Our Policy

Sarfraah GmbH is committed to fully comply with applicable laws and regulations to conduct our business activities. This policy has been established to describe our approach to compliance. Our reputation for high standards of business conduct and integrity is one of our greatest assets, as it enables us to continue to provide effective services. Download the compliance policy document below.

We are committed to conducting business in accordance with the highest ethical standards and prohibits all forms of bribery and corruption. Refer the document below which describes the Company’s Policy prohibiting bribery and other improper payments in the conduct of the Company business operations and employee responsibilities for ensuring implementation of the Policy.

Our commitment to ethical behaviour and the solid ethical foundations are one of the most essential components of Sarfraah operation. We are committed to doing business the right way, based on a culture of ethics and compliance. Refer to the attached Code of Ethics documentation

1. Data Controller

Sarfraah GmbH
Nidfeldstrasse 2D
6010 Kriens
Switzerland

Sarfraah GmbH ("Sarfraah", "we", "us" or "our") is responsible for the processing of personal data described in this Privacy Policy.

Sarfraah GmbH operates in the automotive sector, including the importation and redistribution of vehicles to dealers and the sale of vehicles directly to private customers and other companies.

If you have any questions regarding the processing of your personal data or wish to exercise your data-protection rights, please contact us at:

Sarfraah GmbH
Nidfeldstrasse 2D
6010 Kriens
Switzerland

Email: info@sarfraah.com

This Privacy Policy explains how Sarfraah GmbH collects, uses, stores and otherwise processes personal data in connection with our business activities.

This includes information relating to:

• customers and prospective customers;
• representatives and contact persons of companies and dealers;
• suppliers and service providers;
• visitors to our website;
• persons who contact us;
• participants in events organized or hosted by us; and
• other persons who interact with Sarfraah GmbH in connection with our business activities.

We process personal data in accordance with applicable Swiss data-protection legislation, in particular the Swiss Federal Act on Data Protection (FADP/DSG), as amended from time to time.

Depending on the nature of our relationship with you, we may collect and process the following categories of personal data:

• first and last name;
• postal address;
• email address;
• telephone number;
• company name;
• job title or professional function; and
• other contact details that you provide to us.

Depending on the relationship, we may process information relating to:

• vehicle enquiries and purchases;
• vehicle orders and transactions;
• quotations and offers;
• delivery and registration arrangements;
• invoices and payment information;
• communications with us;
• warranty or service-related matters;
• dealer relationships;
• supplier and business relationships; and
• other information necessary for carrying out our business activities.

If you register for an event organized by Sarfraah GmbH, we may collect information such as:

• name;
• email address;
• postal address;
• food or dietary preferences; and
• information necessary for organizing and administering the event.

We aim to collect only personal data that is appropriate and necessary for the relevant purpose.

We may obtain personal data:

• directly from you;
• when you contact us by email, telephone, website or other means;
• when you request information or a quotation;
• when you purchase or enquire about a vehicle;
• when you enter into a contractual relationship with us;
• when you register for an event;
• from your employer or the company you represent;
• from dealers, suppliers or other business partners; or
• from publicly available sources or other lawful sources where appropriate.

Where personal data is obtained from sources other than the individual concerned, we will comply with applicable information requirements under Swiss data-protection law.

We may process personal data for the following purposes:

We process personal data to:

• respond to enquiries;
• prepare quotations and offers;
• process vehicle orders and sales;
• arrange vehicle delivery;
• communicate with customers;
• administer customer relationships;
• manage warranties and after-sales matters;
• provide customer support; and
• perform other activities necessary for the sale and administration of vehicles.

We may process personal data relating to representatives and contact persons of dealers, suppliers and other companies for purposes including:

• establishing and managing business relationships;
• communicating with business partners;
• negotiating and performing contracts;
• processing orders and transactions;
• coordinating vehicle distribution;
• managing deliveries and logistics;
• invoicing and accounting; and
• maintaining our business relationships.

Where you register for an event organized by Sarfraah GmbH, we process the information you provide to:

• register and manage your participation;
• communicate with you about the event;
• manage attendance;
• arrange catering based on stated food or dietary preferences; and
• administer the event.

We may process personal data to:

• respond to enquiries submitted through our website;
• communicate with you about our products and services;
• maintain and improve our website and digital services;
• protect our systems and information; and
• manage and administer our business.

We may also process personal data where necessary to:

• comply with legal and regulatory obligations;
• maintain accounting and business records;
• establish, exercise or defend legal claims;
• prevent fraud, misuse or other unlawful activities;
• protect our rights, property and systems; and
• comply with requests from competent authorities.

Sarfraah GmbH processes personal data in accordance with the Swiss FADP/DSG and other applicable laws.

Depending on the circumstances, we process personal data because:

• it is necessary to enter into or perform a contract with you;
• it is necessary for the legitimate interests of Sarfraah GmbH or another party;
• you have provided the information voluntarily;
• processing is necessary to comply with a legal obligation; or
• another legal basis or justification permitted under applicable law applies.

Where consent is required by applicable law, we will request consent separately.

Providing certain personal data may be necessary for us to provide a requested service, enter into or perform a contract, or fulfil a legal obligation. Where this is the case, we will indicate which information is necessary.

We may disclose personal data where necessary for the purposes described in this Privacy Policy.

