Impulze DATA PROTECTION POLICY
Last Update: 13 March 2023 - note: the original German version (PDF download) is the legally binding version
1. General note
Based on Article 13 of the Swiss Federal Constitution and the federal data protection regulations (Data Protection Act, Ordinance to the Federal Data Protection Act), as well as the European Data Protection Regulation (EU-DSGVO), every person is entitled to protection of their privacy as well as protection against misuse of their personal data.
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
2. Person in charge of data protection at impulze: contact details
The responsible person in the sense of the data protection legislation is:
impulze GmbH
Rämistrasse 50
8001 Zürich
Commercial register number: CHE-115.954.251
Please direct your questions about data protection to:
E-Mail: dataprotection@impulze.ch
Tel.: +41 43 817 86 17
3. General information and definitions
This Privacy Policy applies to the use of our website www.impulze.ch in general, the use of our eSurvey tool provided by Qualtrics (www.qualtrics.com), our participant database www.impulzedb.ch, contacting our company, and telephone and in-person interview surveys to which we invite you.
As part of our activities, we process data from you in order to be able to provide a functional website and to provide companies and authorities with decision-making aids on a statistical basis. Market, social and opinion research aims to observe, measure and describe behavior, attitudes, opinions, etc.. It is not about your data as a person, but about mean values of a group of persons. Your data can be collected in different ways (online, by telephone, in writing or in person with an interviewer or by means of a measuring device).
We only collect personal data that is actually required for the performance of our tasks and services or that you provide to us voluntarily.
For the purposes of this privacy policy, the following definitions apply:
4. Purpose and legal basis of data processing
We process your personal data for the purposes described below and/or in accordance with your consent. We process personal data only to the extent that it is necessary for the fulfillment of the respective purposes.
We process personal data exclusively as described in this Privacy Policy, unless you have given your expressed consent to process your personal data in a different way.
If we intend to use your personal data that we process with your consent for purposes other than those described in the consent form, we will ask for your consent in advance and will process your personal data only with your permission in cases where the processing depends on your consent.
Your data will not be used for the purpose of automated decision making or profiling.
The processing of personal data is justified by the overriding legitimate interest of the controller, in particular if the processing is directly related to the initiation, conclusion or performance of a contract.
Providing access to the website
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected:
Implementation of web analysis
We analyze the use of our website with the web analytics SmartAnalytics® of our hosting provider Webland.ch. This is used exclusively to optimize the website in terms of user-friendliness and to provide useful information about our services. This data is not merged with other personal data sources or passed on to third parties. There is also no personal analysis. The analyses are based on anonymized data records.
Contact, registration data, and direct communication
In order to process your contact and provide our services, we collect personal data such as name, postal address, telephone number, banking details for honoraria payments, and e-mail address ("registration data", in the case of repeated participation also referred to as your "master data").
We process your Personal Data to respond to your inquiry, communicate with you about our services, and inform you about our policies and terms.
In addition, we process your Personal Data as set forth in the consent form of the surveys in which you participate.
Survey Data
We process various data within the scope of surveys, which serve as decision-making aids on a statistical basis. The aim is to analyze behavior, opinions and attitudes. In doing so, we do not interpret your personal data, but the data of a group of persons in an anonymous way.
Legal obligations and legal defense
We may be required to process personal data for legal reasons, for example in connection with pharmacovigilance policies or to prevent loss, fraud or other misuse of our services and IT systems.
We may also process your personal data to comply with our internal and external audit requirements or data security purposes, or to protect our rights, data security, safety, property or the rights of others.
Cookies
Our websites, including the eSurvey Tool, use cookies and other technologies to improve user experience, website performance, usability, and for survey completion.
Cookies are small text files that make it possible to store specific information related to the user on the user's terminal device while the user is using the website. Cookies make it possible, in particular, to determine the frequency of use and number of users of the pages, to analyze behavior patterns of page use, but also to make our offer more customer-friendly. Cookies remain stored beyond the end of a browser session and can be retrieved when you visit the site again. If you do not wish this to happen, you should set your Internet browser so that it refuses to accept cookies.
