Privacy Policy for the Public Website

1. What is this privacy policy about?

Trenda AG (hereinafter also "Trenda", "we", "us") collects and processes personal data relating to you or to other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data".

In this privacy policy, we describe what we do with your data when you use our publicly accessible website (at https://www.trenda.ch, hereinafter also the "website"). For the use of our platform as a customer and for business dealings with Trenda, a separate privacy policy is available on our privacy page.

This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the Swiss Federal Act on Data Protection ("FADP").

2. Who is responsible for processing your data?

The controller for the data processing described in this privacy policy is Trenda AG, Seidenplatz 1, 8304 Wallisellen, Switzerland ("Trenda"), unless otherwise communicated in individual cases.

You can contact us about data protection matters and to exercise your rights under Section 11 as follows:

Trenda AG
Data Protection Officer
Seidenplatz 1
8304 Wallisellen - Switzerland
privacy@trenda.ch

3. What data do we process?

When you use the public website and when you contact us via the contact form or otherwise, we process various categories of data about you (hereinafter "data"). The most important categories are:

• Technical data: When you use our website, we collect the IP address of your device and other technical data to ensure functionality and security. This data also includes logs that record the use of our systems. We generally keep technical data for one month. To ensure the functionality of the website, we may also assign an individual code to you or your device (e.g. in the form of a cookie, see Section 12). Technical data on its own generally does not allow any conclusions about your identity.
• Communication data: When you are in contact with us via the contact form, by email, phone or chat, by letter or by other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. If we want or need to establish your identity, e.g. for a request for information you have made, we collect data to identify you.

  We generally keep communication data for 3 months. This period may be longer where this is necessary for evidentiary reasons, to comply with legal or contractual requirements, or for technical reasons.

4. For what purposes do we process your data?

We process the data collected in connection with the public website for the purposes explained below. These purposes and the objectives behind them represent legitimate interests of ours and, where applicable, of third parties. You will find more information on the legal bases of our processing in Section 5.

We process your data for purposes related to communication with you, in particular to answer enquiries and to handle the exercise of your rights (Section 11), and to contact you with follow-up questions. For this, we mainly use communication data and, if you have a customer relationship with us, other categories of data (see the separate privacy policy for business relations, in German). We keep this data to document our communication with you, for training purposes, for quality assurance and for follow-up questions.

We process data to establish, manage, perform and settle the contractual relationship with you or to process your request (see also the separate privacy policy for business relations).

We process data for marketing purposes and relationship management. This can take the form of newsletters and other regular (electronic) contacts, but also individual marketing activities (e.g. events). You can refuse such contacts at any time (see the end of this Section 4). With your consent, we also show you ads for Trenda on third-party websites and measure their effect (Google Ads, see Section 12).

We also process your data to improve the website and our operations (e.g. anonymized access data of the website and, with your consent, usage statistics with Google Analytics, see Section 12).

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations ("compliance").

We also process data for the purposes of our risk management and as part of prudent corporate governance, including business organization and corporate development.

You can refuse marketing contacts at any time: newsletters via the unsubscribe link in each email, other contacts by email to us (you will find our contact details in Section 2), and advertising via Google Ads through the "Cookie Settings" at the bottom of every page (see Section 12).

5. On what legal basis do we process your data?

Where we ask for your consent for certain processing (e.g. for marketing emails), we inform you separately about the purposes of the processing. You can withdraw your consent at any time with effect for the future by written notice or by email to us; you will find our contact details in Section 2. You can also withdraw your consent to marketing cookies at any time via the "Cookie Settings" at the bottom of every page (see Section 12). Once we have received notice of the withdrawal of your consent, we will no longer process your data for the purposes you originally consented to, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that it is necessary for initiating, performing or settling a contract with you (or the entity you represent), or that we or third parties have a legitimate interest in it, in particular to pursue the purposes and related objectives described in Section 4 and to take the corresponding measures. Our legitimate interests also include compliance with legal requirements, insofar as this is not already recognized as a legal basis by the applicable data protection law (e.g. under the GDPR, the law in the EEA and in Switzerland). They also include marketing our products and services, the interest in better understanding our markets, and running and developing our company, including its operations, safely and efficiently.

We may also process your data on other legal bases, e.g. in the event of disputes, where processing is necessary for possible litigation or for enforcing or defending legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately where necessary.

6. What applies to profiling and automated individual decisions?

"Profiling" means the automated processing of personal data to analyze or predict certain personal aspects or behavior. This allows, for example, customers to be looked after and advised more individually, or offers to be better tailored to individual customer needs. We do not carry out profiling on the public website. However, if you allow marketing cookies, Google analyzes your usage behavior to show you interest-based advertising (see Section 12).

"Automated individual decisions" are decisions that are made fully automatically, i.e. without relevant human influence, and that have negative legal effects or similarly negative effects for the customer. We do not make automated individual decisions.

7. Who do we disclose your data to?

In connection with the operation of our website, to protect our legitimate interests and for the other purposes listed in Section 4, we also disclose your personal data to third parties, in particular to the following categories of recipients:

• Service providers: We work with service providers in Switzerland and abroad that process data about you on our behalf (e.g. hosting and IT providers, providers of chat software, providers of our email, online conferencing, office and accounting applications, the provider of our newsletter application). We also use services from service providers so that we can provide our services efficiently. We conclude contracts with these service providers that include provisions on data protection, insofar as such protection does not already follow from the law.

  We publish a regularly updated list of data protection-relevant service providers and subprocessors (in German), including where data is stored and processed.

