PRIVACY POLICY - OUR COMMITMENT TO DATA PROTECTION
The registered office of Kessel Group SA is located in Switzerland and is therefore primarily subject to the New Federal Data Protection Act (nFADP) when processing personal data, particularly that of individuals residing in Switzerland. Furthermore, the EU General Data Protection Regulation (GDPR) as a legal basis for the processing of personal data of EU citizens.
In this privacy statement, we, Kessel Group SA, explain how, through our affiliated companies (Kessel Auto Lugano SA, Kessel Auto Zug AG, Kessel Service SA) and our partners, we collect and process personal data.
In this regard, Kessel Group SA is required to process your personal data collected automatically, or provided by you, through navigation and/or use of the website: www.kessel.ch (hereinafter “Website”).
1. Data Controller
The Data Controller is Kessel Group SA, with registered office at Via Grancia 4, 6916 Grancia (hereinafter “Data Controller”).
2. Definition and type of personal data processed
To allow you to use the Website and its services, or in case of submitting a job application, the Data Controller needs to know and process some of your personal data.
By personal data we mean any information that identifies or makes identifiable, directly or indirectly, any individual, such as name, contact details, IP addresses.
The personal data that is processed in order to respond to requests for information via the contact form are as follows:
- name, surname, telephone number, email address
The personal data processed for the purpose of subscribing to the newsletter and to be constantly informed about the activities of Kessel and to receive discounts and promotions is that relating to your e-mail address.
Please note that the processing of data by our brand partners may take place under their own responsibility for data protection, over which we have no control. For further details regarding data protection, please refer to the privacy policy of the respective brand partner.
For the simple navigation of the Website, the types of data processed and the related specific information for “cookies” are specified below.
Navigation data
The computer systems and software procedures used to operate the Website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected in order to be associated with identified data subjects, but it should be noted that, by its very nature, it could, through processing and association with other data held by the Data Controller or by third parties, enable users to be identified.
This category of data includes:
- IP addresses or domain names of computers used by users connecting to the website
- the addresses in URI (Uniform Resource Identifier) notation of the requested resources
- the time of the request
- the method used in submitting the request to the server
- the size of the file obtained in response
- the numeric code indicating the status of the response given by the server (successful, error, etc.).
- other parameters relating to the user’s operating system and computer environment
This data may be used by the Data Controller for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check its correct operation. Furthermore, the data could also be used, in agreement with the judicial authorities, to ascertain liability in the event of hypothetical cybercrimes against the Data Controller. Apart from this, please note that data on contacts to the website are not stored on the servers for more than seven days.
Data provided voluntarily by the user
No provision of personal data by the user is required in order to consult the website.
The optional, explicit and voluntary sending of messages, by electronic or traditional mail, to the addresses indicated on the website entails the subsequent acquisition of the sender’s e-mail address, or even postal address, or the relevant telephone number, necessary to reply to requests, as well as any other personal data included in the relevant communications.
This data will be used for the sole purpose of processing your request and may only be disclosed to third parties if this is necessary for that purpose.
For the processing of data for these purposes, your consent is not required since the processing is necessary for the performance of a contract to which you are a party or the execution of pre-contractual measures taken at your request, as well as, where applicable, to fulfil a legal obligation.
This data is kept for the time strictly necessary to provide you with the requested service and is deleted immediately afterwards, subject to further retention obligations provided for by you’re your data will not be distributed.
Cookie Policy
The Cookie Policy section outlines the types of cookies used by this Website, in order to explain how personal data is processed through these types of technologies.
3. Our Services
We, or third parties appointed by us, process your personal data in our customer databases in order to offer and perform our services. The processing of your data takes place in the context of initiating and/or managing a contract, based on our legitimate interest and your consent.
In certain circumstances, your data may be shared with the following categories of recipients:
- affiliated companies of Kessel
- business partners
- banks
- insurance companies
- IT services providers
- vehicle data application providers
Test drive
To arrange a test drive, we process your name, address, and contact details. Additionally, we are required to verify the validity of your driver’s license. Your data will be retained for a maximum of 12 months in order to potentially enforce legal rights thereafter (e.g., in case of traffic violations such as speeding fines).
Leasing
If you decide to lease a car, we—and/or the service providers appointed by us—will process your personal data for purposes related to the execution and management of the leasing contract.
