1.1 Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

1.2 Definitions

For the purposes of this Privacy Policy:

• Account, a unique account created for You to access our Website or parts of our Website.
• Affiliate, any legal entity that directly or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with Us with at least a fifty percent (50%) ownership interest.
• Company, (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to GENERATION IMPACT GLOBAL, SA 1202, Switzerland, Geneva, Rue de Lausanne, 82.
• Contracted Processor, a Sub-Processor engaged by the Processor, or a person who is processing the data based on the contractual relations with the Processor.
• Cookies, files that are stored on Your computer, mobile device or any other device by a website, containing the details of Your browsing session on our websites.
• Data Controller, for the purposes of the GDPR and FADP, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
• Data Protection Laws, means applicable data protection laws, including but not limited to: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("EU GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) GDPR as it forms parts of the United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"); and (iv) Swiss Federal Data Protection Act of 25 September 2020 and its Ordinance ("FADP"); and all other applicable laws and regulations relating to processing of personal data and privacy that may exist in any relevant jurisdiction, including, where applicable, the guidance and codes of practice issued by supervisory authorities; in each case, as applicable and as may be amended, superseded or replaced.
• Data Subject, any individual whose Personal Data is being processed.
• Device, any device that can access the Website such as a computer, a cell phone or a digital tablet.
• EEA, the European Economic Area.
• GDPR, the EU GDPR and the UK GDPR as applicable.
• Individual Personal Data, Personal Data of individuals, including employees and clients.
• Personal Data, any information that relates to an identified or identifiable individual.
• Personal Data Breach, a breach of security leading to the accidental or unlawful destruction, deletion, loss, alteration, unauthorized disclosure of, or access to, Personal Data. For clarity, a Personal Data Breach will not include unsuccessful attempts or activities that do not compromise the security (confidentiality, integrity, traceability and availability) of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
• Processing, any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. The terms “Process”, “Processes” and “Processed” will be construed accordingly.
• Processor, also referred to as the "Data Processor", refers to the natural or legal person that processes the Personal Data on behalf and on instructions of the Data Controller.
• Service Provider, any natural or legal person who processes the data on behalf and on instructions of the Company. It refers to third-party companies or individuals retained by the Company to facilitate the Website, to provide the Website on behalf of the Company, to perform services related to the Website or to assist the Company in analyzing how the Website is used. Service Providers are considered Data Processors.
• Sub-Processor, any person appointed by or on behalf of Processor to process Personal Data on behalf of the Company in connection with the Agreement.
• Usage Data, data collected automatically, either generated by the use of the Website or from the Website infrastructure itself (for example, the duration of a page visit).
• Website, refers to Company websites, accessible through https://generationimpact.global and https://generationimpact.tech.
• You, refers to the individual accessing or using the Website, or the company, or other legal entity on behalf of which such individual is accessing or using the Website, as applicable.
  • You, can be referred to as the Data Subject or as the User as you are the individual using the Website.

3.1 Types of Data Collected

3.2 Legal Basis

As and to the extent required under Data Protection Laws, we will process Personal Data based on one or multiple of the following grounds:

• Consent: You have given Your consent for processing Personal Data for one or more specific purposes.
• Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof.
• Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.
• Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or of another individual.
• Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Company.
• Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company.

The Company will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

3.3 Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Website, including to monitor the usage of our Website.
• To manage Your Account: to manage Your registration as a user of the Website. The Personal Data You provide can give You access to different functionalities of the Website that are available to You as a registered user.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Website (it being specified that We process Your Personal Data as a Data Controller for this purpose only if You have not instructed Us to do so on Your behalf and that any data processing addendum or other specific data protection arrangement associated with the underlying contract shall take precedence over this Privacy Policy).
• To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application’s push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To provide You with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless You have opted not to receive such information.
• To manage Your requests: To attend and manage Your requests to Us.
• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Website users is among the assets transferred.
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Website, products, services, marketing and your experience.
• Compliance and protection of our interests: We may use your Personal Data to comply with a legal obligation, protect and defend the rights or property of the Company, protect the integrity of the Website, prevent or investigate possible wrongdoing in connection with the Website, protect the personal safety of Users of the Website or the public, mitigate the risks of any potential legal liability of the Company.
• Enforcement: Your Personal Data may also be processed when required to do so by law or in response to valid requests by public authorities (e.g. a final and binding decision of competent court or a government agency).

