Data Protection

1. Information about the collection of personal data and contact information of the person responsible

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following we inform you about the handling of your personal information when using our website. Personal information is any data with which you could be personally identified.

1.2 The person responsible for the data processing on this website in terms of the data protection regulation (General Data Protection Regulation) is:

Name: VestaHealth GmbH
Address: Industriestrasse 1B, 6300 Zug
Email: info@vestatea.com

The person responsible for the processing of personal data is the natural or legal person who determines the purposes and means of the processing of personal data alone or jointly with others.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or requests to the person responsible), this website uses SSL or TLS encryption. You can see an encrypted connection to the string "https://" and the lock icon in your protocol.

2. Data collection when you visit our website
When you use our website for information purposes, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you call our website, we collect the following data that are technically necessary for us to display the Web page:

• our visited Web page
• date and time at the time of the access
• quantity of the sent data in byte
• source/reference, by which you arrived on the page
• used browser
• used operating system
• IP address

The processing takes place in accordance with Article 6 paragraph 1 lit. f GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. We reserve the right however to check the server log files, later concrete evidence should point to an illegal use.

Please note that for non-acceptance of cookies, the functionality of our website may be limited.

7. Data processing for order processing
To process your order we work together with the following service provider(s), which support us wholly or partly in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information. The personal data collected by us will be passed on to the transport company commissioned with delivery within the framework of implementing the contract, as far as this is necessary for delivering the goods. We will pass on your payment data to the commissioned credit institution within the framework of payment processing, if this is necessary for payment processing. If payment service provider are used, we inform thereof hereinafter referred to explicitly. The legal basis for the transmission of the data section is Article 6 1 lit. b, GDPR).

7.1 Using PayPal
When paying via PayPal, credit card via PayPal, direct debit via PayPal or - if available - "Purchase on account" or "Installment" via PayPal we give your payment details within the framework of the payment on the PayPal (Europe) S.a.r.l.. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereafter "PayPal"), further. The data is passed on in accordance with Art. 6 para. 1 lit. b GDPR and only insofar as this is necessary for payment processing. PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" via PayPal. For this purpose, your payment data will be processed, if necessary, in accordance with Art. 6 para. 1 lit. f GDPR on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check with respect to the statistical probability of debt default for the purpose of deciding on providing the respective payment method. The credit information may contain probability values ​​(so-called. score values). When score values are ​​included in the results of the credit check, they are based on a scientifically recognised mathematical and statistical method. The calculation of the score values includes, but is not limited to, address data. Please refer to the Privacy Policy of PayPal for further information on data protection law, including the credit agencies used. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.

7.2 Use of Stripe
If you choose a payment method of the payment service provider Stripe, payment is processed by the payment service provider Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland, to whom we pass on your order information (name, address, account number, bank code, possibly credit card number, invoice amount, currency and transaction number). Your data will only be passed on for the purpose of payment processing with the payment service provider Stripe Payments Europe Ltd. For information on the data protection of Stripe, click here.

7.3 Use of PostFinance
If you have opted for the method of payment credit card (PostFinance), we will be payment processing via the payment service provider PostFinance AG, Mingerstrasse 20, 3030 Bern, Switzerland, to whom we pass on information within the framework of the order information communicated along with the details of your order (name, address, account number, bank code, any credit card number, invoice amount, currency and transaction number). The transmission of your data is done solely for the purposes of the payment with the payment service provider PostFinance AG. Further information on data protection at PostFinance can be found here.

7.4 Use of Saferpay

If you have opted for the Saferpay payment method, the payment is processed via the payment service provider SIX Payment Services AG, Hardturmstrasse 201, 8005 Zurich, Switzerland, to which we pass on your information provided during the order process together with the information about your order (name, e-mail address, address, account number, bank code, credit card number, invoice amount, currency and transaction number, if applicable). Your data will only be passed on for the purpose of payment processing with the payment service provider SIX Payment Services AG. Further information can be found in Saferpay's privacy policy.

