This document describes the policy regarding the processing of personal data of Studio17 SA, a company incorporated under Swiss law with registered office in Lugano (CH), in relation to the user's use of the website www.studio17.ch and the resources linked to it (hereinafter the "Website").

This document informs the user, pursuant to and for the purposes of Articles 4(5) of the Federal Data Protection Act (DPA) and, where applicable, Articles 13 and 14 of the European Regulation (EU) 679/2016 (GDPR), that the personal data provided or otherwise acquired as part of the Site's activity will be processed in accordance with the principles set out in the aforementioned regulations.

It should be noted that the GDPR, according to Article 3, applies only in the case of:

1. offering goods or services to natural persons in the EU;
2. monitoring the behaviour of natural persons in the EU.

Paragraphs A and B specify the ownership of the Site, the contact details for communications, and describe the mechanism for accepting and reviewing this document. Paragraphs C and D describe the Site's policy regarding the processing of users' personal data. Finally, paragraph E governs the substantive law applicable to the legal relationship between the parties and establishes the competent court in the event of a dispute related to that relationship.

The conditions governing the use of the Site are described in a separate document, accessible at this link. The same is deemed to be reproduced and supplemented in full here.

Site owner and communications

The Site is the property of Studio17 SA, Lugano (CH).

All notices shall be in writing and shall be deemed validly and effectively executed upon receipt thereof, if effected by ordinary mail, or upon receipt of confirmation of reading, if effected by electronic mail.

Contacts:

Address: Via Nassa 32, 6900 Lugano - Switzerland

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Phone: +41 91 922 97 33

WhatsApp: +41 91 922 97 33

ACCEPTANCE AND MODIFICATION OF TERMS AND CONDITIONS

By using the Site, the user accepts the terms and conditions in force at the time of access. It is the user's responsibility to carefully check the status of the terms and conditions before accessing the Site, the holder's right being reserved to update this document at any time and at its own discretion, in particular according to the evolution of applicable law.

DATA PROTECTION POLICY

Data controller

The data controller is Studio17 SA, Via Nassa, 32 - CH-6900 Lugano. The owner can be contacted using the contact details specified in paragraph A above.

Data Protection Officer

The Data Protection Officer may be contacted in writing by ordinary mail at the following address: c/o Studio17 SA, Via Nassa, 32 - CH-6900 Lugano.

Any communication concerning the protection of personal data may be sent to the following e-mail address: This email address is being protected from spambots. You need JavaScript enabled to view it.

Legal regime applicable to data processing

The data controller, as a legal entity under Swiss law operating in the private sector, processes the personal data of users in accordance with the Federal Data Protection Act ('DPA', SR 235.1).

Whereas Studio17 SA does not in principle process personal data falling within the scope of the GDPR (see Section A above), should the Regulation be exceptionally applicable, Studio17 SA grants the data subjects the protections provided for by the GDPR itself (in particular the rights provided for in Articles 12 - 23). The text of the GDPR can be consulted by activating this link.

Concepts and categories of personal data

Personal data means any information concerning an identified or identifiable natural person (Personal Data). In particular, sensitive information such as information concerning the intimate sphere, social welfare measures, racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data or data concerning health, mental, mental or physical state, as well as data concerning criminal convictions and offences or related security measures, are considered as personal data deserving special protection.

Purpose and lawfulness of processing

The owner collects and processes Personal Data necessary to enable and optimise navigation on the Site. This data includes information concerning the use of the Site, such as the IP address of the user's device, the user's location, the unique identifier of the user's mobile device, the duration of the stay on the Site, the links activated, the characteristics of the browser (type, language, plug-ins installed etc., cookies etc.). This data is processed in an automated manner exclusively to allow navigation on the Site, assess the introduction of new functions, improve the quality of the services offered, measure the use of the Site and optimise its usability.

The Site processes Personal Data transmitted by the user, in particular by means of an online form or electronic mail, for the purpose of communicating or making available the information requested by the user.

The Site does not process or transmit any content or advertising messages designed on the basis of online behaviour, nor does it profile the user or monitor the use of web resources or e-mail. The Site does not sell, rent, trade and/or lend Personal Data to third parties.

Obligation to provide data

Apart from what is specified for navigation data, the user is free to provide Personal Data.

The provision of data is optional or necessary depending on the specific purpose for which the data is processed. Failure to provide the requested data will make it impossible to obtain what has been requested or to use the services of the data controller.

Data transfer to a third country and/or international organisation

Personal Data may be transferred abroad (with respect to Switzerland), however, limited to the European Union or to countries that provide adequate data protection (with respect to Swiss law) as per the List established by the Federal Authority, respectively the European Authority responsible for data processing subject to the GDPR. The data subject has the right to obtain a copy of such data.

In the event of transfer to non-European countries, in particular the United States, where the level of data protection has been deemed inadequate, personal data may only be transferred to natural persons, entities and companies that are party to specific international agreements and/or instruments concerning the protection of personal data (e.g. Swiss / EU - US Privacy Shield). The data subject may obtain information about the safeguards adopted for the transfer of Personal Data by writing to Studio17 SA.

Personal data retention period

The Site retains Personal Data as long as its retention is necessary in view of the purpose for which the data was collected, respectively to the extent that there is a legal obligation to retain it (normally 10 years). Once the purpose for which the Personal Data was collected has lapsed, respectively the retention obligation established by law has expired, the Data Controller shall permanently and securely delete the data or, alternatively, anonymise them. The detailed policy on the retention of Personal Data can be requested from the data controller by e-mail or viewed at the registered office.

