Privacy Notice

The companies Codex Holding Anstalt, Codex Management Anstalt, Codex Treuhand AG and CTX Treuhand AG (hereinafter referred to as the Company), with registered office at Lova-Center, P.O. Box 1150, 9490 Vaduz, process information and personal data about you.

As a rule, the Companies process this information in the context of existing or prospective business relationships, including the use of the websites.

This privacy notice (hereinafter the "Notice") describes the processing of personal data in connection with the provision of services by the Company and its website. This privacy notice is based on the GDPR, the Data Protection Act (DSG) and the relevant special statutory provisions.

The Companies endeavour to ensure the best possible protection of your personal data. The overall controller within the meaning of the EU General Data Protection Regulation (hereinafter the "GDPR") is Codex Holding Anstalt, Lova-Center, P.O. Box 1150, 9490 Vaduz.

Personal data means any information by which a natural person can be identified directly or indirectly. This includes, for example, name, address, e-mail address, telephone number, date of birth, age, gender and tax identification number. Sensitive data (a specially protected category of data), such as health data or data relating to criminal proceedings, is also included.

The Company collects, processes and uses your personal data exclusively in accordance with the requirements of Art. 5 and 6 GDPR (contract, legal obligation, legitimate interest or consent of the data subject).

Only such personal data is collected as is necessary for the performance and handling of our services or has been provided by you voluntarily. The processing of our users' personal data is limited to the data necessary to provide a functional static website. The sole purpose of this website is to inform our clients within the meaning of the GDPR.

The Company is subject to professional duties of confidentiality and secrecy deriving from data protection law, contract law or professional secrecy. The Company is bound by these duties when processing personal data. Personal data is processed (i) for the performance of contracts, (ii) for compliance with our legal or regulatory obligations, (iii) for the pursuit of our legitimate interests and (iv) for the performance of obligations in the public interest (e.g. for the prevention or detection of criminal offences).

1. Provision of the website

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

2. Cookies

The Company uses cookies on its website in order to obtain information about the use of the website. Cookies are small files that are stored on your computer and serve to store page settings. This means that certain details do not have to be entered again when you revisit the website. You can prevent the installation of cookies by adjusting the settings of your browser software accordingly, and you can delete any cookies set by a website of the Company. By refraining from these measures, you consent to the use of cookies when using the Company's website.

When the Company's website is used, access data (e.g. log files, IP address, date and time of access, name of the file accessed, access status, top-level domain, web browser used, operating system used) is stored. The Company uses this data for statistical purposes and for technical analyses, for optimising the server infrastructure, for determining access frequencies and, finally, in order to draw conclusions for improving user-friendliness and functionality.

The following types and functions of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their browser.
• Permanent cookies: Permanent cookies remain stored even after the browser has been closed. For example, the login status can be saved or preferred content displayed directly when the user revisits a website. Likewise, the interests of users that are used for audience measurement or marketing purposes can be stored in such a cookie.
• First-party cookies: First-party cookies are set by the Company itself.
• Third-party cookies (also: third-party provider cookies): Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
• Necessary (also: essential or strictly necessary) cookies: Cookies may, on the one hand, be strictly necessary for the operation of a website (e.g. to store logins or other user input, or for security reasons).
• Statistics, marketing and personalisation cookies: Furthermore, cookies are as a rule also used in the context of audience measurement and where the interests or behaviour of a user (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile.

Such profiles serve, for example, to display content to users that corresponds to their potential interests. This procedure is also referred to as "tracking", i.e. following the potential interests of users. Insofar as we use cookies or "tracking" technologies, we will inform you separately in our privacy notice or when obtaining consent.

Notes on legal bases: The legal basis on which we process your personal data by means of cookies depends on whether we ask you for consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is the consent given. Otherwise, the data processed by means of cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online service and its improvement) or where the use of cookies is necessary to fulfil our contractual obligations.

