We process personal data if you have or are establishing a business relationship with us or if you are visiting our website.

In this section A. we give you general information about our data processing which applies to all our processing of personal data. The details of data processing regarding our business partners are outlined under section B. and the details of data processing when you are visiting our website are outlined under section C.

‍1. Who processes your personal data?

The controller of personal data is:
THE FACTOR-Y LTD
71-75 Shelton Street, Covent Garden
London WC2H 9JQ
United Kingdom
E-mail: contact@thefactor-y.com

‍2. What personal data do we process, for what purpose and what is the legal basis for the processing?

The details on what personal data for what purpose and on what legal basis are processed by us we explain you in sections B. for our business partners and in section C. for the visitors of our website.

‍3. Do I have to provide my personal data?

If you want to establish a business relationship with us, you must provide us with at least the following data:

• name, surname;

• e-mail address;

• depending on business relationship: billing address or bank details; and

• depending on business relationship: data to comply with regulatory requirements.

​If you want to visit our website you do not have to provide us personal data, however some functions of the website might not work properly if you do not allow us to process your data (e.g. because of cookie-settings)

‍4. To whom do we disclose your personal data?

Personal data of our business partners might be disclosed to certain data processors, which on our behalf process your data for the business relationship (e.g. accounting service providers). Further details you can find under section B.

Details regarding data processors for the personal data of visitors our website you can find under section C.

‍5. Do we transfer your personal data to third countries outside of Switzerland and the European Union?

Generally, we process your personal data in Switzerland. Switzerland offers appropriate level of data protection under the GDPR.

However, some of our data processors are located outside of Switzerland and the European Union. Details regarding these processors your can find under sections B. and C. accordingly.

​6. How long do we store your personal data?

Unless a more specific storage period is specified under section B. or C., your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your personal data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

‍7. What are your rights as data subject in the European Union?

If your personal data is processed and the GDPR is applicable, you have the following rights towards us:

‍7.1 Right of access

You have the right to obtain a confirmation as to whether personal data concerning you is being processed. If this is the case, you can request access to the personal data and the following information:

• the purposes of the processing;

• the categories of personal data concerned;

• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

• the existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal data or to object to such processing;

• the right to lodge a complaint with a supervisory authority;

• where the personal data are not collected from you, any available information as to their source; and

• the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organization. In this context, you have the right to be informed of the appropriate guarantees in accordance with Article 46 GDPR in connection with the transmission.

​7.2 Right to rectification

You have the right to obtain the rectification of inaccurate personal data. We must effect the rectification without delay.

‍7.3 Right to restriction of processing

You have the right to obtain restriction of processing where one of the following applies:

• you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;

• the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;

• we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; or

• you have objected to processing pursuant to Article 21 (1) GDPR pending the verification whether our legitimate grounds override those of you.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state.

We will inform you if we lift any restriction on data processing you have obtained according to the above conditions.

​7.4 Right to erasure

You have the right to obtain the erasure of personal data without undue delay and we shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

• the data subject objects to the processing and there are no overriding legitimate grounds for the processing; or

• the personal data have been unlawfully processed.

The right to erasure does not apply to the extent processing is necessary for the establishment, exercise or defense of legal claims.

​7.5 Right to notification

If you have exercised your right of rectification, erasure or restriction, we shall communicate such rectification, erasure of data or restriction of processing to each recipient to whom personal data have been disclosed, unless this proves impossible or involves disproportionate efforts.

‍7.6 Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on the legal basis of legitimate interest.

We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

​7.7 Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.

1. What personal data do we process?

If you are establishing or having a business relationship with us, we process the personal data you have provided us in connection with our business relationship. This are especially the following data:

• name, surname;

• e-mail address;

• depending on business relationship: billing address or bank details; and

• depending on business relationship: data to comply with regulatory requirements.

If you are supplying an innovation as innovator for our investment scheme, in a first step we receive your personal data (together with the information about your innovation) via an online form on our website. Please see section C.5 for further information about data processing on our website.