Please note that not all functions of our online offer, in particular the automatic caching in the eSurvey tool, can be used if cookies are refused.
Log files
In the eSurvey Tool, we collect data, including personal data, that your device transmits whenever it connects to the Internet. This data includes, but is not limited to, the IP address (Internet Protocol address), the type and version of operating system and browser, the date and time of requests to our servers, and device manufacturer and model information, if applicable.
Third party websites
Our websites may contain links to websites that are not affiliated with impulze and are not operated, controlled or administered by us.
The policies and practices set forth herein do not apply to those websites. We assume no responsibility for the security or privacy of any information collected by third parties. We encourage you to contact the operators of those websites directly for information about their privacy policies.
5. Processing personal data from other sources
We do not process Personal Data regarding survey respondents' contacts with advertising or other media content from other sources, either advertising networks or social media platforms.
Personal data about you from other sources may come, for example, from the clients of our surveys, most commonly pharmaceutical companies, with whom you are in contact. In this case, it is the responsibility of the data provider to ensure that you have already been informed in advance that your personal data may be shared for market research purposes.
6. Disclosure of personal data
We will disclose your personal data only for the purposes described below and to the third parties listed below, unless your explicit consent to the transfer of personal data to other categories of third parties has otherwise been given. impulze will take reasonable steps to ensure that your personal data is processed in accordance with applicable law.
Clients of the surveys ("clients")
The clients of our surveys are usually pharmaceutical companies. Unless explicitly agreed otherwise with you, we report survey results in anonymized, aggregated form on a statistical basis, and no inferences can be made about your identity or the identity of the institution to which you belong (hospital, practice).
For survey projects where the results are not reported anonymously to the client - such as interviews conducted in the presence of client representatives - your consent is always obtained in advance.
External service providers
When necessary, we engage other companies and individuals to perform certain tasks that contribute to our services under contract data processing agreements (ADV). For example, we may share personal data with vendors who manage our databases and applications for the purpose of providing data processing services or transmitting information you request.
We share such data with, or allow access to, external service providers only to the extent necessary for the particular purpose. This data may not be used by the external service providers for other purposes, in particular not for their own purposes or the purposes of third parties. The external service providers of impulze are contractually obligated to maintain the confidentiality of your personal data.
Public authorities
We only disclose your personal data to public authorities if this is required by law.
Company transfers
In connection with start-ups, reorganizations, mergers or divestitures, or other transfers of business assets (collectively, "Business Transfers"), we transfer data, including Personal Data, to the extent appropriate and necessary for the Business Transfer, provided that the receiving party agrees to process your Personal Data in a manner consistent with applicable data protection law. We will ensure the confidentiality of any Personal Data on an ongoing basis and will notify you before Personal Data is subject to any other privacy policy.
7. International transfer of personal data
impulze does not transfer your personal data outside of Switzerland, the European Union (EU) or the European Economic Area (EEA). All personal data is stored on servers located either in Switzerland or in the EU.
8. Processing of particularly sensitive personal data
In certain cases, we may process sensitive personal data about you (also referred to as "sensitive data").
For example, we may process sensitive data that you have made public. We may also process sensitive data if this is necessary to establish, exercise or defend legal claims.
In addition, we may process sensitive data if you have voluntarily given your prior, explicit and separate consent to do so in a specific context for a specific purpose, for example, as part of your participation in a survey.
impulze does not process personal data of children and young people under the age of 18 without prior parental consent in accordance with applicable law. If we become aware that personal data of a child has been collected without the consent of the parent or guardian, we will delete this data immediately.
9. Technical and organizational measures
impulze takes the issue of data security very seriously. We take all appropriate and reasonable physical, electronic, organizational and administrative security measures to protect the data, including personal data, that we process against accidental or unlawful destruction, loss, alteration and unauthorized disclosure, and to prevent unauthorized access to personal data transmitted, stored or otherwise processed.
