Privacy Policy

This privacy policy provides you with an overview of the processing of your personal data by Jaywalker AG in connection with the Stu-Mehrwertprogramm.

We use the term «data» here as equivalent to «personal data». By «personal data» we mean data that relates to an identified or identifiable person, and «processing» means any handling of personal data, e.g. collecting, storing, using, altering, disclosing and deleting.

If you disclose data about other persons to us (e.g. family members), we assume that you are authorised to do so and that this data is accurate. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

1. Controllers responsible for the data processing

We (Jaywalker AG, Alpenquai 4, 6005 Lucerne, Switzerland) are responsible for processing your data as a Stu-Member and for operating the Stu value programme, in principle jointly with the Kantonalbank at which you, as a Stu-Member, hold a private account and through which you concluded the contract with us. In this privacy policy we refer to it hereafter as the «Kantonalbank». You will find the data protection contact details in the privacy policy of the respective Kantonalbank. This concerns in particular the processing of the personal data that we receive from it for the operation of the Stu value programme.

For the further data processing that we describe here, e.g. in connection with our website, we are responsible alone or together with other third parties whom we will name to you in this privacy policy or in another appropriate way.

If you have data protection concerns, you can send them to us at the following contact address: datenschutz@jaywalker.ch.

2. Collection and processing of personal data

We collect in particular the following personal data:

• Master data: This is general personal data, such as name, contact details or further information about you (e.g. about roles and functions) as well as your relationship with us.
• Registration data: This is data that arises when you register via the Stu-App, or that you provide to us (e.g. e-mail, mobile number, password, IBAN), but also data that arises in connection with competitions.
• Contract data: This is data that arises in connection with a contract concluded with us and our offers, e.g. in the course of operating the Stu-Mehrwertprogramm (e.g. information about the date of conclusion of the contract, information required or used for processing, such as the Stu status, the contract term or also financial data).
• Financial data: Financial data is data about your finances, e.g. about the type of account or card transactions made with the debit Stu card.
• Communication data: This is data that arises in connection with communication between us and with third parties (e.g. the content of the communication or metadata).
• Technical data: This is data that arises when using our electronic offerings (e.g. website, apps), such as IP address, information about the operating system of your device, the region and the time of use. Technical data on its own does not, in principle, allow any conclusions to be drawn about your identity. However, it can be linked with other categories of data (e.g. registration data) and thus, where applicable, with your person.
• Behavioural and preference data: This is data about your behaviour and your preferences, such as reactions to electronic communications or special Stu benefits, your purchasing behaviour, navigation in the Stu-App, interactions with our social media profiles, participation in competitions or events, etc., where applicable supplemented with information from third parties (also from publicly accessible sources).
• Other data: This includes in particular data that is processed in connection with administrative or judicial proceedings (e.g. files, evidence, etc.), data on participation in events or other campaigns, photos, video or audio recordings that we produce or receive from third parties and on which you are recognisable (e.g. at events).

3. Purposes of the data processing and legal bases

We process your personal data for the following purposes:

