1. introduction
This privacy statement describes how the Pension Fund of the C&A Group (hereinafter also referred to as PKCA, we or us) handles personal data.
2. Who is responsible for data processing?
The company responsible under data protection law for a particular data processing operation is the company that determines whether this processing is to take place, for what purposes it is to take place and how it is to be structured.
The Pension Fund of the C&A Group is responsible under data protection law for data processing in accordance with this data protection declaration.
3. for whom and for whom is this data protection declaration intended?
This data protection declaration applies to all persons whose data the PKCA processes. It applies regardless of the manner in which the individuals come into contact with PKCA. It applies to the processing of all personal data that PKCA collects in connection with the provision of occupational benefits and related activities.
In particular, the data processing may concern the following categories of persons, insofar as PKCA processes personal data in this context:
- Insured persons in the occupational benefit scheme
- former, current and future employers of insured persons or their contact persons;
- Dependents of insured persons (e.g. current and former spouses, life partners, parents and children) and other beneficiaries;
- Authorized representatives (e.g., legal representative);
- Members of the PKCA's governing bodies;
- external consultants and service providers;
- Contact persons of social and private insurers, other pension and vested benefits institutions, suppliers and partners, as well as authorities and agencies;
- Persons who write to PKCA or otherwise contact PKCA.
PKCA operates in the area of both mandatory and non-mandatory occupational benefits. In the area of mandatory pension provision, it processes personal data on the basis of the applicable legal provisions. In this area, PKCA is exempt from the obligation to provide information on data processing. Nevertheless, PKCA provides information in this privacy statement across its entire range of activities, and references in this privacy statement apply in each case to the mandatory and non-compulsory areas.
4. What personal data is processed?
"Personal data" is information that can be associated with a specific individual.
4.1 Master data
Master data is the basic data about you that PKCA needs to process contractual and other business relationships. Depending on the capacity in which you deal with PKCA, master data includes, for example:
- Salutation, first name, last name, gender, date of birth;
- Address, e-mail address, telephone number and other contact details;
- To provide occupational benefits: marital status, date of marriage or divorce or registration or dissolution of partnership, age, gender, nationality and hometown, information from identification data (e.g., from passport, ID or other identification documents), OASI number, contract number, policy number and insured number, details of the previous pension or vested benefits institution, date of joining and leaving the employer, personnel category, degree of ability to work, degree of employment, time limit of the employment relationship, reported and insured annual salary and the BVG annual salary. This data also includes information on relationships with third parties who are also affected by the data processing, e.g. relatives and beneficiaries;
- For advance capital withdrawal: marital status, profession/function, employer, bank details;
- For members of governing bodies: curriculum vitae, bank account details, copy of identification documents;
- For employers and other contractual partners that are companies: Data of contact persons, e.g. name and address, information on titles, function in the company, qualifications and, if applicable, information on supervisors and employees.
4.2 Contract, case and service data.
This is personal data related to the conclusion, settlement or termination of contracts, to the enrolment of insured persons in the occupational pension plan, to the receipt of notifications, to the processing of pension cases and to other benefits (e.g. payment of termination benefits). This data includes, in particular, the following data:
- Information in connection with the affiliation contract with employers;
- Data in connection with the processing of pension claims (e.g. the notification of the occurrence of the pension claim, the claim number, data on the reason for the pension claim such as accident or illness and the event date, data in connection with the examination of the pension claim, data on other insurance companies and insurers and on third parties such as persons involved, and also personal data requiring special protection (e.g. health data) and data on third parties (e.g. on persons involved in the occurrence of the incapacity to work or death);
- information on the termination benefit, e.g. its amount and on possible and effected purchases;
- for other benefit cases, e.g. information in connection with the payment of the termination benefit (e.g. on its reason, but also information on accounts and vested benefits institutions and, if applicable, the consent of the spouse) or in connection with a change in marital status (e.g. date of a divorce, termination benefits acquired, advance withdrawals or disability pensions drawn and court orders in this connection).
4.3 Financial data
Financial data is personal data relating to financial circumstances, payments and the enforcement of claims. This includes information relating to payments and bank details, e.g. employer contribution payments, and to the enforcement of claims, and, in the case of insured persons, also information on salary, purchases into the occupational pension scheme and payments of termination benefits and pensions. PKCA also processes financial data on beneficiaries, e.g. in connection with pensions to surviving spouses, children and other beneficiaries.
4.4 Communication data
When contacting PKCA, PKCA processes your information as well as the exchanged content. Data is processed in order to be able to respond to the content of the contact. PKCA reserves the right to collect further personal data if this is necessary for the fulfillment of its services.