General information on revocation and objection (opt-out): Depending on whether the processing is based on consent or on statutory permission, you have the option at any time to revoke any consent given or to object to the processing of your data by cookie technologies (collectively referred to as "opt-out"). You can initially declare your objection by means of your browser settings, e.g. by deactivating the use of cookies (although this may also restrict the functionality of our online service).

Processing of cookie data on the basis of consent: Before we process data, or have it processed, in the context of the use of cookies, we ask users for consent, which may be revoked at any time. Until consent has been given, only cookies that are necessary for the operation of our online service are used, if at all. Their use is based on our interest and the interest of users in the expected functionality of our online service.

• Types of data processed: Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Legal bases: Consent (Art. 6(1)(1)(a) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

3. Integration of third-party software, scripts or frameworks

We integrate into our online service software that we retrieve from the servers of other providers (e.g. function libraries that we use for the purpose of displaying our online service or making it user-friendly). In doing so, the respective providers collect the IP address of users and may process it for the purpose of transmitting the software to the users' browsers, for security purposes, and for the analysis and optimisation of their services.

• Types of data processed: Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos).
• Data subjects: Users (e.g. website visitors, users of online services), communication partners.
• Purposes of processing: Provision of our online service and user-friendliness, contact requests and communication, direct marketing (e.g. by e-mail or post), tracking (e.g. interest-/behaviour-based profiling, use of cookies), interest-based and behavioural marketing, profiling (creation of user profiles), contractual services and support.
• Legal bases: Consent (Art. 6(1)(1)(a) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

The following third-party software, scripts or frameworks are used:

• Google Font API: On our website we use Google Fonts. These are the "Google fonts" of Google Inc. For the European area, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Further information can be found at https://fonts.google.com/ and https://developers.google.com/fonts/faq/ . No cookies are stored in your browser. The files (CSS, fonts) are requested via the Google domains fonts.googleapis.com and fonts.gstatic.com. According to Google, requests for CSS and fonts are completely separate from all other Google services. If you have a Google account, you need not be concerned that your Google account data will be transmitted to Google while Google Fonts is being used. Google records the use of CSS (Cascading Style Sheets) and of the fonts used and stores this data securely. The privacy policy can be found at https://www.google.com/intl/de/policies/privacy/ .
• Viewport Meta: Viewport is the general term for the size of the display available on mobile devices. This may be, for example, the display of a smartphone, tablet or phablet. The term viewport has a more specific meaning, however, as a meta element in HTML5, where it is an important part of mobile optimisation. It serves to make optimal use of the display size by scaling the content to be displayed. The viewport meta element ensures that the content is displayed correctly and, above all, completely and legibly. This is done by adjusting the width and length of a website so that a mobile browser can display the page optimally. The ability to zoom into a website can also be defined with the viewport element. Mozilla Corporation, Attn: Legal Notices – Privacy, 331 E. Evelyn Ave, Mountain View, CA 94041, E-mail: compliance@mozilla.com, https://developer.mozilla.org/de/docs/Mozilla/Mobile/Viewport_meta_tag. The privacy policy can be found at https://www.mozilla.org/de/privacy/websites/.
• Php7: PHP (a recursive acronym for PHP: Hypertext Preprocessor) is a widely used, general-purpose open-source scripting language that is especially suited to web programming and can be embedded in HTML. PHP differs from client-side languages such as JavaScript in that the code is executed on the server, where it generates HTML output that is sent to the client. The client therefore receives only the result of the script execution, without it being possible to find out what the underlying code looks like. Further information can be found at: https://www.php.net/privacy.php.
• GoDaddy: GoDaddy is a domain registrar and web host founded by Bob Parsons. The Go Daddy Group is a certification authority and, with a market share of 6.9%, the fourth-largest provider of SSL certificates. Further information can be found at: https://www.godaddy.com/de-ch.

The Company takes appropriate technical and organisational measures, both in relation to data processing and data storage and in relation to its website, in order to protect all data against loss, unauthorised access or misuse.