Our information security policies and procedures are based on generally accepted international standards and are regularly reviewed and updated as necessary to meet our business needs, technological changes and regulatory requirements.
Access to your personal data is granted only to those impulze employees and service providers who need such access to fulfill a business purpose or to perform their duties.
In the event of a data breach that also affects personal data, impulze will comply with all applicable laws regarding the duty to notify in the event of a personal data breach.
Specific measures:
10. Your rights
As a data subject, you have certain rights with respect to the personal data we process about you. This applies to all processing activities that are governed by this privacy policy.
impulze respects your individual rights and will respond appropriately to your concerns. Below is information about the rights you may have under applicable data protection law:
Exercise of rights
To exercise your rights, please contact us via the contact point listed in section 2. We will endeavor to comply with your request within 30 days. However, the processing time may be extended for certain reasons related to the particular right or complexity of your request. In such cases, we will notify you accordingly.
In certain situations, we may not be able to grant you access to your Personal Data or may be able to do so only on a limited basis due to legal requirements. If we deny your access request, we will notify you of the reason for the denial.
In some cases, we may not be able to determine your personal information based on the information in your request. In cases where we are unable to identify you as a data subject, we will not be able to comply with the exercise of your rights described in this clause unless you provide us with further information that enables us to identify you (e.g. a copy of your passport or identity card).
11. Storage of your personal data
As a general rule, we delete the personal data we have processed from you as soon as it is no longer needed to fulfill the purpose for which it was originally collected (usually 5 years). However, we may be required by law to retain your personal data for a longer period of time.
In addition, we will not readily delete all of your Personal Data if you request us to refrain from contacting you again in the future. To comply with your request, impulze maintains records that include information about individuals who do not wish to be contacted again in the future (e.g., in the form of email newsletters or recruitment campaigns for market research projects). We will consider your request to do so as consent to retain your personal information for the purpose of maintaining such records unless you instruct us otherwise.
12. Changes to this Privacy Policy
We reserve the right to make updates and changes to this Privacy Policy at any time. The Privacy Policy will be effective as of the "last modified" date set forth below and may be viewed in its most current form online at any time at http://www.impulze.ch/data-protection.html.
We will treat your personal information in accordance with the Privacy Policy under which it was collected, unless we have your consent to an updated Privacy Policy or to treat your personal information differently.
1. General note
Based on Article 13 of the Swiss Federal Constitution and the federal data protection regulations (Data Protection Act, Ordinance to the Federal Data Protection Act), as well as the European Data Protection Regulation (EU-DSGVO), every person is entitled to protection of their privacy as well as protection against misuse of their personal data.
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
2. Person in charge of data protection at impulze: contact details
The responsible person in the sense of the data protection legislation is:
impulze GmbH
Rämistrasse 50
8001 Zürich
Commercial register number: CHE-115.954.251
Please direct your questions about data protection to:
E-Mail: dataprotection@impulze.ch
Tel.: +41 43 817 86 17
3. General information and definitions
This Privacy Policy applies to the use of our website www.impulze.ch in general, the use of our eSurvey tool provided by Qualtrics (www.qualtrics.com), our participant database www.impulzedb.ch, contacting our company, and telephone and in-person interview surveys to which we invite you.
As part of our activities, we process data from you in order to be able to provide a functional website and to provide companies and authorities with decision-making aids on a statistical basis. Market, social and opinion research aims to observe, measure and describe behavior, attitudes, opinions, etc.. It is not about your data as a person, but about mean values of a group of persons. Your data can be collected in different ways (online, by telephone, in writing or in person with an interviewer or by means of a measuring device).
We only collect personal data that is actually required for the performance of our tasks and services or that you provide to us voluntarily.
For the purposes of this privacy policy, the following definitions apply:
- Personal Data: any information by which you as a person can be directly or indirectly identified; by "indirectly" is meant the combination with other information. Examples of personal data are your name, postal address, e-mail address and telephone number or a unique device identifier.
