Legal Information

Version effective as of 1 September 2019

The websites located at https://empsa.org/ are operated by the European Mobile Payment Association (EMPSA), with registered offices at Stauffacherstrasse 31, 8004 Zurich, Switzerland (hereinafter "we" or "us").

Accordingly, we are responsible for the collection, processing and use of your personal data in accordance with the law. We take data protection seriously and are committed to the protection of your personal data. We comply with the legal requirements of the Swiss Federal Data Protection Act (FDPA), the Ordinance on the Federal Data Protection Act (OFDPA) and other data protection provisions that may be applicable, in particular the General Data Protection Regulation of the European Union (GDPR).

In the following, we would like to inform you of how we treat your personal data. The term "personal data" in this Privacy Policy shall mean any information that identifies, or could reasonably be used to identify, an individual person (including legal entities under the FDPA).

We may amend this Privacy Policy from time to time by posting the amended version on our websites. The version published on our website shall apply as the current version. We therefore recommend that you consult this Privacy Policy regularly.

1. Collection and Processing of Personal Data

1.1 When you visit our websites

When you visit our websites, our servers temporarily store each access in a log file. The following data is collected and stored, without any action on your part:

• the IP address of the requesting computer,
• the name of your Internet access provider,
• the date and time of your access,
• the website from which our domain was accessed (referrer URL), and the search term used, as applicable,
• the operating system of your computer and the browser used (type, version and language),
• the transmission protocol used (e.g. HTTP/1.1).

This data is collected and processed for the purpose of allowing the use of our websites (establishing a connection), ensuring system security and stability in the long term and allowing our Internet offering to be optimized, as well as for internal statistical purposes. We rely on our legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR to process the data for these purposes.

The IP address will be evaluated for clarification and defense purposes only in the event of an attack on the websites' network infrastructure or in case of a suspicion of unauthorized or abusive use of the websites. It may further be used for identification purposes in criminal proceedings and in the context of civil and criminal proceedings against the concerned individual, as necessary and required. We rely on our legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR to process the data for these purposes.

Lastly, when you visit our websites, we use cookies as well as applications that are based on the use of cookies. Please see Sections 2 "Cookies" and 3 "Tracking Tools" for further details.

1.2 When you send us an email

If you contact us by sending us an email via the email address provided at https://empsa.org/, we collect the following information from you:

• email address,
• further personal information if you provide us voluntarily with such information (e.g. name, first name),
• your message.

We use this data to respond to your query or to provide the services you request and, if necessary, to contact you.

In addition, we may use your email address for advertisement and marketing (including organizing events), provided that you have consented, or not objected (as the applicable data protection law may provide), to the use of your data for this purpose. If you are part of our association or customer base and you receive our advertisement, you may object at any time and we will not send you any further advertising mailings.

2. Cookies / Tracking and Other Techniques Regarding the Use of our Website

We typically use cookies and similar techniques on our websites which allow for an identification of your browser or device. A cookie is a small text file that is sent to your computer and automatically saved by the web browser on your computer or mobile device when you visit our websites.

If you revisit our websites we may recognize you as a repeated visitor, even if we do not know your identity. Besides cookies that are only used during a session and deleted after your visit of the websites ("session cookies"), we may use cookies in order to save user configurations and other information for a certain time period ("permanent cookies").

Notwithstanding the foregoing, you may configure your browser settings in a way that it rejects cookies, only saves them for one session or deletes them prematurely. Most browsers are preset to accept cookies.

We use permanent cookies for the purpose of saving user configurations (e.g., language, automated log in), in order to understand how you use our services and content, and to show you customized offers and advertisement (which may also happen on websites of other companies; should your identity be known to us, such companies will not learn your identity from us; they will only know that the same user visiting their website has previously visited a certain website).

Certain cookies are sent to you from us, others from business partners with which we collaborate.

If you block cookies, it is possible that certain functions (such as language settings, shopping basket, ordering processes) are no longer available to you.

In accordance with applicable law, we may include visible and invisible image files in our newsletters and other marketing emails. If such image files are retrieved from our servers, we can determine whether and when you have opened the email, so that we can measure and better understand how you use our offers and customize them. You may disable this in your email program, which will usually be a default setting.

By using our website and consenting to the receipt of newsletters and other marketing emails you agree to our use of such techniques.

We may use Google Analytics or similar services on our website. These are services provided by third parties, which may be located in any country worldwide (in the case of Google Analytics Google LLC is in the U.S., www.google.com) and which allow us to measure and evaluate the use of our website (on an anonymized basis).