We may share Your Personal Data with the following third parties:

• With Service Providers: We may share Your personal information with administrative, IT or operational Service Providers and subcontractors to monitor and analyze the use of our Website or to contact You. Please note that such Service Providers may collect, store, use, process and transfer Your Personal Data on their behalf as Data Controllers in accordance with their own privacy policies.
• For business transfers: We may share or transfer Your personal information to interested stakeholders and concerned parties as well as their advisors in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
• With business partners: We may share Your information with Our business partners to offer You certain products, services or promotions.

3.4 Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain Your Personal Data to comply with applicable laws such as for tax, accounting or security reasons), resolve disputes, defend Our rights and interests and enforce our legal agreements and policies.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Website, or We are legally obligated to retain this data for longer time periods. Additionally, we retain Persistent Cookies data for up to 12 months.

3.5 Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company’s operating offices in Switzerland and does not leave Switzerland or the EEA as a matter of principle. However, in certain circumstances, we may transfer Personal Data to third countries outside of Switzerland and the EEA, such as the United States of America. In case of any transfer of Personal Data to third countries outside Switzerland and the EEA which are not providing for an adequate level of data protection, We will take all necessary measures in order to guarantee appropriate data protection of Your Personal Data such as through application of an international treaty or implementation of binding corporate rules or standard contractual clauses, in each case as approved by the competent supervisory authorities. These transfers of Personal Data may also rely on statutory derogations such as your consent, contract necessity, the recognition, safeguarding or exercise of rights, an overriding public interest, Personal Data made public without objection and/or the protection of integrity of Data Subjects.

The Company will take all required steps deemed necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place to ensure the security, confidentiality, integrity, traceability and availability of Your Personal Data.

3.6 Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

That said, we take all technical and organizational measures commensurate to the risks involved to avoid Personal Data Breach and ensure an adequate level of Personal Data confidentiality, availability, integrity and traceability in accordance with Data Protection Laws.

We notably implement rigorous security measures aligned with ISO 27001:2022 standards or equivalent. These include multi-factor authentication (MFA), role-based access control (RBAC), strict policies ensuring only authorized personnel can access data, advanced encryption protocols for data at rest and in transit, firewalls, intrusion detection systems (IDS/IPS), and regular security assessments. Data integrity is ensured in particular through backups and disaster recovery plans. We continuously train employees, swiftly address incidents with a dedicated response team, and rigorously assess vendors and Sub-Processors (including Service Providers) ensuring they meet Our security standards.

Upon request, We provide detailed descriptions of our security measures and regular updates, maintaining transparency and trust. Our security framework is continuously enhanced to meet or exceed industry standards, ensuring top-tier data protection in our cloud environment.

3.7 Your Rights

Your Rights under the FADP

As and to the extent provided under the FADP, Data Subjects have several key rights to control and manage how their Personal Data is Processed. These include a right of access, right to rectification, right to erasure (right to be forgotten), right to restriction, right to data portability, and the right to object to Processing.

You may exercise your rights by contacting Us. Please note that We may ask You to verify Your identity before responding to such requests.

You also have the right to file a complaint to the Federal Data Protection and Information Commissioner (FDPIC).

Your Rights under the GDPR

As and to the extent provided under GDPR, Data Subjects resident in the EEA have the right to:

• Request access to Your Personal Data. The right to access, update or delete the information We have on You. Whenever made possible, you can access, update or request deletion of Your Personal Data directly within Your account settings section. If you are unable to perform these actions yourself, please contact Us to assist You. This also enables You to receive a copy of the Personal Data We hold about You.
• Request correction of the Personal Data that We hold about You. You have the right to have any incomplete or inaccurate information We hold about You corrected.
• Object to processing of Your Personal Data: This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation, which makes You want to object to our processing of Your Personal Data on this ground. You also have the right to object where We are processing Your Personal Data for direct marketing purposes.
• Request erasure of Your Personal Data. You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it.
• Request the transfer of Your Personal Data. We will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for Us to use or where We used the information to perform a contract with You.
• Withdraw Your consent. You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Website.

You may exercise Your rights by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests.

You have the right to complain to a Data Protection Authority about Our Processing of Your Personal Data. For more information, if You are a European Economic Area (EEA) resident, please contact Your local data protection authority in the EEA.