- Processing: any handling of Personal Data, regardless of the means and procedures used, including but not limited to obtaining, storing, retaining, using, modifying, disclosing, archiving, deleting or destroying data.
- Personal data requiring special protection: Data on religious, ideological, political or trade union views or activities, data on health, privacy or racial or ethnic origin, genetic data, biometric data uniquely identifying a natural person, data on administrative and criminal prosecutions or sanctions, data on social assistance measures.
4. Purpose and legal basis of data processing
We process your personal data for the purposes described below and/or in accordance with your consent. We process personal data only to the extent that it is necessary for the fulfillment of the respective purposes.
We process personal data exclusively as described in this Privacy Policy, unless you have given your expressed consent to process your personal data in a different way.
If we intend to use your personal data that we process with your consent for purposes other than those described in the consent form, we will ask for your consent in advance and will process your personal data only with your permission in cases where the processing depends on your consent.
Your data will not be used for the purpose of automated decision making or profiling.
The processing of personal data is justified by the overriding legitimate interest of the controller, in particular if the processing is directly related to the initiation, conclusion or performance of a contract.
Providing access to the website
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected:
- Information about the browser type and version used.
- The operating system of the user
- The user's Internet service provider
- The IP address of the user
- Date and time of access
- Internet pages from which the user's system accesses our website
Implementation of web analysis
We analyze the use of our website with the web analytics SmartAnalytics® of our hosting provider Webland.ch. This is used exclusively to optimize the website in terms of user-friendliness and to provide useful information about our services. This data is not merged with other personal data sources or passed on to third parties. There is also no personal analysis. The analyses are based on anonymized data records.
Contact, registration data, and direct communication
In order to process your contact and provide our services, we collect personal data such as name, postal address, telephone number, banking details for honoraria payments, and e-mail address ("registration data", in the case of repeated participation also referred to as your "master data").
We process your Personal Data to respond to your inquiry, communicate with you about our services, and inform you about our policies and terms.
In addition, we process your Personal Data as set forth in the consent form of the surveys in which you participate.
Survey Data
We process various data within the scope of surveys, which serve as decision-making aids on a statistical basis. The aim is to analyze behavior, opinions and attitudes. In doing so, we do not interpret your personal data, but the data of a group of persons in an anonymous way.
Legal obligations and legal defense
We may be required to process personal data for legal reasons, for example in connection with pharmacovigilance policies or to prevent loss, fraud or other misuse of our services and IT systems.
We may also process your personal data to comply with our internal and external audit requirements or data security purposes, or to protect our rights, data security, safety, property or the rights of others.
Cookies
Our websites, including the eSurvey Tool, use cookies and other technologies to improve user experience, website performance, usability, and for survey completion.
Cookies are small text files that make it possible to store specific information related to the user on the user's terminal device while the user is using the website. Cookies make it possible, in particular, to determine the frequency of use and number of users of the pages, to analyze behavior patterns of page use, but also to make our offer more customer-friendly. Cookies remain stored beyond the end of a browser session and can be retrieved when you visit the site again. If you do not wish this to happen, you should set your Internet browser so that it refuses to accept cookies.
Please note that not all functions of our online offer, in particular the automatic caching in the eSurvey tool, can be used if cookies are refused.
Log files
In the eSurvey Tool, we collect data, including personal data, that your device transmits whenever it connects to the Internet. This data includes, but is not limited to, the IP address (Internet Protocol address), the type and version of operating system and browser, the date and time of requests to our servers, and device manufacturer and model information, if applicable.
Third party websites
Our websites may contain links to websites that are not affiliated with impulze and are not operated, controlled or administered by us.
The policies and practices set forth herein do not apply to those websites. We assume no responsibility for the security or privacy of any information collected by third parties. We encourage you to contact the operators of those websites directly for information about their privacy policies.
5. Processing personal data from other sources
We do not process Personal Data regarding survey respondents' contacts with advertising or other media content from other sources, either advertising networks or social media platforms.
