Privacy Policy


Status: September 2026

1. Controller

The controller responsible for processing personal data in connection with this website, our business relationships, business development and our marketing activities is – depending on which company manages the respective contact, offer or business relationship –

OBJECT ECM AG
Albisriederstrasse 252
8047 Zurich
Switzerland

or

OBJECT ECM GmbH
Neuer Wall 71
20354 Hamburg
Germany

Both companies use the website object.ch for their business activities in the German-speaking region. Where processing can clearly be attributed to one of the two companies, that company is responsible for the respective processing.

Contact:
Email: [email protected]
Phone Germany: +49 40 7976 9100
Phone Switzerland: +41 44 240 22 66

Data Protection Officer

The following external data protection officer has been appointed for OBJECT ECM GmbH:

DATA-ORG GmbH
Mr Jürgen Maurer
Gottlieb-Daimler-Str. 5
78467 Konstanz
Germany

Email: [email protected]

This Privacy Policy applies to the website object.ch as well as other websites, campaign websites and landing pages operated by us, and to the processing of personal data in connection with business development, business relationships, customer and prospect management, events and marketing activities. Personal data is processed in accordance with the applicable data protection regulations, in particular the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

2. General information on data processing

We process personal data only to the extent necessary to provide our offerings, for communication, to carry out our business relationships, for business development, to fulfil legal obligations, or on the basis of consent. Personal data may in particular include the following categories:

  • Master and contact data, e.g. name, company, function, address, telephone number and email address,
  • Contract and business data,
  • Communication content,
  • Appointment and event data,
  • Usage and access data,
  • Technical data such as IP address, browser and device information,
  • Marketing and prospect data,
  • Information voluntarily provided via forms, surveys or other means of communication.

For processing within the scope of the GDPR, we rely in particular on Art. 6 para. 1 lit. a, b, c and f GDPR. In Switzerland, we process personal data in accordance with the principles of the FADP. Where a justification is required, processing is carried out in particular on the basis of consent, a contractual relationship, a legal basis or an overriding private interest.

3. Provision of the website and server log files

When you access our website, technically necessary data is processed by the web server or the infrastructure and hosting providers used. This may in particular include:

  • IP address,
  • Date and time of access,
  • Page or file accessed,
  • Referrer URL,
  • Browser type and version,
  • Operating system,
  • Amount of data transferred,
  • Access status.

This processing is carried out to technically provide the website, to ensure its stability and security, and to detect attacks or misuse. The legal basis within the scope of the GDPR is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and uninterrupted provision of our website. Log data is generally stored only for as long as necessary for the purposes stated. Unless security-relevant events require longer retention, server log data is deleted on a regular basis.

4. Cloudflare

We use services provided by Cloudflare for the secure and accelerated provision of our website. The provider is in particular Cloudflare, Inc., USA, or the relevant European company. Data traffic between your browser and our website may be routed through Cloudflare's infrastructure. In doing so, IP addresses as well as technical connection, device and browser data may in particular be processed. Cloudflare serves in particular to defend against attacks, increase availability and optimise the loading times of our website. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in a secure, high-performance and reliable provision of our online offering. Insofar as Cloudflare processes data on our behalf, the necessary data protection agreements are in place. For transfers to the USA, the applicable data protection transfer mechanisms are used. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

5. Cloudflare Zaraz and consent management

We use Cloudflare Zaraz for the technical management and control of services embedded on our website. This is used in particular to control whether analytics, statistics, marketing or CRM services requiring consent are loaded. The decision made via our consent management is stored so that the selected settings can be taken into account. In doing so, technical information such as IP address, browser and device information, time of access and the selected consent setting may be processed. Insofar as the processing is necessary for the management of consent or for technically required operation, it is carried out on the basis of our legitimate interest in a legally compliant and secure website. Services requiring consent are activated only once the corresponding consent has been given.

6. Cookies and similar technologies

Our website uses cookies and comparable technologies. Technically necessary cookies are used insofar as this is required for functionality, security or storing your privacy settings. In addition, cookies and similar technologies may be used for statistics, analytics, marketing and CRM. Technologies requiring consent are activated only after you have given your consent via the consent banner. You can change or withdraw your consent at any time with effect for the future via our website's cookie settings. If you do not give consent, non-essential analytics and marketing services remain deactivated.