• Communication: We process data in order to communicate with you or third parties by e-mail, telephone, letter or otherwise (e.g. responding to enquiries). If we have to or wish to establish your identity, we collect additional data (e.g. a copy of an identity document).
• Initiation, conclusion, administration and performance of contracts: In connection with the initiation, conclusion, administration or performance of contracts with you or other contractual partners (e.g. project partners), we process personal data. This includes in particular the processing of master and financial data for the purpose of operating the Stu-Mehrwertprogramm or setting up a Stu customer profile with which the Stu-Member obtains access to the entire online offering of Stu.
• Support: We process data in order to provide support services to Stu-Members, for example in the event of problems with the Stu-App. For this purpose we may, among other things, link technical data with master data of the respective Stu-Member. It may also be necessary for us to verify your identity before we provide the support service. For this we may, among other things, also request a copy of an identity document.
• Monitoring the use of the Stu-Mehrwertprogramm: In order to ensure that the Stu-Mehrwertprogramm is used only in the manner we have agreed with the Stu-Partner, and to prevent or investigate misuse, we may process data (in particular master, contract and financial data). We also point this out in the GTC-M for the value programme.
• Relationship management and for marketing purposes: We also process your data for relationship management and for marketing purposes, namely in order to send you (also personalised) advertising (e.g. in the Stu new-customer flyer, in the Stu printletter, on the Stu website, in the Stu-App or in the newsletter) from us and from third parties (e.g. from partner companies) or in the course of individual marketing campaigns (e.g. events, competitions). You can decline these communications at any time or refuse or revoke consent to being contacted for advertising purposes by notifying us (see contact details in section 1).
• Market research, improvement of our services and product development: We process data in order to continuously improve our app and website, to be able to respond quickly to changing needs and to further optimise our services, so that in future we can offer you, e.g., even more attractive and more suitable Stu benefits.
• Preparation of the Stu-Partner report: We also process data in order to prepare reports for our Stu-Partners and to pass these on, which give them information about the composition of the customers who have claimed a Stu discount benefit, and at what times, on which days and for what amounts they made purchases. Although these reports are in principle passed on to the Stu-Partners only in anonymised form, it cannot be ruled out that, on the basis of data already available at the Stu-Partner, the latter may in individual cases be able to identify a Stu-Member.
• Collection, analysis, documentation of performance and preparation of reports: We process data in order to collect, document and analyse the performance [of our offerings, in particular] of the Stu-Mehrwertprogramm, e.g. in order to identify changes at an early stage and to be able to respond to them. We also prepare corresponding reports for ourselves as well as for the Kantonalbank. For this purpose we collect and process, e.g., data on the use of the offerings, in particular on the type, number and scope of transactions. The reports for the Kantonalbank generally do not contain any data that can be attributed to an individual person, but it cannot be ruled out that, on the basis of data already available at the Kantonalbank or other circumstances, persons can be identified.
• Operation of our website and app: In order to be able to operate these in a stable and secure manner, we also process data (for further information see section 4).
• Registration: In order to use certain offers and services (e.g. the Stu-App), you must register. For this we process the data disclosed in the course of the respective registration. Furthermore, we may also collect data about you during the use of the offer or service.
• Security purposes: We process data in order to ensure and continuously improve the security of our IT systems and our other infrastructure. This includes, e.g., the monitoring and control of electronic access to our IT systems, analyses and tests of our IT infrastructures, system and error checks and the creation of backup copies.
• Compliance with laws, instructions, recommendations of authorities and compliance: In the course of complying with laws we may process data (e.g. combating money laundering, tax obligations). In addition, data processing may take place in the course of internal and external investigations (e.g. by a law enforcement or supervisory authority or a commissioned private body). The legal obligations may be Swiss law, but also foreign provisions to which we are subject, as well as self-regulation, industry standards, our own «corporate governance» and official instructions and requests.
• Risk management and corporate governance: We collect and process data in the course of risk management (e.g. protection against criminal activities and monitoring of del credere risk) and corporate governance (e.g. liquidity management).
• Further purposes: These include, e.g., training or administrative purposes (e.g. accounting) or the organisation, conduct and follow-up of events. We may use your data in preparation for or in the course of proceedings before authorities or courts, in particular for the assertion and enforcement of legal claims, or also in order to defend ourselves against asserted claims. Safeguarding further legitimate interests is also among the further purposes, which cannot be listed exhaustively.

4. Cookies / tracking and other technologies

When you use our app or website (incl. newsletter and other digital offerings), data arises that is stored in logs (in particular technical data). We use cookies and comparable techniques in order to recognise website visitors, to evaluate their behaviour and to identify preferences. A cookie is a small file that is transmitted between the server and your system and that enables the recognition of a specific device or browser.

You can set your browser so that it automatically rejects, accepts or deletes cookies. You can also deactivate or delete cookies in individual cases. You can find out how to manage cookies in your browser in the help menu of your browser.

In addition to cookies that are used only during a session and are deleted after your website visit («session cookies»), cookies may also be used, e.g., to store user settings and other information over a certain period («permanent cookies»). We use permanent cookies so that you can save user settings (e.g. language, auto-login) and so that we can better understand how you use our offerings and content.

In our newsletters and other marketing e-mails we sometimes incorporate, and to the extent permitted, both visible and invisible image elements, through the retrieval of which from our servers we can determine whether and when you opened the e-mail, so that here too we can measure and better understand how you use our offerings in order to be able to tailor them to you. You can block this in your e-mail programme; most are preset to do this.