Personal data about you from other sources may come, for example, from the clients of our surveys, most commonly pharmaceutical companies, with whom you are in contact. In this case, it is the responsibility of the data provider to ensure that you have already been informed in advance that your personal data may be shared for market research purposes.
6. Disclosure of personal data
We will disclose your personal data only for the purposes described below and to the third parties listed below, unless your explicit consent to the transfer of personal data to other categories of third parties has otherwise been given. impulze will take reasonable steps to ensure that your personal data is processed in accordance with applicable law.
Clients of the surveys ("clients")
The clients of our surveys are usually pharmaceutical companies. Unless explicitly agreed otherwise with you, we report survey results in anonymized, aggregated form on a statistical basis, and no inferences can be made about your identity or the identity of the institution to which you belong (hospital, practice).
For survey projects where the results are not reported anonymously to the client - such as interviews conducted in the presence of client representatives - your consent is always obtained in advance.
External service providers
When necessary, we engage other companies and individuals to perform certain tasks that contribute to our services under contract data processing agreements (ADV). For example, we may share personal data with vendors who manage our databases and applications for the purpose of providing data processing services or transmitting information you request.
We share such data with, or allow access to, external service providers only to the extent necessary for the particular purpose. This data may not be used by the external service providers for other purposes, in particular not for their own purposes or the purposes of third parties. The external service providers of impulze are contractually obligated to maintain the confidentiality of your personal data.
Public authorities
We only disclose your personal data to public authorities if this is required by law.
Company transfers
In connection with start-ups, reorganizations, mergers or divestitures, or other transfers of business assets (collectively, "Business Transfers"), we transfer data, including Personal Data, to the extent appropriate and necessary for the Business Transfer, provided that the receiving party agrees to process your Personal Data in a manner consistent with applicable data protection law. We will ensure the confidentiality of any Personal Data on an ongoing basis and will notify you before Personal Data is subject to any other privacy policy.
7. International transfer of personal data
impulze does not transfer your personal data outside of Switzerland, the European Union (EU) or the European Economic Area (EEA). All personal data is stored on servers located either in Switzerland or in the EU.
8. Processing of particularly sensitive personal data
In certain cases, we may process sensitive personal data about you (also referred to as "sensitive data").
For example, we may process sensitive data that you have made public. We may also process sensitive data if this is necessary to establish, exercise or defend legal claims.
In addition, we may process sensitive data if you have voluntarily given your prior, explicit and separate consent to do so in a specific context for a specific purpose, for example, as part of your participation in a survey.
impulze does not process personal data of children and young people under the age of 18 without prior parental consent in accordance with applicable law. If we become aware that personal data of a child has been collected without the consent of the parent or guardian, we will delete this data immediately.
9. Technical and organizational measures
impulze takes the issue of data security very seriously. We take all appropriate and reasonable physical, electronic, organizational and administrative security measures to protect the data, including personal data, that we process against accidental or unlawful destruction, loss, alteration and unauthorized disclosure, and to prevent unauthorized access to personal data transmitted, stored or otherwise processed.
Our information security policies and procedures are based on generally accepted international standards and are regularly reviewed and updated as necessary to meet our business needs, technological changes and regulatory requirements.
Access to your personal data is granted only to those impulze employees and service providers who need such access to fulfill a business purpose or to perform their duties.
In the event of a data breach that also affects personal data, impulze will comply with all applicable laws regarding the duty to notify in the event of a personal data breach.
Specific measures:
- Our databases are stored in secure environments;
- Personal data and survey data are stored separately;
- Only designated employees of impulze have access to personal data;
- Customers do not have access to personal data.
10. Your rights
As a data subject, you have certain rights with respect to the personal data we process about you. This applies to all processing activities that are governed by this privacy policy.
impulze respects your individual rights and will respond appropriately to your concerns. Below is information about the rights you may have under applicable data protection law:
- Right to withdraw consent: If the processing of personal data is based on your consent, you have the right to withdraw that consent at any time by following the procedure described in the relevant consent form. We ensure that consent can be revoked by the same means by which it was given, e.g. electronically.