Data on minors

Processing justified by the consent of the data subject is lawful where the child who has given consent is at least 16 years old. Where the child is under 16 years of age, the processing of personal data shall be lawful only and to the extent that consent is given or authorised by the legal representative. The controller shall make every reasonable effort, taking into account available technology, to verify that the consent given by the legal representative is effective. However, it shall in no way be liable for any false declarations that may be provided by the minor and, in any case, should it ascertain that the declaration is false, it shall immediately delete any personal data and any material acquired. The controller will facilitate requests concerning the personal data of minors coming from the legal representative.

Persons responsible for data processing, recipients or categories of recipients, access to data

The Personal Data provided by the user may be disclosed to recipients who will process the data as appointed data processors and/or as natural persons acting under the authority of the data controller or data processor. Where they operate autonomously, the subjects take on the position of separate data controllers.

Subject to the transmission of data provided for by law, the data may be communicated to recipients belonging to the following categories:

• subjects that provide services for the management of information and telecommunication systems used by the data controller for the provision of the Site and for the organisation, planning, implementation and execution of activities related to the Site;
• companies and freelancers that provide services to the data controller, for example in the legal, accounting, administrative field and in the management of the Site and related resources (in particular: e-recruiting activities, e-mailing, back-up, web-design, graphics, maintenance, translation, hosting and Internet access), Studio17 SA uses external suppliers of goods and/or services established and active in Switzerland or in the European Union (EU).

External suppliers have access to the data only to the extent strictly necessary for the proper and efficient performance of their tasks, subject to an obligation of confidentiality and non-use in relation to Personal Data.

The full list of data processors is available at the company's registered office.

E-mail communication, risks

The user is advised that (I) the use of e-mail does not ensure the confidentiality and integrity of data in transit, (II) many e-mail service providers are located or hold their data in countries that do not guarantee adequate protection of personal data (e.g. the USA, see updated official list downloadable here), (III) the use of such an e-mail service results in the transfer and storage of data in a country that does not guarantee adequate protection of such data.

The user authorises the holder (and its auxiliaries) to transmit documents and/or information, including those containing personal and/or confidential data, by ordinary (non-certified and encrypted) electronic mail, using the e-mail address provided by the user in response to user requests received by telephone or e-mail. The user, being fully aware of the above-mentioned risks, releases the holder from any liability in the event of unauthorised access by third parties to the documents and/or personal and/or confidential information transmitted or received by e-mail by the holder and/or its organs and auxiliaries.

Links to third-party resources

The Site contains links to third-party sites, services and other Internet resources. The proprietor is in no way responsible for the content, security and usability of these sites and resources; in particular, the proprietor does not verify the policy, nor does it issue guarantees regarding the protection of privacy and personal data by these third parties.

Security

The Site implements security measures reasonably imposed by the circumstances and proportionate to the risks against unauthorised access, use, transmission, alteration, loss or destruction of Personal Data. These measures include technical, physical and organisational measures. However, given the nature of the Internet as an "open network", the data controller cannot guarantee, nor does it warrant, that data will not be intercepted or acquired by unauthorised third parties.

User rights

Within the limits set by the DPA, the person concerned may in particular:

• to obtain the correction of inaccurate personal data (Art. 5 2 DPA);
• to request, free of charge and with a written answer, whether data relating to him are being processed (Art. 8 1 DPA);
• to stop or revoke his consent to the processing of personal data (Art. 12 2 lit. b) DPA);
• to stop the unlawful processing of personal data (Art. 12 2 lit. a) DPA);
• to prevent, without justification, the disclosure to third parties of personal data worthy of special protection or personality profiles (Art. 12 2 lit. c) DPA);
• to request that data processing be stopped, that disclosure to third parties be prevented or that personal data be corrected or destroyed (Art. 15 1 of the DPA);
• if neither the accuracy nor the inaccuracy of the personal data can be proved, request that a statement be added to the data to highlight the contested nature of the data (Art. 15 para. 1 of the DPA);
• request that the rectification, destruction, blocking, in particular that of disclosure to third parties, as well as the statement of the contested nature or the ruling be communicated to third parties or published (Art. 15 3 DPA);
• to have personal data unlawfully collected, stored or used destroyed;
• to have the illegality of the processing of personal data established;
• to lodge a criminal complaint in the event of a breach of the obligations to inform, notify and co-operate (Art. 34 DPA), as well as of the duty of discretion (Art. 35 DPA).

If the data processing falls within the territorial scope of Article 3 GDPR, the data subject may assert the rights as expressed in Articles 15, 16, 17, 18, 19, 20, 21, 22 GDPR, by addressing the data controller or the data processor. The user has the right, at any time, to request from the controller access to his personal data, rectification, erasure, restriction of processing concerning him or to object to its processing as well as to exercise the right to the portability of such data. Where the processing is based on Article 6(1)(a) or Article 9(2)(a) GDPR, the user has the right to withdraw consent at any time without affecting the lawfulness of the processing based on the consent given before the revocation. The user has the right to lodge a complaint with the Supervisory Authority. In the case of a request for data portability, the data controller shall provide the user with the personal data concerning him/her in a structured, commonly used and machine-readable format, subject to paragraphs 3 and 4 of Article 20 GDPR.

APPLICABLE LAW AND JURISDICTION

The legal relationship between the user and the owner of the Site with respect to access to and use of the Site (and related resources) is governed by Swiss substantive law, excluding the rules of private international law.

The parties choose the Pretura di Lugano (TI) as the exclusive competent court in the event of a dispute arising out of or simply connected with the use of the Site. The owner of the Site reserves the right to bring the case before the competent court at the registered office, branch or domicile of the user.

Effective date: 16 September 2024