In compliance with legal obligations, we are also required to perform a creditworthiness check. For this purpose, we and our service partners will process the following categories of personal data:
- personal data (name, surname, date of birth, marital status, number of children)
- income (salary, alimony, pension, employer’s name)
- expenses (rent, professional expenses, religious taxes)
Furthermore, at the time of the leasing application and during the ongoing contractual relationship, we obtain the following information about you from our service providers for creditworthiness checks:
- current leasing obligations
- current credit obligations (including conversion to 36 months)
- creditworthiness data related to concluded or ongoing contracts
- payment history
- information on politically exposed persons (PEPs), criminal records, and sanctions
Kessel Storage
If you enter into a permanent or temporary rental agreement for a parking space in our storage facilities, we process your name, contact details, license plate number, and vehicle information. This data is necessary for the execution of the contract and for invoicing process.
In the event of termination of the permanent or temporary rental agreement, your data will be deleted once the retention period required by applicable law has expired.
Aftersales services
In our workshops, we offer various aftersales services.
If you use these services, we and/or the service providers appointed by us typically process the following categories of personal data:
- name and surname
- addresses
- contact details
- vehicle data
- billing data
- insurance data
This information is necessary to provide the requested service and to maintain effective communication with you.
VentaVid
As part of our service operations, the VentaVid system records videos of your vehicle to ensure even greater transparency when maintaing and repairing your vehicle. We process your contact details, such as email addresses, in order to send you the recordings. The video footage is processed and transmitted to Venta Internet Services BV, headquartered in the Netherlands, and made available to us for the duration of the service.
For more information on how Venta Internet Services BV processes your personal data and for what purposes, please refer to their privacy policy available at the following link:
https://www.ventavid.com/privacy-policy
Comunication using WhatsApp
We do not use WhatsApp as a direct communication channel. However, if you choose to contact us through WhatsApp—for example, during the contract subscription process or regarding assistance for your car—we inform you that, by using this communication method, your personal data (such as your name and contact information) will be transmitted to WhatsApp Inc., headquartered in the United States. By using WhatsApp, you give your consent to this data transmission. Please note that the United States currently does not provide an adequate level of data protection. For more information on how WhatsApp processes your personal data and for what purposes, please refer to their privacy policy available at the following link:
https://www.whatsapp.com/privacy
Courtesy car
If you are provided with a courtesy car, we process your name, address, and contact details.
In this context, we do not receive any data that allows location tracking or information related to your driving behavior.
4. Purpose of the treatment of Data and Legal basis
The personal data of which the Data Controller is in possession are exclusively those provided during navigation and/or during the forwarding of any requests for information. Therefore, personal data will be processed to:
- allow the Website to be used. Data processing is based on the legitimate interest of the Data Controller.
- satisfy the requests that were received through the contact form, also allowing us to contact you at the e-mail address that was communicated to us. In this case, the processing is related to fulfil a request by the user.
- The transmission of one or more newsletters at the request of the user. The processing is based on the consent of the Data Subject.
In consideration of the choice to use the services provided by the Website, the legal basis on which the processing of personal data is based may be:
- express consent, accepting the Cookie Policy and continuing to browse the Website;
- express consent, by subscribing to the Newsletter and accepting this Privacy Policy;
- the need to fulfil a legal obligation, if this is deemed necessary, and to communicate your personal data if we are asked to do so by the competent authorities;
- the legitimate interest in processing personal data to offer the best service; to allow us to respond where a request is submitted; to prevent fraud; to keep the Website, our services and the IT system secure; to ensure that our processes, procedures and systems are always kept efficient.
You can unsubscribe from the newsletter at any time by simply clicking on the appropriate unsubscribe link in each communication you receive.
5. Period of conservation of personal data
Personal data may be processed by both electronic and paper-based means.
The Data Controller intends to keep personal data for a period of time no longer than it is necessary to achieve the purposes for which it was collected and processed. It should be noted that the Data Controller has taken all the necessary security measures to prevent the loss of data, unlawful or incorrect use and unauthorised access.
The contact data on the Website will not be kept for more than seven days, unless these are necessary to verify responsibility in case of hypothetical computer crimes against the Data Controller.
As far as any additional personal data are concerned, since the Data Controller cannot accurately determine the period of conservation, from now on the Data Controller undertakes to inspire the processing of personal data in accordance with the principles of adequacy, relevance and minimization of data, as required by the European Regulation and Federal Legislation, and constantly checking the need for their conservation. Therefore, once the purposes for which they were collected and processed are fulfilled, they will be removed from the systems or made completely anonymous.