Notwithstanding the measures taken to protect data, you must be aware that data transmission via the internet – this applies to websites and e-mail services alike - takes place in an uncontrolled manner and across borders. Even if the sender and the recipient are located in the same country, data may be transmitted across borders. The Company therefore cannot guarantee the confidential treatment of data transmitted via the internet. If you disclose personal data via the internet, you must be aware of the fact that third parties may access this information and may read, alter, falsify, monitor, destroy or misuse the data. Data transmission may also be delayed. Moreover, data may be lost during transmission. Furthermore, third parties could draw conclusions about existing business relationships. The Company therefore cannot accept any responsibility for the security of your data during transmission via the internet and disclaims all liability for direct and indirect damage.

During visits to its website, the Company uses the widespread SSL (Secure Socket Layer) procedure in conjunction with the highest level of encryption supported by your browser. You can tell whether an individual page is transmitted in encrypted form by the closed key or padlock symbol in the address bar of your browser. In addition, we apply further appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. The security measures are continuously improved in line with technological developments.

The Company's systems required for data processing are located in Liechtenstein. The data transmitted by you is retained for at least six months and remains stored for as long as is operationally necessary or required by law.

1. Right of access

You have the right to request information about the data concerning you that is stored by the Companies. A request for information must be addressed in writing to the controller (see lit. e.), together with proof of identity.

Upon receipt of your request, you will be provided with the information within the statutory period of 30 days. The information may be refused, restricted or deferred insofar as this is provided for by law or is necessary on account of the overriding interest of a third party or of a company to which the request has been made.

The request for information may be combined with an application for the rectification or erasure of data.

2. Right to rectification or erasure

You have the right to request, in writing and free of charge, the rectification or erasure of data concerning you insofar as it is incorrect or is being stored or processed unlawfully. A substantiated application for rectification or erasure must be addressed to the controller (see lit. e.), enclosing proof of identity.

Your application for rectification or erasure will be processed within a reasonable period after receipt. You will subsequently receive confirmation that your application for rectification or erasure has been dealt with.

In certain circumstances, statutory provisions may preclude erasure. In such a case, the Companies will continue to process the data concerning you only to the extent necessary to fulfil their statutory obligations.

3. Right to object or revoke consent

You have the right to object in writing, in whole or in part, to the processing of data concerning you or to revoke your consent to data processing. An objection or revocation must be addressed in writing to the controller (see lit. e.), together with proof of identity.

You will receive confirmation of receipt of your objection or revocation, and the data concerned will subsequently be erased.

In certain circumstances, statutory provisions may preclude compliance with an objection or revocation. In such a case, the Companies will continue to process the data concerning you only to the extent necessary to fulfil their statutory obligations.

4. Right to blocking

You have the right to have the data concerning you blocked from disclosure to third parties. An application for blocking must be addressed in writing to the controller (see lit. e.), enclosing proof of identity.

You will receive confirmation of receipt of your application for blocking, and your application will be dealt with within a reasonable period.

In certain circumstances, statutory provisions may preclude blocking. In such a case, the Companies will disclose the data concerning you to third parties only to the extent necessary to fulfil their statutory obligations.

5. Right to lodge a complaint

You have the right to lodge a complaint with the competent Liechtenstein supervisory authority. You may also contact another supervisory authority of an EU or EEA Member State, for example in your place of residence or work or in the place of the alleged infringement.

The contact details of the competent data protection authority in Liechtenstein are as follows:

Datenschutzstelle Liechtenstein
Städtle 38
Postfach 684
LI-9490 Vaduz
+423 236 60 90
info.dss@llv.li

If you have any questions regarding data protection and data processing, please contact the controller in writing. The controller can be reached as follows:

Codex Holding Anstalt
Lova Center
P.O. Box 1150
LI-9495 Triesen
+423 388 2000
office@codextrust.com