1. Data controller and data protection officer

This privacy statement explains how we collect and process personal data in connection with our bob zero services.

"We" or "bob Finance" refers to bob Finance, branch office of Valora Schweiz AG, Hofackerstrasse 40, 4132 Muttenz.

Your trust is important to us, which is why we take the issue of data protection seriously and ensure appropriate security. We are committed to handling your personal data responsibly. Consequently, we consider it a matter of course to comply with the legal requirements of the Swiss Federal Act on Data Protection (FADP), the Ordinance to the Federal Act on Data Protection (FADP), the Telecommunications Act (TCA) and other provisions of Swiss data protection law.

You can reach our group data protection officer by e-mail at dataprivacy@valora.com.

2. Categories of data and purposes of processing

Data in connection with bob zero: If you wish to conclude a bob zero financing contract with your seller, the seller will collect certain data from you. The seller enters your personal master data (title, surname, first name) as well as your contact data (e-mail address, address, previous address if applicable and mobile number) in our digital bob partner portal, through which the data can be viewed by us.

Based on this data, we carry out an initial, automated check to determine whether you are eligible for bob zero financing. To do this, we query your credit score and any existing loans with the relevant credit agencies (CRIF, ZEK), and check our internal database to see whether you already have a contractual relationship with us and/or one of our partners. In addition, we will have a service provider verify the data of a valid identification document provided by you (including nationality, residence title and period of validity).

All of the data described above is collected for the purposes of checking your creditworthiness, verifying the information you have provided (including verification of your e-mail address by means of a verification e-mail) and clarifying the possible framework conditions for any bob zero financing (financing amount and term).

In order to enable your salesperson to make you a suitable bob zero offer, your balance available for bob zero (or remaining balance) will be shown to him on a daily basis. We cannot influence any other processing of your data by the seller. However, your seller is obliged by the cooperation agreement with us to comply with the applicable data protection regulations. The seller's privacy statement applies.

If bob zero financing can be offered to you, the aforementioned data will furthermore be used for contacting you as well as for invoicing and dunning (via SMS, e-mail or letter post) in relation to the outstanding claim amount according to your bob zero financing contract with the seller.

Direct marketing: If you give us your consent to do so, we will use your email address and certain demographic data (age, gender, postcode, language) as well as your contract master data to send you attractive offers and relevant information about our products.

Website log data: When you visit our website, our web server automatically records details of your visit, for example your IP address, the website from which you visit us, the type of browser software you use and certain information relating to your website usage, including the date and duration of your visit, as well as details of which products you have viewed on our website. We use tracking technologies, cookies and third-party analytics services to collect log and analytics data. You can find out more about this topic in our Cookie Policy.

3. Sharing of your personal data

• Disclosure to employees and affiliates: Where necessary for the processing purposes set out above, we may disclose your personal data to our own employees as well as to our affiliates (regularly within, and only exceptionally outside, Switzerland).
• Disclosure to third parties:
  • Credit reference agencies: If you apply for bob zero financing, we will transmit your personal data (name, address, date of birth, financing amount) to credit reference agencies (e.g. ZEK, CRIF). In the course of the credit check, we will also check your data against our internal customer and contract databases. In addition, we may report any qualified delinquencies or abuses to the above-mentioned agencies.
  • Seller: We will notify the seller of the results of the credit check and ID verification, but we will not disclose any details of the check. We also notify the seller of your individual available balance (or remaining balance) and the maximum possible term for a bob zero financing.

Please note: We have no influence on the data processing by the above-mentioned third parties. Information on the processing of your personal data by these third parties can be requested directly from them or can be found in their respective privacy statement.

• Sharing with data processors: We have appointed data processors to store your personal data in a secure database. We have entered into a data processing agreement with our data processors to ensure that your personal data is adequately protected at all times and is only processed as we would be permitted to do.
• Disclosure in connection with financial transactions: If we are involved in a business combination (merger), joint venture, acquisition or sale of shares in a business or assets, we may disclose your information to any party to the transaction.
• Disclosure in connection with criminal proceedings: To the extent permitted by law, we may disclose information that is necessary or helpful to investigate or prevent an actual or suspected crime or other violation of our rights or the rights of a third party.

4. Automated decisions

When you apply for bob zero financing, an automated check of your creditworthiness (based purely on our internal guidelines and a credit check with one or more credit reference agencies) and your application data is carried out on the basis of the information you provide in the application process. If you receive a rejection as a result of the automated check, you have the right to contact us in this regard and to comment on the decision.

5. Place of processing and transfer to third countries

Your data will be processed in Switzerland and in the member states of the European Union. We are also entitled to transfer your personal data to third parties abroad, in particular affiliates, if this is necessary within the scope of the processing purpose. In doing so, the legal regulations on the transfer of personal data to third parties are, of course, complied with. These third parties are bound to the same extent as we are to applicable data protection laws. If the level of data protection in a country under its local laws does not correspond to Swiss data protection law, we will contractually ensure that the protection of your personal data corresponds to that in Switzerland at all times. To this end, we will either conclude the recognized standard contractual clauses with the recipient and/or implement other additional suitable guarantees.