7. Google Analytics 4

Provided you have consented, we use Google Analytics 4 (GA4), a web analytics service provided by Google. For users within the EU or the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is generally responsible. Google Analytics enables us to carry out statistical analyses of the use of our website. In doing so, the following may in particular be processed:

  • Pages visited,
  • Time and duration of visits,
  • Interactions with the website,
  • Browser and device type used,
  • Approximate geographic origin,
  • Referrer or source of the visit.

Google Analytics is activated only following your consent. The legal basis is Art. 6 para. 1 lit. a GDPR. The IP address is not permanently stored by Google Analytics but is used only to determine approximate location information. Data may also be processed by Google companies in the USA. Google is certified under the EU-U.S. Data Privacy Framework. In addition, Standard Contractual Clauses may be used. We have generally set the retention period for user and event data in Google Analytics to 14 months. You can withdraw your consent at any time via the cookie settings.

8. HubSpot – contact forms, CRM, appointment booking and marketing

We use HubSpot for contact forms, appointment bookings, customer and prospect management as well as – following the relevant consent – marketing and analytics functions. The provider is in particular HubSpot Ireland or HubSpot, Inc., USA.

Contact forms: If you fill in a contact form, we process in particular the information you provide, for example:

  • First and last name,
  • Company,
  • Email address,
  • Telephone number,
  • Message and other voluntary information.

Processing is carried out to handle your enquiry. Depending on the nature of the enquiry, the legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR.

Appointment bookings: If you actively open an appointment booking provided via HubSpot, technical connection data may be transmitted to HubSpot. The data you subsequently enter is processed for arranging and managing the appointment. The legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR.

CRM: HubSpot is also used to manage customers, prospects and business contacts. In doing so, contact data, communication history, enquiries, appointments and information on the business relationship may in particular be stored. The legal basis is Art. 6 para. 1 lit. b or lit. f GDPR.

Website tracking: Personal website tracking via HubSpot takes place only with your consent. In doing so, information on pages visited, times, interactions and devices used may be processed and, insofar as identification is possible, assigned to an existing CRM contact. The legal basis is Art. 6 para. 1 lit. a GDPR. Without your consent, no corresponding personal HubSpot tracking takes place. HubSpot may also process data in the USA. HubSpot is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. Standard Contractual Clauses may additionally be used.

9. Newsletter – rapidmail

For sending our newsletter, we use rapidmail, a service provided by rapidmail GmbH, Wentzingerstr. 21, 79106 Freiburg im Breisgau, Germany. For newsletter registration, we generally use the double opt-in procedure. In doing so, the following is in particular processed:

  • Email address,
  • Name, where applicable,
  • Time of registration,
  • Time of confirmation,
  • IP address as evidence of registration.

The legal basis for sending the newsletter is Art. 6 para. 1 lit. a GDPR. Newsletters may contain technologies to measure opens and clicks. Insofar as consent is required for this, performance measurement is carried out only on the basis of the relevant consent. You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in the newsletter. Following unsubscription, data may be stored in a suppression list insofar as this is necessary to ensure that no further newsletters are sent to the address concerned. The necessary data processing agreements are in place with rapidmail.

10. YouTube

Videos from YouTube may be embedded on individual pages. We use a privacy-friendly solution in which only a preview image is initially displayed. Only when you actively start a YouTube video is a connection established to YouTube or Google. In doing so, your IP address, browser and device information as well as information about the page accessed may in particular be transmitted to Google. If you are logged in to Google or YouTube, Google may associate this information with your user account. The legal basis for loading the video is your consent pursuant to Art. 6 para. 1 lit. a GDPR. Google may also process data in the USA. Google is certified under the EU-U.S. Data Privacy Framework.