• Authorities: We may disclose personal data to agencies, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests (e.g. in criminal investigations, police measures, regulatory requirements and investigations, court proceedings, reporting obligations, pre-trial and out-of-court proceedings, and statutory obligations to provide information and to cooperate).

All these categories of recipients may in turn involve third parties, so that your data may also be made accessible to them. We can restrict the processing by certain third parties (e.g. IT providers), but not that of other third parties (e.g. authorities, banks, etc.).

8. Where do we process your data?

As explained in Section 7, we also disclose data to other bodies that are not only located in Switzerland. Your communication data is generally stored and processed in the EU or in Switzerland. If you allow statistics or marketing cookies, data is also transferred to Google and may be processed in the USA (see Section 12).

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection law, unless the recipient is already subject to a legally recognized set of rules ensuring data protection or we can rely on an exemption.

9. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require, or as long as storage is technically necessary. You will find further information on the respective storage and processing periods under the individual data categories in Section 3. Unless legal or contractual obligations prevent it, we delete or anonymize your data after the storage or processing period has expired, as part of our usual processes.

10. How do we protect your data?

We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing, and to counter the risks of loss, accidental alteration, unwanted disclosure or unauthorized access.

11. What rights do you have?

To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

• The right to request information from us as to whether and which data we process about you
• The right to have us correct data if it is inaccurate
• The right to request the deletion of data
• The right to request that we hand over certain personal data in a common electronic format or transfer it to another controller
• The right to withdraw consent, insofar as our processing is based on your consent
• The right to receive, on request, further information necessary to exercise these rights

If you wish to exercise the above rights, please contact us by email; you will find our contact details in Section 2. To rule out misuse, we need to identify you (e.g. with a copy of your ID, where this is not possible otherwise).

Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly where applicable. In particular, we may need to continue processing and storing your personal data to perform a contract with you, to protect our own legitimate interests, such as asserting, exercising or defending legal claims, or to comply with legal obligations.

If you do not agree with how we handle your rights or data protection, please let us know by email (you will find our contact details in Section 2). In particular, if you are in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority of your country.

12. Do we use cookies and online tracking technologies?

We use cookies and similar technologies on our website (e.g. your browser's local storage). A cookie is a small file that your web browser stores on your computer or mobile device when you visit our website. When you visit the website again, your browser can be recognized in this way, even if we do not know who you are. We distinguish three categories:

• Necessary cookies: They are required for the operation and security of the website, e.g. to maintain your session, to protect forms against misuse and to store your language, your color theme and your cookie settings. We use them based on our legitimate interest in a functioning and secure website; they cannot be turned off.
• Statistics cookies: They show us how our website is used, e.g. which pages are visited and how visitors find us, so that we can improve the website. We only use them if you have given your consent (Google Analytics, see below).
• Marketing cookies: They are used to show you ads for Trenda on other websites and to measure the effect of our ads. We only use them if you have given your consent (Google Ads, see below).

On your first visit, a banner asks whether you allow statistics and marketing cookies. Until you have given your consent, we do not load any of these services. We store your choice in a cookie for six months; after that, or if we change the services we use, we ask you again. You can change or withdraw your consent at any time with effect for the future via the Cookie Settings at the bottom of every page. There you will also find a list of the individual cookies with their purpose and storage period. After a withdrawal, we delete the statistics and marketing cookies stored on our domain. You can delete cookies that Google has set on its own domains in your browser. You can also set your browser to reject cookies, to store them only for one session or to delete them early.

Google Ads: With your consent, we use Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which relies on Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (both "Google"). We use Google Ads to show you ads for Trenda on third-party websites and apps after you have visited our website (remarketing) and to measure how many visits to our website result from our ads. For this purpose, your browser loads the Google tag (gtag.js) from Google's servers. It stores cookies (e.g. "_gcl_au") and entries in your browser's local storage and transmits information such as your IP address, the pages you visit, details of your browser and device, and an online identifier to Google. Google may combine this information with other data, e.g. if you are signed in to Google, and use it for its own purposes, for which Google itself is responsible. We only receive aggregated reports from Google and no information that allows us to identify you.

Google Analytics: With your consent, we also use Google Analytics, another service of Google. It shows us how our website is used, e.g. which pages are visited and how often, how long visits last and through which websites or search engines visitors find us. For this purpose, your browser loads the Google tag (gtag.js) from Google's servers. It stores cookies ("_ga" and "_ga_" with an identifier of our website) and transmits information such as the pages you visit, the website you came from, details of your browser and device, your approximate location and a random identifier to Google. According to Google, it only uses your IP address to determine your approximate location and does not store it. We only receive aggregated reports from Google and no information that allows us to identify you.

The legal basis for Google Ads and Google Analytics is your consent (Art. 6(1)(a) GDPR). Google may transfer the data to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, which the European Commission and the Swiss Federal Council respectively recognize as adequate. You will find more information in Google's privacy policy and under "How Google uses information from sites or apps that use our services". You can manage your ad settings with Google in My Ad Center.

Emails: In our marketing newsletters and other marketing emails, we sometimes include, where permitted, visible and invisible image elements. When these are retrieved from our servers, we can determine whether and when you opened the email, so that we can measure and better understand how you use our offers and tailor them to you. By consenting to receive newsletters and other marketing emails, you agree to the use of this technology. If you do not want this, you can block the image elements in your email program; most email programs do this by default.

13. Can this privacy policy change?

We may change this privacy policy at any time. The version published on this website is the current version. If different language versions contradict each other, the German version prevails.

Last updated: October 28, 2026