Recipients may include:

• our employees and authorized representatives;
• vehicle dealers and distribution partners;
• vehicle manufacturers and other automotive business partners, where necessary;
• logistics and transport providers;
• event organizers and catering providers;
• IT, hosting, cloud and software service providers;
• accounting, auditing and fiduciary service providers;
• legal, tax and professional advisers;
• insurance companies, where appropriate;
• payment service providers and financial institutions;
• authorities and public bodies where required or permitted by law; and
• other service providers or business partners where necessary for the relevant purpose.

Where third parties process personal data on our behalf, Sarfraah GmbH remains responsible for ensuring that the processing is carried out in accordance with applicable data-protection requirements. The FDPIC confirms that using a processor does not remove the controller's responsibility for data protection.

We do not sell personal data to third parties.

Sarfraah GmbH may use Microsoft 365 services, including Microsoft Forms, for business administration, communication, event registration and other business purposes.

For example, information submitted through a Sarfraah GmbH event registration form may be processed using Microsoft Forms and stored within our Microsoft 365 environment.

Microsoft acts as a service provider for the relevant Microsoft 365 services. The processing of personal data through these services is subject to the applicable contractual arrangements and Microsoft's privacy and security framework.

Microsoft states that Forms data for European-based tenants is stored on servers in Europe. Microsoft also documents Switzerland as a Microsoft 365 Local Region Geography for certain services and provides service-specific information regarding data residency. The precise location applicable to a particular service depends on the Microsoft 365 tenant and service configuration.

Where personal data is transferred to or accessed from a country outside Switzerland, Sarfraah GmbH will comply with the applicable requirements of Swiss data-protection law concerning international data transfers.

Sarfraah GmbH is based in Switzerland. Depending on the service providers and business partners we use, personal data may be processed or accessed in Switzerland or in other countries.

Where personal data is disclosed abroad, we comply with the requirements of Swiss data-protection law.

In particular, personal data may be transferred abroad where:

• the destination country provides an adequate level of data protection;
• appropriate safeguards are in place, such as recognized standard data-protection clauses or other legally recognized safeguards; or
• another exception permitted by Swiss law applies.

Swiss law requires information to be provided where personal data is disclosed abroad, including information concerning the destination country and the level of data protection where applicable.

The countries to which personal data may be transferred depend on the service providers and systems used by Sarfraah GmbH.

We retain personal data only for as long as necessary for the purposes for which it was collected.

The applicable retention period depends on the nature of the information and the purpose of processing.

For example, customer and transaction information may need to be retained for longer periods where required by accounting, tax, commercial, contractual or other legal obligations.

Information relating to event registrations will generally be retained for the period necessary to organize and administer the event and for a reasonable period afterwards for administrative, accounting, legal or other legitimate business purposes.

When personal data is no longer required, we will delete it or anonymize it where appropriate, unless we are legally required or otherwise entitled to retain it for a longer period.

Sarfraah GmbH takes appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, disclosure or other unlawful processing.

The measures applied depend on the nature and risks of the processing and may include access controls, authentication, confidentiality obligations, secure IT systems, backups and other appropriate technical and organizational safeguards.

Nevertheless, no electronic transmission or storage system can guarantee absolute security.

Where permitted by applicable law, we may use contact information to communicate with customers, prospective customers and business contacts about our products, services, events and business activities.

Where applicable, you may object to receiving marketing communications at any time by contacting us or by using the unsubscribe mechanism provided in the relevant communication.

An objection to marketing communications does not necessarily affect other communications that are necessary for an existing contractual or business relationship.

When you visit our website, technical information may be processed automatically, depending on the configuration of our website and hosting services.

This may include information such as:

• IP address;
• date and time of access;
• browser and device information;
• operating system;
• pages visited; and
• technical information required to operate and secure the website.

Our website may use cookies or similar technologies.

Where required, we will obtain consent before using non-essential cookies or similar technologies.

Where our website uses analytics, advertising, social-media plug-ins or other third-party technologies that process personal data, additional information may be provided through our cookie notice or other website-specific privacy information.

Subject to the applicable legal requirements and limitations, you may have the right to:

• request information about whether we process personal data concerning you;
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data where the applicable requirements are met;
• request restriction of certain processing activities where the applicable requirements are met;
• object to certain processing activities where the applicable requirements are met; and
• exercise other rights available under applicable Swiss data-protection law.

The Swiss FADP provides individuals with a right to request information about the processing of their personal data. The information may include the identity and contact details of the controller, the type and purpose of processing, recipients or categories of recipients, and the retention period or criteria used to determine it.

To exercise your rights, please contact:

Sarfraah GmbH
Nidfeldstrasse 2D
6010 Kriens
Switzerland
Email: [INSERT PRIVACY OR GENERAL CONTACT EMAIL]

We may need to verify your identity before responding to a request.

Requests will be handled in accordance with the applicable legal requirements.

If you have concerns about how Sarfraah GmbH processes your personal data, we encourage you to contact us first so that we can review and address your concern.

We may update this Privacy Policy from time to time to reflect changes in our business activities, services, technology or applicable legal requirements.

The current version will be published on this page and will indicate the date on which it was last updated.

Sarfraah GmbH
Nidfeldstrasse 2D
6010 Kriens
Switzerland

Privacy contact: info@sarfraah.com