11. ScoreApp

On individual pages, we may use ScoreApp to provide interactive surveys and evaluations. The provider is Hyper Targeted Marketing Limited trading as ScoreApp, United Kingdom. ScoreApp is loaded only once you actively start the relevant survey. In doing so, technical data such as IP address, browser and device information as well as the answers you provide as part of the survey may be processed. If you provide contact details, these may be used to deliver the requested result and to contact you in connection with the survey. Depending on the specific process, processing is carried out on the basis of your consent, for the performance of pre-contractual measures, or on the basis of our legitimate interest in providing the relevant offerings. Participation is voluntary.

12. Telephone contact and Offinea

If you contact us by telephone, the following data may in particular be processed:

  • Name,
  • Company,
  • Telephone number,
  • Date and time,
  • Matter or content of the call.

For the acceptance and handling of incoming calls, we use the telephone service of offinea AG, Zugerstrasse 32, 6341 Baar, Switzerland. Offinea may answer calls on our behalf, create call notes and forward the necessary information to us. Depending on the occasion, the legal basis is Art. 6 para. 1 lit. b or lit. f GDPR.

13. Business relationships and business contacts

We process personal data of customers, prospects, suppliers, partners and other business contacts. This in particular includes:

  • Name,
  • Professional contact details,
  • Company and function,
  • Communication data,
  • Contract and project data,
  • Appointment and conversation information.

The data is processed in particular for business development, contract performance, customer support, project handling, communication as well as for maintaining existing business relationships. The legal basis is in particular Art. 6 para. 1 lit. b GDPR as well as Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in particular in efficient business communication and the maintenance of customer and business contacts.

14. B2B marketing and direct approach

We may use contact data of existing or potential business customers for B2B communication, business development and direct marketing, insofar as this is legally permitted. In doing so, the following data may in particular be processed:

  • Name,
  • Company,
  • Professional function,
  • Business telephone number,
  • Business email address,
  • Publicly available company information,
  • Information on previous contacts.

Where applicable, processing is carried out on the basis of our legitimate interest in business development, customer relationship management and B2B marketing pursuant to Art. 6 para. 1 lit. f GDPR. In our assessment, we take into account in particular the reasonable expectations of the data subject, the nature and source of the contact data, and the type of contact. Insofar as consent is legally required for certain advertising measures, processing is carried out only following the relevant consent. Data subjects may object at any time to the processing of their data for direct marketing purposes.

15. Telephone business development / Starcom

For certain telephone business development activities, OBJECT may work together with external service providers. This in particular includes Starcom. Insofar as Starcom approaches potential business contacts from its own databases, that contact data initially remains with Starcom. OBJECT generally only receives personal contact data once the data subject has expressed interest in further contact with OBJECT or has consented to a corresponding follow-up contact. An employee acting for Starcom may present themselves on behalf of OBJECT when making contact and may use an email address with the OBJECT domain for this purpose. This processing serves B2B business development and contacting potential business customers. Insofar as the GDPR applies, processing is carried out – depending on the specific processing activity and the respective responsibility – in particular on the basis of Art. 6 para. 1 lit. f GDPR or, where consent has been given, on the basis of Art. 6 para. 1 lit. a GDPR. Insofar as OBJECT has not collected personal data directly from the data subject, it may in particular originate from commissioned service providers, publicly accessible business sources or lawfully maintained business contact databases. Data subjects may object at any time to the use of their personal data for direct marketing.

16. Source of data not collected directly

Personal data is generally collected directly from the data subject. In addition, in connection with business development and B2B communication, we may obtain data from other permissible sources. These may include:

  • Business partners and service providers,
  • Publicly accessible company websites,
  • Public directories,
  • Professional networks,
  • Publicly accessible registers,
  • Lawfully maintained B2B contact databases.

In doing so, we generally only process data that is necessary for the respective business development or communication. Insofar as Art. 14 GDPR applies, we inform the data subject about the processing and source of their data in accordance with the statutory requirements.

17. Social media presence

We maintain company profiles on various social networks, in particular LinkedIn, Xing, YouTube, Facebook, Instagram, Pinterest and TikTok. Social media icons used on our website are generally merely links to the respective platforms. Data is therefore generally only transmitted to the respective provider once you click on the link. When visiting our profiles, the privacy provisions of the respective platform operator additionally apply. The platform providers may in particular process usage and profile data and create usage profiles. Insofar as we ourselves process personal data via our social media presences, this is done in particular for communication with customers, prospects and other users.