Communication data are in particular name and contact details such as postal address, e-mail address and telephone number, the content of e-mails. other written correspondence, telephone conversations, video conferences, etc.; information on the type, time and possibly location of the communication; proof of identity such as copies of official IDs and marginal data of the communication.
4.5 Technical data
Each time the PKCA website is called up, a series of general data and information is collected. This general data and information is stored in the server's log files. The following data may be collected: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system accesses our website (so-called referrer), (4) the sub-websites that are accessed via an accessing system on our website, (5) the date and time of an access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information that serve to avert danger in the event of attacks on our IT infrastructure.
This data and information is required to display the contents of our website correctly, to optimize the contents of our website and to ensure the permanent functionality of our website.
Links to other websites
The PKCA website may contain links to websites of other providers. We have no influence on these websites, their contents, offers or availability or the data protection declarations and regulations applicable there.
Cookies
PKCA may use cookies on its website. Cookies contain a so-called cookie ID, a unique identifier of the cookie, which assigns web pages and servers to a specific Internet browser. A specific Internet browser can be recognized and identified via this unique cookie ID.
4.6 Other data
PKCA also collects data from you in other situations. In connection with official or judicial proceedings, for example, data is generated (such as files, evidence, etc.) that may also relate to you. The PKCA may also collect data for reasons of health protection.
5. Where does the personal data come from?
5.1 Data provided by you
You provide certain personal data to the PKCA yourself, e.g. when you transmit data to the PKCA or communicate with the PKCA. This can be done through various channels.
5.2 Data received from third parties
PKCA receives personal data in connection with the implementation of the occupational pension plan mainly from current or former employers. These are legally obliged to provide PKCA with all data required for the implementation of the occupational benefit scheme. However, PKCA may also receive information about you from other third parties, e.g. from companies with which PKCA cooperates, from persons who communicate with PKCA, or from public sources.
For example, PKCA may receive personal information from the following third parties:
- From employers;
- from persons close to you (family members, legal representatives, etc.), e.g. powers of attorney;
- from the Swiss postal service and public offices, e.g. for address updates;
- from banks and other financial service providers, private and social insurance companies, pension and vested benefits institutions;
- from experts and from doctors and other service providers from whom the PKCA also receives health data during clarifications, if necessary with a separate declaration of release;
- from service providers;
- from authorities, courts, parties and other third parties in connection with official and judicial proceedings;
- from public registers such as the debt enforcement register or commercial register, from public bodies such as the Federal Statistical Office, from the media or from the Internet.
The data that the PKCA processes in accordance with this privacy policy does not only relate to insured persons, but often also to third parties. If you transmit data about third parties to the PKCA, the PKCA assumes that you are authorized to do so and that this data is correct. By transmitting data via third parties, you confirm this. Therefore, please inform these third parties about the processing of their data by PKCA and provide them with a copy of this privacy policy.
6. For what purposes is personal data processed?
Personal data is processed primarily for the purpose of implementing the occupational pension plan. This includes, for example
- the conclusion and processing of affiliation contracts with the employer, including advice, the enforcement of legal claims arising from contracts, accounting and the termination of contracts.
- the enrollment of insured persons. In addition to master data, one or more pension capital accounts are maintained for each insured person, for which information on contributions, purchases, retirement assets and withdrawals must be processed;
- the examination and settlement of pension cases, including coordination with other insurers such as disability insurance and the enforcement of recourse claims. For this purpose, the PKCA primarily processes contract, case and benefit data of the insured person and of dependents and beneficiaries, also health data and data from third parties such as external experts and service providers;
PKCA also processes personal data for related purposes, including but not limited to the following purposes:
- Communication: for communicating with you, such as responding to inquiries;
- Contract execution: In connection with the initiation, administration and settlement of contractual relationships;
- Security and prevention: For security purposes, to ensure IT security, for fraud and abuse prevention and for evidence purposes;
- Compliance with legal requirements: To create the conditions for compliance with legal requirements, to comply with legal obligations, and to prevent and detect violations.
- Legal preservation: to enforce claims and defend against claims by others. PKCA therefore also processes personal data for legal preservation, e.g. to enforce claims in court, before or out of court and before authorities in Switzerland and, if necessary, also abroad, or to defend against claims.
- Other purposes: e.g. as part of internal processes and administration. This includes IT administration, accounting, archiving of data and management of archives; training and education; reviewing or carrying out transactions under company law; forwarding inquiries to the relevant bodies; the sale of receivables, where we provide the purchaser, for example, with information on the reason for and amount of the receivable and, where applicable, the creditworthiness and conduct of the debtor; in general, the review and improvement of internal processes.
7. on what legal basis are personal data processed?