Further, some third-party service providers may be based in the USA. For the sake of completeness, we would like to point out to users who are resident or domiciled in Switzerland that there are monitoring measures in place in the USA by US authorities which generally allow the storage of all personal data of all persons whose data has been transferred from Switzerland to the USA. This is done without any differentiation, restriction or exception based on the objective pursued and without any objective criterion that makes it possible to restrict the access of the US authorities to the data and their subsequent use to very specific, strictly limited purposes that are capable of justifying the interference associated with both access to and use of this data. Furthermore, we would like to point out that there are no legal remedies available in the USA for data subjects from Switzerland to obtain access to the data concerning them and to obtain their correction or deletion, or that there is no effective judicial legal protection against general access rights of US authorities.

We would like to point out to users residing in Switzerland or in a member state of the EU that, from the perspective of Switzerland and the European Union, the USA does not have an adequate level of data protection - among other things due to the issues mentioned in this section. Insofar as recipients of data are based in the USA, we will ensure that your data is protected at an appropriate level with our partners by means of contractual arrangements with these companies and, if necessary, additional required appropriate guarantees that protect the rights of persons whose personal data is transferred to a third country.

6. Own social media presences

On our website you will find links to social media networks. These are not plugins provided by the social media network, which, without any influence from the user, already transmit data to the provider when the page is loaded. Behind the buttons to the social media networks is merely a link to our presence on the social media network. No user data is transmitted from our website to the social media network.

The links lead to our appearances on the following networks:

• Facebook by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland,
• Instagram by Instagram Inc, 1601 Willow Road, Menlo Park, CA 94025, USA,
• LinkedIn operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA,
• YouTube operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and
• Kununu operated by New Work SE, Dammtorstrase 30, 20354 Hamburg.

When you call up a link to one of our social media profiles, a direct connection is established between your browser and the server of the social network in question. This provides the network with the information that you have visited our website with your IP address and called up the link. If you call up a link to a network while you are logged into your account with the network in question, the content of our site can be linked to your profile with the network, which means that the network can assign your visit to our website directly to your user account. If you want to prevent this, you should log out before activating corresponding links. An assignment will take place in any case if you log in to the relevant network after activating the link.

Please note: We have not checked third-party websites linked on our website and do not assume any responsibility for how the above-mentioned social media networks process personal data. We recommend that you read the privacy statements of third-party websites in advance.

7. Data security

We use suitable and appropriate technical and organizational security measures to protect your personal data stored with us against manipulation, partial or complete loss and unauthorized access by third parties. Our security measures are continuously reviewed, adapted and improved in line with technological developments.

You should always treat your access data confidentially and close the browser window when you have finished communicating with us, especially if you share the terminal device with others.

We take internal company data protection very seriously. Our employees and the service companies commissioned by us have been obligated by us to maintain confidentiality and to comply with the provisions of data protection law.

8. Duration of processing

We process your personal data only for as long as is necessary for the respective processing purpose or until the statutory or contractual retention period for your personal data has expired.

• We store personal master data, contact data, data in connection with the performance of the contract and data for performing credit checks for a period of 10 years after the bob zero financing contract has been terminated. If you submit a bob zero financing application but no contract has been concluded, your data will be deleted after 14 months at the latest.
• We store electronic correspondence for a maximum period of 5 years, unless the correspondence is required as part of a legal dispute.
• If you have consented to receive attractive offers and information about our products from us, we will use your e-mail address for this purpose until you revoke your consent, for example by clicking the "Unsubscribe Newsletter" link in our e-mail.

9. Your rights

You have the following rights in connection with your personal data:

• Revocation of consents: For those data processing operations to which you have given your consent, you have the right to revoke it at any time.
• Right of access: You also have the right to receive information from us what data we process about you, on what legal basis and for what purposes we process that data, as well as to request a free copy of your personal data.
• Right to rectification: If your data is incomplete or incorrect, you have the right to request rectification of your personal data. Some information you can correct on your own in your customer account.
• Right to erasure: You can request that your personal data be deleted, especially if it is no longer needed for the purposes described.
• Right to restriction: You can request the restriction of the processing and/or disclosure of your personal data.
• Automated decisions: Where, in the context of this website, decisions are based exclusively on automated processing, you may request a manual review of the decision.

If you wish to exercise your rights, please direct your request to our group data protection officer (contact information in section 1).

Right to complain: If you have reason to believe that bob Finance is not processing your personal data in accordance with applicable laws and regulations and/or if you do not agree with the response to your request to grant your rights, you may file a complaint with the competent supervisory authority.

Last updated on: July 2021