We also use social media plug-ins, which are small software components that establish a connection between your visit to our website and a third-party provider. The social media plug-in informs the third-party provider that you have visited our website and can transmit to the third-party provider cookies that it has previously placed on your web browser. Further information about how these third-party providers use your personal data collected via their social media plug-ins can be found in their respective privacy policies.

In addition, we use our own tools as well as services from third-party providers (which for their part may use cookies) on our website, in particular in order to improve the functionality or the content of our website (e.g. integration of videos or maps), to create statistics and to display advertising.

Currently we may use in particular the offerings of the following service providers and advertising partners, whereby their contact details and further information on the individual data processing can be accessed in the respective privacy policy:

Some of the third-party providers we use may be located outside Switzerland. Information on the disclosure of data abroad can be found under section 12. From a data protection perspective, they are in some cases «only» processors on our behalf and in some cases responsible bodies. The privacy policies contain further information on this.

• Google Analytics Provider: Google Ireland Ltd., Ireland Privacy policy: https://policies.google.com/privacy?hl=de
• Google Tag Manager Provider: Google Ireland Ltd., Ireland Privacy policy: https://policies.google.com/privacy?hl=de
• Google Maps Provider: Google LLC, USA Privacy policy: https://policies.google.com/privacy?hl=de
• Google Firebase Provider: Google Ireland Ltd., Ireland Privacy policy: https://policies.google.com/privacy?hl=de
• Youtube Provider: Google Ireland Ltd., Ireland Privacy policy: https://policies.google.com/privacy?hl=de
• Facebook Provider: Meta Platforms Ireland Ltd., Ireland Privacy policy: www.facebook.com/privacy/policy
• Instagram Provider: Meta Platforms Ireland Ltd., Ireland Privacy policy: https://privacycenter.instagram.com/policy
• TikTok Provider: TikTok Technology Ltd., Ireland and TikTok Information Technologies UK Ltd., GB Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de
• Snapchat Provider: Snap Inc., USA Privacy policy: https://values.snap.com/de-DE/privacy/privacy-policy
• aiaibot.com Provider: swiss moonshot AG, Switzerland Privacy policy: https://www.aiaibot.com/de/datenschutz

5. How do we process personal data on our pages in social networks?

On social networks and other platforms operated by third parties we operate pages and other online presences and, in this connection, process data about you. In doing so, we receive data from you (e.g. when you communicate with us or comment on our content) and from the platforms (e.g. statistics). The providers of the platforms can analyse your usage and process this data together with other data they hold about you. They also process this data for their own purposes (e.g. marketing and market research purposes and to administer their platforms), and act for this purpose as controllers in their own right. Please refer to the privacy policies of the respective platforms for further information on the processing by the platform operators.

We currently use the following platforms, whereby the identity and contact details of the platform operator can in each case be accessed in the privacy policy:

We are entitled, but not obliged, to review third-party content before or after its publication on our online presences, to delete content without notice and, where applicable, to report it to the provider of the platform concerned.

Some of the platform operators may be located outside Switzerland. Information on the disclosure of data abroad can be found under section 12.

• Facebook Our profiles: https://www.facebook.com/stu.cashback/ and https://www.facebook.com/stucard.stu Provider: Meta Platforms Ireland Ltd., Ireland Privacy policy: www.facebook.com/privacy/policy
• Instagram Our profile: https://www.instagram.com/stucard.stu/ Provider Meta Platforms Ireland Ltd., Ireland Privacy policy: https://privacycenter.instagram.com/policy
• Youtube Our profile: https://www.youtube.com/@STUcard_Stu and https://www.youtube.com/@Stu-Vorteilsapp Provider: Google Ireland Ltd., Ireland Privacy policy: https://policies.google.com/privacy?hl=de
• TikTok Our profile: https://www.tiktok.com/@stucard.stu Provider: TikTok Technology Ltd., Ireland and TikTok Information Technologies UK Ltd., GB Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de
• Snapchat Provider: Snap Inc., USA Privacy policy: https://values.snap.com/de-DE/privacy/privacy-policy

6. Use of messenger services

In order to communicate with you, in addition to the chat function that is integrated on our websites and in the Stu-App, e-mail and telephone, we also use well-known messenger services. These process your data under their own responsibility. If you contact us via one of these platforms, we assume that you agree to us replying to you via these channels or contacting you again. We use the following messenger services:

• WhatsApp Provider: WhatsApp Ireland Limited, Ireland Privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea
• Instagram Messenger Provider: Meta Platforms Ireland Ltd., Ireland Privacy policy: https://privacycenter.instagram.com/policy

7. Where does the data come from?

• From you: You disclose data to us in accordance with section 2 yourself (e.g. in the course of communicating with us, in connection with contracts or our offering, by using our website and further services, etc.). You are not obliged to disclose your data, with exceptions in individual cases (e.g. legal obligations such as legally required identity verification or protection concepts). However, if you wish to conclude contracts with us or make use of our offerings, you must disclose certain data to us (in particular master, contract and registration data). When using our website and apps, the processing of technical data is unavoidable. If you wish to obtain access to certain systems, you may have to provide us with registration data. With behavioural and preference data, however, you generally have the option to object or not to give consent.
• From the Kantonalbank: Insofar as contractually agreed with you, Jaywalker receives data from the Kantonalbank, e.g. salutation, surname, first name, date of birth, street, postal code, place, e-mail address, telephone number, mobile number, language, type of account, transaction data, end of studies and Stu status.
• From third parties: Insofar as permitted, we may also take data from publicly accessible sources (e.g. debt-collection registers, land registers, the commercial register, media or the internet incl. social media) or receive it from authorities and from other third parties (e.g. credit agencies, address dealers, associations, contractual partners, internet analysis services, etc.).

8. Data transfer and data transmission

In connection with the stated processing purposes (section 3), we may pass on personal data to the following categories of recipients:

We also enable certain third parties to collect personal data about you on their own responsibility on our website and at events (e.g. media photographers, providers of tools that we have embedded on our website, etc.). Insofar as we are not decisively involved in these data collections, these third parties are solely responsible for them. For concerns and to assert your data protection rights, please contact these third parties directly.

• Group company: We may pass on data to Jaywalker Digital AG. It may use your data, as described in this privacy policy, for itself for the same purposes as we do (see section 3). It generally processes the data under its own responsibility.
• Kantonalbanks: With regard to you as a Stu-Member and for the operation of the Stu value programme, we and the Kantonalbank disclose data to each other. In this context we are, in principle, jointly responsible with the Kantonalbank for the data processing.
• Partner companies: We may pass on data to partner companies. This is done in particular for the purpose of providing the Stu-Mehrwertprogramm as well as for analysis and evaluation purposes in this connection. The recipients generally process the data under their own responsibility.
• Service providers: We work together with service providers in Switzerland and abroad who process data (i) on our behalf (e.g. IT providers), (ii) under joint responsibility with us or (iii) under their own responsibility, which they receive from us or have collected for us. These service providers include in particular:
• Arcmedia AG
• Arcon Informatik AG
• Bächler-Sidler AG
• Codesmith GmbH
• Inventx AG
• Jaywalker Digital AG
• MNC Mobile News Channel AG
• Nine Internet Solutions AG
• OPTEX Treuhand AG
• Authorities: We also disclose data to authorities if we are legally obliged or entitled to do so or if this appears necessary or sensible for the protection of our interests.
• Further persons: In addition, we may disclose data to further persons, insofar as this results from the purposes listed in this privacy policy in accordance with section 3. This concerns, e.g., third parties in the context of representation relationships or persons involved in court or authority proceedings. If we work together with media and transmit material to them (e.g. photos), you may likewise be affected by this.

9. Data security

We take appropriate security measures in order to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counteract the risks of loss, unintentional alteration, unwanted disclosure or unauthorised access. However, security risks generally cannot be completely ruled out; a certain residual risk is unavoidable.

10. Profiling

We process your data for the purposes stated in section 3 partly in an automated manner with the aim of evaluating certain personal aspects (profiling). We use profiling in order to inform you in a targeted manner about deals in our printletter, newsletter or in our app. In doing so, we use evaluation instruments that enable us to carry out needs-based communication and advertising including market and opinion research.

11. Rights of the data subject

You have certain rights in connection with our data processing. Under applicable law you may in particular request information about the processing of your personal data, have inaccurate personal data corrected, request the deletion of personal data, object to a data processing, request the release of certain personal data in a common electronic format or its transfer to other controllers.

If you wish to exercise your rights vis-à-vis us, please contact us; you will find our contact details in section 1. So that we can rule out misuse, we must identify you (e.g. with a copy of an identity document, if necessary).