18. Recipients and service providers

Insofar as necessary for the respective purposes, personal data may be transmitted to the following categories of recipients:

  • Affiliated companies within the OBJECT group,
  • IT and hosting service providers,
  • Cloud and infrastructure providers,
  • CRM providers,
  • Newsletter service providers,
  • Telephone and communication service providers,
  • Marketing and sales service providers,
  • Consulting firms,
  • Payment and financial service providers,
  • Tax advisors and auditors,
  • Legal advisors,
  • Authorities and courts, insofar as there is a legal obligation.

Service providers are, where necessary, contractually bound to comply with data protection requirements.

19. Data transfers to third countries

In connection with the use of individual service providers, personal data may also be processed outside Switzerland, the European Union or the European Economic Area. For transfers to countries for which an adequate level of data protection has been recognised, the transfer is carried out on this basis. For transfers to other countries, we use, where necessary, appropriate safeguards, in particular Standard Contractual Clauses. For appropriately certified US companies, a transfer may also be carried out on the basis of the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework. When selecting our service providers, we take into account the data protection requirements for international data transfers.

20. Retention period and deletion

We generally store personal data only for as long as necessary for the respective purpose. The data is subsequently deleted or anonymised, unless statutory retention obligations or other legal grounds require further storage. Statutory retention periods may apply to business records, contracts, accounting documents and tax-relevant documents. Business correspondence is retained in accordance with the applicable commercial and tax law requirements. Data relating purely to prospects is deleted once there is no longer any comprehensible business interest and no statutory retention or documentation obligations apply. For individual systems and data categories, supplementary deletion and retention rules apply under OBJECT's internal deletion concept or data management requirements.

21. Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised alteration or disclosure. This in particular includes measures for:

  • Access and entry control,
  • Encryption,
  • Authentication,
  • Authorisation management,
  • Securing IT systems,
  • Data backup,
  • Logging,
  • Detection and handling of security incidents.

Our website uses SSL/TLS encryption.

22. Rights under the GDPR

Insofar as the GDPR applies to the processing of your personal data, you in particular have the following rights:

  • Right of access pursuant to Art. 15 GDPR,
  • Right to rectification pursuant to Art. 16 GDPR,
  • Right to erasure pursuant to Art. 17 GDPR,
  • Right to restriction of processing pursuant to Art. 18 GDPR,
  • Right to data portability pursuant to Art. 20 GDPR,
  • Right to object pursuant to Art. 21 GDPR,
  • Right to withdraw consent given, with effect for the future.

Objection to direct marketing: Where personal data is processed for the purpose of direct marketing, you have the right to object to this processing at any time. Following such an objection, your personal data will no longer be used for direct marketing.

23. Rights under the Swiss FADP

Insofar as the Swiss Federal Act on Data Protection applies, data subjects in particular have the statutory rights to:

  • Access,
  • Rectification,
  • Erasure or destruction,
  • Surrender or transfer of personal data, subject to the statutory requirements.

To exercise your rights, you may contact the points of contact named above.

24. Complaints and supervisory authorities

If you believe that your personal data is being processed unlawfully, you may contact a competent data protection supervisory authority.

For OBJECT ECM GmbH, the Hamburg Commissioner for Data Protection and Freedom of Information is in particular responsible.

For data protection matters in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) may in particular be responsible.

Data subjects may also contact the supervisory authority responsible for their place of residence under the applicable statutory provisions.

25. Automated decisions

A decision based exclusively on automated processing which produces legal effects concerning data subjects or similarly significantly affects them does not generally take place in connection with the website or our usual customer and prospect communication. Should corresponding procedures be used in the future, the legally required information will be provided.

26. External links

Our website may contain links to third-party websites. After clicking on an external link, the privacy provisions of the respective website operator apply. We generally have no influence over the processing of personal data by these providers.

27. Changes to this Privacy Policy

We update this Privacy Policy whenever our data processing activities, the services we use, or the legal framework change. The current version is available on our website. Status: September 2026