- Right to rectification: You may ask us to rectify any inaccurate personal data relating to you. We make reasonable efforts to keep Personal Information in our possession or under our control that is used on an ongoing basis accurate, complete, current and relevant based on the most current information available to us. In some cases, we provide Internet portals that allow users to review and correct their own Personal Data.
- Right to restrict processing: You may request us to restrict the processing of your personal data if
- you dispute the accuracy of your personal data while we are verifying its accuracy,
- the processing is unlawful and you request the restriction of the processing instead of the deletion of your personal data,
- we no longer need your personal data, but you need it to assert, exercise or defend a legal claim, or
- you object to the processing while we consider whether our legitimate grounds override yours.
- Right of access: you may request information from us about your personal data that we process, including information about the categories of personal data we hold or control, the purpose of use, from what source, if not from you directly, we collected the personal data, and to whom, if any, it has been disclosed. You have the right to request from us a copy, free of charge, of the Personal Information we maintain about you. We reserve the right to charge a reasonable fee for each additional copy you request.
- Right to portability: upon your request, we will transfer your personal data to another data controller if technically feasible and provided that the processing is based on your consent or is necessary for the performance of a contract. Instead of receiving a copy of your personal data, you may request that we transfer the data directly to another data controller you choose.
- Right to erasure: You may request that we erase your personal data if
- the personal data is no longer necessary for the purpose for which it was collected or otherwise processed;
- you are entitled to object to further processing of your personal data (see below) and exercise this right to object to the processing;
- the processing is based on your consent, you have revoked your consent and there is no other legal basis for the processing;
- the personal data has been processed in an unlawful manner;
- the processing is not (or is no longer) necessary to (i) comply with a legal obligation requiring us to process the data; (ii) comply with legal data retention obligations; (iii) assert, exercise or defend legal claims.
- Right to object: You have the right to object at any time to the processing of your personal data on the basis of a specific situation, provided that the processing is not based on your consent but on our legitimate interests or the legitimate interests of third parties. In such a case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds and an overriding interest in the processing or in relation to the assertion, exercise or defense of legal claims. If you object to the processing, please indicate whether you wish us to delete your personal data or to restrict the processing.
- Right of appeal: in the event of an alleged breach of applicable data protection law, you may lodge a complaint with the competent supervisory authority in your country of residence.
Exercise of rights
To exercise your rights, please contact us via the contact point listed in section 2. We will endeavor to comply with your request within 30 days. However, the processing time may be extended for certain reasons related to the particular right or complexity of your request. In such cases, we will notify you accordingly.
In certain situations, we may not be able to grant you access to your Personal Data or may be able to do so only on a limited basis due to legal requirements. If we deny your access request, we will notify you of the reason for the denial.
In some cases, we may not be able to determine your personal information based on the information in your request. In cases where we are unable to identify you as a data subject, we will not be able to comply with the exercise of your rights described in this clause unless you provide us with further information that enables us to identify you (e.g. a copy of your passport or identity card).
11. Storage of your personal data
As a general rule, we delete the personal data we have processed from you as soon as it is no longer needed to fulfill the purpose for which it was originally collected (usually 5 years). However, we may be required by law to retain your personal data for a longer period of time.
In addition, we will not readily delete all of your Personal Data if you request us to refrain from contacting you again in the future. To comply with your request, impulze maintains records that include information about individuals who do not wish to be contacted again in the future (e.g., in the form of email newsletters or recruitment campaigns for market research projects). We will consider your request to do so as consent to retain your personal information for the purpose of maintaining such records unless you instruct us otherwise.
12. Changes to this Privacy Policy
We reserve the right to make updates and changes to this Privacy Policy at any time. The Privacy Policy will be effective as of the "last modified" date set forth below and may be viewed in its most current form online at any time at http://www.impulze.ch/data-protection.html.
We will treat your personal information in accordance with the Privacy Policy under which it was collected, unless we have your consent to an updated Privacy Policy or to treat your personal information differently.