Please note that conditions, exceptions or restrictions apply to these rights (e.g. to protect third parties or business secrets). We reserve the right to redact copies for data protection reasons or reasons of confidentiality, or to provide only extracts.

If you do not agree with our handling of your rights or with data protection, please let us know (datenschutz@jaywalker.ch). Every data subject also has the right to lodge a complaint with the competent data protection authority. The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

12. Disclosure of data abroad

We process and store personal data mainly in Switzerland and in the European Economic Area (EEA), but in exceptional cases, for example via sub-processors of our service providers, potentially in any country in the world.

If a recipient is located in a country without adequate data protection, we contractually oblige the recipient to comply with a sufficient level of data protection (for this we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?; including the additions necessary for Switzerland), insofar as it is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exception provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests, where the performance of a contract that is in your interest requires such disclosure, where you have consented, or where obtaining your consent within a reasonable period is not possible and the disclosure is necessary in order to protect your life or your physical integrity or that of a third party, or where it concerns data that you have made generally accessible and to whose processing you have not objected. In some circumstances we also rely on the exception for data from a register provided for by law (e.g. commercial register) into which we have lawfully been granted access.

13. What else should be noted?

Should the EU General Data Protection Regulation («EU GDPR») exceptionally be applicable to certain of our data processing, then this section 13 applies in addition, exclusively for the purposes of the EU GDPR and the data processing subject to it.

We base the processing of your personal data in particular on the fact that

We point out to you that we generally process your data for as long as our processing purposes (see section 3), the statutory retention periods and our legitimate interests, in particular for documentation and evidence purposes, require, or as long as storage is technically necessary (e.g. in the case of backups or document management systems). Where there are no legal or contractual obligations or technical reasons to the contrary, we generally delete or anonymise your data after the expiry of the storage or processing period in the course of our usual processes and in accordance with our retention policy.

You are not obliged to disclose your data, with exceptions in individual cases (e.g. legal obligations). However, if you do not provide certain personal data, this may result in the provision of the associated services or the conclusion of a contract not being possible. We generally indicate where personal data required by us is mandatory.

The right recorded in section 11 to object to a processing of your data applies in particular to data processing for the purpose of direct marketing.

If you do not agree with our handling of your rights or with data protection, or if you have other data protection concerns, please let us know (see contact details in section 1). You can also contact our data protection representative in the EU pursuant to Art. 27 EU GDPR:

VGS Datenschutzpartner GmbH

Am Kaiserkai 69

20457 Hamburg

Germany

info@datenschutzpartner.eu

If you are located in the EEA, you also have the right to complain to the data protection supervisory authority of your country. You can find a list of the authorities in the EEA here: https://edpb.europa.eu/about-edpb/board/members_de.

• it is, as described in section 3, necessary for the initiation, performance and conclusion of contracts as well as their administration and enforcement (Art. 6 para. 1 lit. b EU GDPR);
• it is necessary to safeguard legitimate interests of ours or of third parties as described in section 3, namely for communication with you or third parties, the preparation of the partner reports for and the passing on of these to our Stu-Partners (insofar as personal data exists at all or data subjects can be identified in individual cases), in order to analyse our performance and to prepare reports for the Kantonalbank (insofar as personal data exists at all or data subjects can be identified in individual cases), in order to operate our website, for the improvement of our offerings and registration for certain offers and services, for security purposes, for compliance with Swiss law and internal regulations, for the assertion and enforcement of legal claims or also where we defend ourselves against asserted claims, for our risk management and corporate governance and for further purposes such as training and education, administration, evidence and quality assurance, organisation, conduct and follow-up of events and further legitimate interests (section 3) (Art. 6 para. 1 lit. f EU GDPR);
• it is legally required or permitted on the basis of our mandate or our position under the law of the EEA or a member state (Art. 6 para. 1 lit. c EU GDPR) or is necessary in order to protect your vital interests or those of other natural persons (Art. 6 para. 1 lit. d EU GDPR);
• it is necessary for the performance of a task carried out in the public interest, or
• you have separately consented to the processing, e.g. via a corresponding declaration on our website (Art. 6 para. 1 lit. a and Art. 9 para. 2 lit. a EU GDPR).

14. Changes

We may amend this privacy policy at any time without prior notice. The respective current version published on our website applies.