​2 For what purpose do we process your personal data?

We process the personal data of our business partners to perform our business relationship. If we have not concluded on the exact terms of our business relationship, we process your data to evaluate potential business relationship. In this connection, we will send e-mails to you, make use of conference tools and use other common business tools.
For innovators we process the personal data in order to decide if we want the innovator to participate in our investment scheme. In this connection we will send you regular updates on our investment scheme via e-mail.

‍3. What is the legal basis for the processing of your personal data?

We may process the personal data as permitted by Article 6 (1) (b) GDPR for the performance of a contract or for the implementation of pre-contractual measures taken at the request of the data subject.

​4. To whom do we disclose the personal data and where are the third parties located?

In addition to the information in section A. 4 and A.5, we use Microsoft Sharepoint, Microsoft Teams and other services of Microsoft to perform our business. The provider of these services is:
Microsoft Corporation
One Microsoft Way
Redmond
WA 98052-6399 USA

(“Microsoft”)
For details on data processing, please refer to the Microsoft privacy policy: https://privacy.microsoft.com/en-us/privacystatement.
In order to assure processing in compliance with data protection regulations, we have concluded a processing agreement with Microsoft.

1. External Hosting

Our website www.thefactor-y.com is hosted by an external host provider. Personal data collected on our website are stored on the servers of the host. These may include, but are not limited to, IP addresses, contact requests, metadata and communications, contract information, contact information, names, web page access, and other data generated through a web site.

We use the services of the external host provider for the purpose of fulfilling the contract with our potential and existing business partners (Article 6 (1) (b) GDPR) and in the interest of secure, fast, and efficient provision of our online services (Article 6 (1) (f) GDPR).

Our host provider will only process your data to the extent necessary to fulfil its performance obligations and to follow our instructions with respect to such data.
We are using the following host:
Wix.com
In order to assure processing in compliance with data protection regulations, we have concluded a processing agreement with GoDaddy.

2. Online form for innovators

2.1 General

If you submit your innovation via our online form on our website, the information provided in the form will be stored and evaluated by us in order to evaluate your innovation. We will contact you after an initial review of your innovation and discuss with the next steps. We will not share the information presented to us via the online form without your consent.
The processing of these data is based on Article 6 (1) (b) GDPR as you contacted us to carry out pre-contractual measures.

‍2.2 External provider

The contact form is provided to us by an external service provider. In this case it is:
Asana, Inc.
1550 Bryant Street
Suite 200
San Francisco CA 94103, USA
In order to assure processing in compliance with data protection regulations, we have concluded a processing agreement with Asana.

‍2.3 SSL and/or TLS encryption

​For security reasons and to protect the transmission of confidential content, our contact form uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line. If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.

​3. Log Files

Our website and its pages automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:

• The type and version of browser used

• The used operating system

• Referrer URL

• The hostname of the accessing computer

• The time of the server inquiry

• The IP address

• This data is not merged with other data sources.

This data is recorded on the basis of Article 6 (1) (f) GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded.

​4. Cookies

Our websites and pages use what the industry refers to as “cookies”. Cookies are small text files which are either stored temporarily for the duration of a session (session cookies) or permanently archived on your device (permanent cookies). Session cookies are automatically deleted once you terminate your visit. Permanent cookies remain archived on your device until you actively delete them, or they are automatically eradicated by your web browser.

Cookies have a variety of functions. Many cookies are technically essential since certain website functions would not work in the absence of the cookies (e.g., the shopping cart function or the display of videos). The purpose of other cookies may be the analysis of user patterns or the display of promotional messages.

Cookies, which are required for the performance of electronic communication transactions (required cookies) or for the provision of certain functions you want to use (functional cookies) or those that are necessary for the optimization of the website (e.g., cookies that provide measurable insights into the web audience), shall be stored on the basis of Article 6 (1) (f) GDPR, unless a different legal basis is cited. The operator of the website has a legitimate interest in the storage of cookies to ensure the technically error free and optimized provision of the operator’s services. If your consent to the storage of the cookies has been requested, the respective cookies are stored exclusively on the basis of the consent obtained (Article 6 (1) (a) GDPR); this consent may be revoked at any time.