6. Categories of addressed persons of Data
Processed data will not be disclosed to third parties. They can, however, acquire the data, in relation to the aforementioned purposes of treatment:
- individuals that can access data in accordance with the provisions of the law that are provided for by European Union law, or by that of the Member State to which the Data Controller is subjected;
- our employees, provided that they are assigned System Administrators or individuals acting under the authority of the Data Controller or the Data Manager, in accordance with European Regulations;
- individuals that perform, within the borders of the European Union, in complete autonomy, as separate Data Controllers, or as Data Processors appointed for this purpose by the Data Controller, purposes auxiliary to the activities and services referred to in paragraph 4 ., including companies that offer advertising, marketing and communication services, IT and information technology services, the design and creation of websites, companies that offer services which are useful for analysing and developing data and developing and conducting market research.
Any communication of personal data will take place in full compliance with the provisions of the law, which are provided for by the European Regulation and Federal Legislation and the technical and organisational measures prepared by the Data Controller, in order to ensure an adequate level of security.
7. Transfer of Personal Data to third Countries
The data will mainly be processed within Switzerland, but may also be transferred to other countries within the EU.
Any transfer will always be subject to adequate safeguards, as the country of destination has obtained an adequacy decision of the Commission pursuant to Article 45 of the European Regulation, or the standard contractual clauses provided for in Article 46(2)(c) of the European Regulation have been adopted.
Any transfer of the Data Subject’s data to countries outside the European Union will only take place in accordance with adequate safeguards for the purposes of such transfer, i.e. that the Swiss Confederation has confirmed that the non-EU country has an adequate level of data protection or that there are other data protection guarantees in place, such as binding corporate regulations or the signing of EU standard contractual clauses.
8. Possible automated decision-making processes
The Data Controller does not use automated decision-making processes, including the aforementioned profiling referred to in Article 22, paragraphs 1 and 4, of the European Regulation. Therefore, the Data Controller deems it does not have to provide information on the type of logic used, or even the importance and the consequences for the person concerned regarding this type of treatment.
9. Rights of the interested party
The persons to whom the personal data refers have the right, at any time, to obtain confirmation of the existence or non-existence of such data and to be informed of its content, to verify its accuracy or to request that it be supplemented, updated or corrected.
It should also be noted that the Data Subject has the right to:
- revoke consent to processing at any time. It should be noted, however, that the withdrawal of consent does not affect the lawfulness of the treatment based on consent before revocation
- ask the Data Controller to access personal data
- obtain from the data controller the correction and supplementation of personal data deemed inaccurate, including by providing a simple supplementary declaration
- obtain the cancellation of personal data from the Data Controller
- obtain the limitation of the processing of personal data from the Data Controller if one of the hypotheses provided for by the relevant legislation
- receive personal data concerning you in a structured format from the Data Controller, commonly used and readable by automatic devices, as well as the right to transmit such data to another data controller without impediments, as provided for by the relevant legislation
- object at any time, for reasons connected to your particular situation, to the processing of personal data carried out, including profiling
- not be subjected to decisions based solely on automated processing, including profiling, that produce legal consequences that affect you, if you previously did not give explicit consent to, as required by art. 22 of the European Regulation. By way of example and by no means exhaustive, this category includes any form of automated processing of personal data aimed at analysing or predicting aspects concerning consumption and purchase choices, one’s economic situation, interests, reliability and behaviour;
- file a complaint to a supervisory authority, if you consider the treatment of data that concern you to be in violation of the European Regulation. The complaint may be lodged in the Member State in which you reside or work, or in the place where the alleged violation occurred
To exercise each of your rights, you can contact the Data Controller, as a legal representative, addressing a communication at the registered office at Via Grancia, 4 6916 Grancia, or by sending an email to privacy@kessel.ch, by providing the following data:
- name, surname and postal address
- details of the request
- photocopy of a valid identity document
10. Consent of minors in relation to the information society services
To be able to use the services provided through the Website it is necessary to be at least sixteen years of age: consent to the processing of personal data of those who are under 16 years of age is permissible provided that it is exercised by those who exercise parental responsibility.
11. Download information
We may modify this privacy statement at any time without prior notice. The current version published on our website shall always apply. Therefore, to better protect its users, Kessel Group SA encourages you to download the privacy statement and ensure that it is the latest available version.