For this purpose, permanent cookies are used, which are set by the service provider. The service provider does not receive (and does not retain) any personal data from us, but the service provider may track your use of the website, combine this information with data from other websites you have visited and which are also tracked by the respective service provider and may use this information for its own purposes (e.g. the controlling of advertisements).

If you have registered with the service provider, the service provider will also know your identity. The service provider only provides us with data on the use of the respective website (but not any personal information of you).

3. Social Media Plug-ins

In addition, we use plug-ins from social networks such as Facebook, Twitter, YouTube, Google+, Pinterest or Instagram on our websites. This is visible for you (typically based on the respective symbols).

We have configured these elements to be disabled by default. If you activate them (by clicking on them), the operators of the respective social networks may record that you are on our website and where on our website you are exactly and may use this information for their own purposes.

This processing of your personal data falls under the responsibility of the respective operator and occurs according to its data protection regulations. We do not receive any information about you from the respective operator.

4. Disclosure of Data to Third Parties

We will only disclose your personal data to third parties if:

• you have given your express consent,
• there is a legal obligation to do so,
• it is necessary for the enforcement of our rights, in particular to assert claims arising out of contractual relationships.

Consent given can be withdrawn at any time, but will not have an effect on disclosures made prior to such withdrawal.

In addition, we will disclose your data to our service providers as far as it is necessary for the use of the websites, the processing of your contact requests, the sending of marketing communications, and the analysis of your user behavior. The use of the data disclosed for these purposes by such service providers is strictly limited to the stated purposes.

5. Transfer of Personal Data Abroad

We may transfer your personal data to service providers located abroad for the purpose of the data processing described in this Privacy Policy.

Any such data recipients abroad are obliged to protect the privacy of individuals to the same extent as we do. If the level of data protection in a jurisdiction does not meet the Swiss or European level, we will ensure by contract or other appropriate safeguards that the protection level of your personal data corresponds at all times to the statutory level in Switzerland or the EU, as applicable.

Certain service providers mentioned in this Privacy Policy have their registered offices in the United States. Further explanations on the data that may be transferred to the United States can be found under Section 2 "Tracking Tools".

6. Data Retention

We process and retain your personal data as long as required for the performance of our contractual obligations and compliance with legal obligations or other purposes pursued with the processing and in accordance with legal retention and documentation obligations.

Personal data may be retained for the period during which claims can be asserted against us or insofar as we are otherwise legally obliged to do so or if legitimate business interests require further retention (e.g., for evidence and documentation purposes).

As soon as your personal data are no longer required for the above-mentioned purposes, they will be deleted or anonymized, as appropriate.

7. Data Security

We have taken appropriate technical and organizational security measures to protect your personal data from unauthorized access, alteration, deletion and misuse.

8. Your Rights

In accordance with, and as far as provided by, applicable law (e.g. the GDPR), you have:

• the right to access your personal data,
• the right to rectification,
• the right to erasure,
• the right to restriction of processing,
• the right to object to our data processing,
• the right to receive certain personal data in machine-readable format (data portability),
• the right to withdraw your consent at any time.

We reserve the right to enforce statutory restrictions on our part, for example if we are obliged to retain or process certain data, have an overriding or legitimate interest, or need the data for asserting claims.

If exercising certain rights will incur costs on you, we will notify you thereof in advance.

In order to assert your rights, please contact us at the addresses provided below. In addition, you have the right to enforce your rights in court or to lodge a complaint with the competent data protection authority.

The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

9. Contact

If you have any questions regarding data protection, if you would like to receive further information or if you would like to exercise any of your rights in relation to your personal data, please contact us by email at:

office@empsa.org

The information provided on this website is for general information purposes only. Visitors to this website should not take any actions or decisions on the basis thereof.

While EMPSA has made reasonable attempts to ensure that the information on this website is accurate when posted, EMPSA is free, but not obliged, to update it, and disclaims all liability for any errors or omissions, or for the outcome of any use of the information on this website.

EMPSA is not responsible for the content of any third-party websites linked to this site.

Further, EMPSA does not provide any guarantee or warranty for the availability of the website's services. In particular, EMPSA is not liable for service interruptions which may be caused by maintenance, fixing of bugs or failure of telecommunications services (in particular the internet).

The copyright and any other intellectual property rights in the entire content of this website are with EMPSA or the entitled third-party right holder, respectively. The content may not be copied, altered, distributed, or otherwise used for commercial purposes without EMPSA's prior written consent.