You have the option to set up your browser in such a manner that you will be notified any time cookies are placed and to permit the acceptance of cookies only in specific cases. You may also exclude the acceptance of cookies in certain cases or in general or activate the delete function for the automatic eradication of cookies when the browser closes.
If cookies are deactivated, the functions of this website may be limited.

In the event that third-party cookies are used or if cookies are used for analytical purposes, we will separately notify you in conjunction with this privacy policy and, if applicable, ask for your consent.

‍5. Google Analytics

​5.1 General

Our website uses functions of the web analysis service Google Analytics. The provider of this service is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4, Ireland
(“Google”).

Google Analytics enables us to analyze the behavior patterns of website visitors. To that end, the website operator receives a variety of user data, such as pages accessed, time spent on the page, the utilized operating system and the user’s origin. Google may consolidate these data in a profile that is allocated to the respective user or the user’s device.

Google Analytics uses technologies that make the recognition of the user for the purpose of analyzing the user behavior patterns (e.g., cookies or device fingerprinting). The website use information recorded by Google is, as a rule transferred to a Google server in the United States, where it is stored.

This analysis tool is used on the basis of Article 6 (1) (f) GDPR. The operator of this website has a legitimate interest in the analysis of user patterns to optimize both, the services offered online and the operator’s advertising activities. If a corresponding agreement has been requested (e.g., an agreement to the storage of cookies), the processing takes place exclusively on the basis of Article 6 (1) (a) GDPR; the agreement can be revoked at any time.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs.

We have executed a contract data processing agreement with Google regarding our use of Google Analytics.

‍5.2 IP anonymization

On our website, we have activated the IP anonymization function for Google Analytics. As a result, your IP address will be abbreviated by Google within the member states of the European Union or in other states that have ratified the Convention on the European Economic Area prior to its transmission to the United States. The full IP address will be transmitted to one of Google’s servers in the United States and abbreviated there only in exceptional cases. On behalf of the operator of this website, Google shall use this information to analyze your use of this website to generate reports on website activities and to render other services to the operator of this website that are related to the use of the website and the Internet. The IP address transmitted in conjunction with Google Analytics from your browser shall not be merged with other data in Google’s possession.

‍5.3 Browser plug-in

You can prevent the recording and processing of your data by Google by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

For more information about the handling of user data by Google Analytics, please consult Google’s Data Privacy Declaration at: https://support.google.com/analytics/answer/6004245?hl=en.

‍5.4 Demographic parameters provided by Google Analytics

Our website uses the “demographic characteristics” function of Google Analytics, to be able to display to the website visitor compatible ads within the Google advertising network. This allows reports to be created that contain information about the age, gender, and interests of the website visitors. The sources of this information are interest-related advertising by Google as well as visitor data obtained from third-party providers. This data cannot be allocated to a specific individual. You have the option to deactivate this function at any time by making pertinent settings changes for advertising in your Google account or you can generally prohibit the recording of your data by Google Analytics as explained in section “Objection to the recording of data”.

‍5.5 Archiving period

Data on the user or incident level stored by Google linked to cookies, user IDs or advertising IDs (e.g., DoubleClick cookies, Android advertising ID) will be anonymized or deleted after 14 month. For details, please click the following link: https://support.google.com/analytics/answer/7667196?hl=en

‍6. Google Web Fonts (local embedding)

Our website uses so-called Web Fonts provided by Google to ensure the uniform use of fonts on this site. These Google fonts are locally installed so that a connection to Google’s servers will not be established in conjunction with this application.

For more information on Google Web Fonts, please follow this link: https://developers.google.com/fonts/faq and consult Google’s Data Privacy Declaration under: https://policies.google.com/privacy?hl=en.