.

14. Your rights

Under the law applicable to you, you have the following rights:

• Access to the personal data processed about you.
• Rectification of inaccurate data.
• Deletion, provided there are no statutory retention obligations to the contrary.
• Restriction of processing.
• The right to receive your data in a commonly used electronic format.
• Objection to processing based on legitimate interests, as well as to direct marketing.
• Withdrawal of consent with effect for the future.

To exercise these rights (proof of identity may be required), please contact us by email.

You may also lodge a complaint with a supervisory authority: in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern; within the EEA, with the data protection authority in your place of residence or work.

15. Applications

We use application data exclusively for the recruitment process and only pass it on within the Group to those involved in the process. If the application is submitted via a recruitment agency, we receive the documents from them. We delete application data no later than 6 months after the conclusion of the process; data will only be retained for longer for future vacancies with your consent.

16. Additional information for specific countries

• EEA and the United Kingdom: For individuals in the EEA/UK, the rights set out in the GDPR and the UK GDPR apply respectively. Our primary points of contact as set out in section 1 apply.
• USA: Where US state privacy laws (e.g. California/CCPA) apply, you have rights to access, rectification, erasure and to opt out of the 'sale' or 'sharing' of data. We do not sell personal data or share it for cross-context behavioural advertising.
• Canada / Québec: The body named in section 1 is responsible for the protection of personal data ('Person in charge of the protection of personal information' under the Québec Privacy Act / 'Law 25'). Personal data may be processed outside Québec or Canada.
• Australia: This statement also serves as a Privacy Policy under Schedule 1 of the Privacy Act 1988 (Cth). Please address any complaints in the first instance to the body mentioned in section 1; we will respond within a reasonable timeframe. You may then contact the Office of the Australian Information Commissioner (OAIC). Recipients abroad: see section 9. We do not make any substantially automated decisions within the meaning of the disclosure requirements applicable from 10 December 2026; otherwise, we will describe them here.
• People's Republic of China (PIPL): For transfers abroad and for sensitive personal data, we will – where necessary – obtain your separate consent and use the prescribed transfer mechanisms (CAC standard contractual clauses). In the event of your death, your next of kin may exercise your rights (access, copy, rectification, erasure), provided you have not stipulated otherwise during your lifetime.
• India (DPDP Act): Where the Digital Personal Data Protection Act 2023 applies, we process digital personal data only for lawful purposes with consent or for 'legitimate uses'.
• Middle East (UAE, Saudi Arabia, etc.): Where local data protection laws (e.g. UAE PDPL, Saudi PDPL, DIFC/ADGM free zone regimes) apply, we grant the rights provided for therein and base cross-border transfers on the mechanisms recognised in those jurisdictions. In countries without comprehensive data protection legislation (e.g. Iraq), we apply the principles of this statement as a group standard.
• Other countries: Where other local laws (e.g. the Singapore PDPA, the Japan APPI) provide for additional rights, we grant these in accordance with the relevant law.

17. Connected products and the use of AI

• Connected products: For connected products and associated services (e.g. monitoring and surveying solutions), we provide the information required under the EU Data Act regarding the data generated in the relevant product and contractual documentation.
• Use of AI: We do not currently use AI chatbots on this website. Should we offer AI-supported functions in the future, we will label them in accordance with the requirements of the EU AI Act (Art. 50).

18. Changes to this policy

We may amend this privacy policy at any time. The version published on our website at any given time shall apply. If this policy forms part of an agreement with you, we will inform you of any material changes in an appropriate manner.