In the area of mandatory occupational benefits, the PKCA processes personal data on the basis of the applicable legal provisions, i.e. the legislation on occupational benefits: in particular, the Federal Law on Occupational Retirement, Survivors' and Disability Pension Plans (BVG) and the Federal Law on Vesting in Occupational Benefits (FZG) and the associated ordinances. As a federal body, the PKCA processes your personal data in this area within the scope of the statutory processing powers (e.g. Art. 85a et seq. BVG).
In the area of non-compulsory pension provision, data processing is subject to the provisions of the Data Protection Act (DPA). In this context, PKCA processes your personal data in particular for the performance of a contract with the data subject or for pre-contractual measures (e.g. the review of a contract application), for the exercise of legitimate interests, based on a separate consent or for compliance with legal provisions.
8. To whom is personal data disclosed?
The implementation of the occupational pension plan requires cooperation with other bodies in some cases. All data disclosures made by PKCA are required for legal or operational reasons. If personal data is processed by external order processors or responsible parties, PKCA ensures that the legal requirements are met.
You will find below an overview of the categories of recipients to whom PKCA may disclose data:
- Employers: these do not receive data about your health or operations such as purchases, advance withdrawals, etc.
- Vested benefits institutions, other pension funds, public authorities and offices (e.g. social insurance institutions such as disability insurance or social welfare offices in particular), other insurers, medical service providers and experts, banks and lenders, courts and external lawyers: These receive data, particularly in the case of pension cases.
- Authorities and offices.
- Other persons: Where the inclusion of third parties results from the purposes pursuant to Section 6, data may also be disclosed to other recipients.
- Service providers: These service providers process personal data on behalf of PKCA as so-called "order processors". These order processors are obliged to process personal data exclusively in accordance with PKCA's instructions and to take appropriate data security measures. Certain service providers are also jointly responsible with PKCA or independently responsible (see section 2). By selecting the service providers and through appropriate contractual agreements, PKCA ensures that data protection is guaranteed throughout the processing of your personal data.
The aforementioned disclosures are required for legal or operational reasons. Legal and contractual confidentiality obligations therefore do not preclude these disclosures.
9. Will personal data be disclosed abroad?
No, the PKCA processes personal data in Switzerland.
10. how is personal data requiring special protection processed?
Certain types of personal data are considered "particularly sensitive" under data protection law, e.g. information on health and biometric characteristics. PKCA only processes personal data requiring special protection to the extent that this is necessary in connection with the implementation of the occupational benefit plan, in particular when processing disability cases, and with your separate consent.
11. Are automated decisions made?
PKCA does not use automated decision-making.
12. How is personal data protected?
PKCA takes appropriate security measures to protect the security of your personal data.
PKCA ensures that the data processors it engages take appropriate security measures of a technical and organizational nature to maintain the security of your personal data, to protect it against unauthorized or unlawful processing, and to protect against the risk of loss, accidental alteration, unauthorized disclosure or access. However, like all companies, PKCA cannot rule out data security breaches with absolute certainty; certain residual risks are unavoidable.
13. How long is personal data processed?
PKCA processes and stores your personal data,
- as long as it is necessary for the respective purpose of processing;
- as long as PKCA has a legitimate interest in storing it. This may be the case in particular if personal data is needed to enforce or defend claims, for archiving purposes and to ensure IT security;
- as long as PKCA is subject to a legal obligation to retain data.
14. What rights do you have in connection with the processing of your personal data?
You have the right to,
- request information about your personal data stored by PKCA;
- to have incorrect or incomplete personal data corrected;
- to request the deletion or anonymization of your personal data if it is not (or no longer) required for the implementation of the occupational benefit plan;
- the right to request the restriction of the processing of your personal data, insofar as the processing is not (any longer) necessary for the implementation of the occupational benefit scheme;
- to receive certain personal data in a structured, common and machine-readable format;
- to revoke consent with effect for the future, insofar as processing is based on consent.
Please note that these rights may be restricted or excluded in individual cases, e.g. if there are doubts about the identity or if this is necessary to protect other persons, to protect interests worthy of protection or to comply with legal obligations.
You are also free to lodge a complaint with a competent supervisory authority if you have concerns about whether the processing of your personal data complies with the law. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
15. How can you contact us?
If you have any questions about this privacy statement or the processing of your personal data, please contact:
Pensionskasse der C&A Gruppe, Datenschutz, Oberneuhofstrasse 6, 6340 Baar.
PKCA has also appointed a data protection advisor. The data protection advisor acts, among other things, as a contact person for the supervisory authority. He can be reached at the above address.
16. Changes to this data protection declaration
This Privacy Policy may be amended over time, in particular if PKCA changes data processing operations or if new legislation becomes applicable. In general, the data protection statement in the version current at the start of the processing in question applies to data processing in each case.
August 2023