7.5 Use of Intrum Justitia credit checks
Your personal data will only be passed on to Intrum Justitia for credit checks. The data passed on in this way may only be used by our service provider to fulfil his task. Databases are properly registered with the Swiss Federal data protection and information Commissioner. Only registered customers with a sufficient interest in information have access to the database. For more information about the privacy of Intrum Justitia, click here.

7.6 Use of Twint

8. Web analysis services

AWStats

In order to be able to evaluate our website statistically, we use the program AWStats. The program is a free web analysis software. It is used for evaluating log files, create the web server on the basis of visitor requests. The program does not use cookie files for the evaluation. The statistical analysis is carried out via the log files, which also contain IP addresses. This data cannot be used to identify specific people. This information is not merged with other data sources, and the information is deleted after it has been statistically analysed. Unlike other statistics programs transmitted data to a remote server with AWStats. The program is installed on your own hosting package. For example, the transfer of data abroad is avoided because our server is located in Switzerland.

9. Rights of the affected parties

The applicable data protection law grants you comprehensive rights of data subjects (rights of information and intervention) vis-a-vis the data controller with regard to the processing of your personal data, about which we inform you below:

• Right to information in accordance with article 15 GDPR: in particular, a right to receive information, have your personal data processed by us, the purposes of the processing, the categories of processed personal data, the recipients or categories of recipients; to which your data were disclosed or are the existence of a right to correction, cancellation, constraint processing, object to the processing, the planned storage period or the criteria for the determination of the storage period, complaint to a supervisor, the origin of your data, if it is not collected by us when you, the existence of an automated decision making including profiling, and any meaningful information about the involved logic and the specific scope and the intended effects of such processing, as well as your right to be informed as to which guarantees exist in accordance with article 46 GDPR in forwarding your data to third countries;

• Right of rectification in accordance with article 16 GDPR: you have the right incorrect data relating to you for immediate rectification and/or completion of your incomplete data stored by us.

• Right to cancellation in accordance with article 17 GDPR: you have the right to require the deletion of your personal data when the conditions of article 17 para. 1 GDPR. This right however in particular then does not exist, if the processing to the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest or to claim, exercise or defence of legal claims is required;

• The Right to restrict the processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data contested is verified, if you refuse to delete your data due to inadmissible data processing and instead request the restriction of the processing of your data, if you need your data to assert, exercise or defend legal claims, after we no longer need this data after the purpose has been achieved or if you have filed an objection for reasons of your particular situation, as long as it has not yet been determined whether our legitimate reasons predominate;

• If you have exercised your right to have the responsible party correct, delete or limit the processing, this party is obliged to inform all recipients to whom the personal data that concerns you has been disclosed of this correction or deletion of the data or restriction on processing, unless this proves impossible or involves a disproportionate effort. It is your right to have the responsible party inform you regarding such recipients.

• You have the right to receive the personal data you have provided to us in a structured, current and machine-readable format or to request its transfer to another responsible person, insofar as this is technically feasible.

• Right to revoke consents granted in accordance with Art. 7 para. 3 GDPR: You have the right to revoke consent to the processing of data at any time with effect for future for the future. In the event of revocation, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its revocation.

• Right of appeal under Art. 77 GDPR: If you believe that the processing of personal data concerning you is contrary to the GDPR, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or suspected infringement, without prejudice to any other administrative or judicial remedy.
  
  

10. Right of objection

When we process your personal data in the framework of interests as a result of our overriding legitimate interest, have you at any time right for reasons arising from your particular situation to the processing to file an opposition with effect for the future. If you exercise your right of objection, we end the processing the affected data. We will however continue processing the data if we have demonstrably compelling reasons for processing which are in need of protection and which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims. If your personal data are processed by us in order to participate in direct marketing, you have the right at any time object to the processing of personal data relating to you for the purpose of such advertising. You can object as described above. If you exercise your right of objection, we end the processing the affected data.

Zurich, 21 February 2019