Privacybeleid

1. Introduction
The protection of your personal data is important to us, Rocket Games AG. In this privacy policy, we inform you about

• what data we collect and process,

• for what purposes this is done,

• on what legal basis we do this,

• how long the data is stored,

• to whom data may be passed on and

• what rights you are entitled to as a data subject under the GDPR and the revised Data Protection Act.

This statement applies to all online offerings of Rocket Games AG – including our website, webshop, mobile apps, and all other digital services that refer to this statement. It also applies to situations where we collect personal data directly from you (e.g., at events, via newsletters, or via contact forms).

---

2. Responsible body and contact

Rocket Games AG
Glattalstrasse 501
8153 Rümlang, Switzerland
E-mail: info@rocket-games.ch
Phone: 078 404 43 34

For data protection inquiries (e.g. information, correction, deletion, objection) you can reach us via the above email address.

We have not appointed a formal data protection officer, as there is no legal requirement to do so. Of course, we nevertheless comply with all requirements under Art. 37 GDPR and Art. 12 et seq. of the revised Data Protection Act.

---

3. Scope
This privacy policy applies:

• for users residing in the Switzerland (revised Data Protection Act – revDSG, valid since 1 September 2023) and

• for users in the EU, especially in Germany (GDPR).

To the extent we provide services to individuals in the EU, the stricter requirements of the GDPR apply. Where the GDPR and the revised Data Protection Act apply simultaneously, we comply with the stricter provisions of each.

---

4. Definitions
For better comprehensibility, we explain key terms in this privacy policy:

• Personal data: Information relating to an identified or identifiable natural person (e.g. name, IP address, email address).

• Processing: Any handling of personal data (e.g. collection, storage, transmission, deletion).

• Affected person: The person whose data is processed.

• Responsible: Rocket Games AG – decides on the purpose and means of processing.

• Processor: Third parties who process data on behalf of Rocket Games AG (e.g. web hosts, newsletter service providers).

• Consent: Voluntary, informed consent to the processing of personal data.

• Pseudonymization: Data can no longer be assigned to a specific person without additional information.

• Anonymization: Data can no longer be assigned to a person and is no longer subject to GDPR/revDSG.

5. Legal basis for data processing

5.1. According to the Swiss Data Protection Act (revDSG)
The processing of personal data is permitted if:

• it is necessary for the performance of the contract,

• there is a legal obligation (e.g. retention obligation),

• it is carried out in the overriding legitimate interest and there are no conflicting interests of the data subject, or

• there is express consent.

5.2. According to the EU General Data Protection Regulation (GDPR)
Legal basis for data processing for EU users:

• Art. 6 (1) (a) GDPR: Consent

• Art. 6 (1) (b) GDPR: Performance of the contract

• Art. 6 (1) (c) GDPR: Legal obligation

• Art. 6 (1) (f) GDPR: Legitimate interest

6. Data collected and purposes of processing

6.1 Visiting the website
Purpose: operational security, optimization, IT protection, usage analysis.
Data: IP address, browser, operating system, timestamp, referrer, cookies.
Legal basis: Legitimate interest (GDPR/DSG).
Recipient: Hosting and analysis service providers.

6.2 Contact (form or email)
Purpose: Communication, support, quotation.
Data: Name, email, phone number, message.
Legal basis: performance of contract or legitimate interest.
Recipients: Internal departments, hosting and email providers.

6.3. Newsletter
Purpose: Information, product news, invitations.
Data: email address, name (optional), topic interest.
Legal basis: consent.
Recipient: Mailchimp, CleverReach or similar

6.4. Registration / Customer Account
Purpose: Processing orders, customer management.
Data: Name, address, contact details, payment details.
Legal basis: performance of contract.
Recipients: payment and shipping service providers, platform providers.

6.5. Marketing & Remarketing
Purpose: Targeted advertising, reach measurement.
Data: Cookies, IDs, email for campaigns.
Legal basis: consent or legitimate interest.
Recipients: Google, Meta, LinkedIn, etc.

6.6. Web analysis
Purpose: Website optimization, analyzing user behavior.
Data: IP address (anonymized), clicks, session duration.
Legal basis: consent or legitimate interest.
Services: Google Analytics, Matomo etc.

6.7 Social media and plug-ins
Purpose: Social media integration, content sharing.
Data: IP address, user ID, interactions.
Legal basis: consent or legitimate interest.
Recipients: Meta, X (Twitter), LinkedIn, etc.

6.8. Applications
Purpose: application process, communication, selection.
Data: contact details, CV, certificates.
Legal basis: Pre-contractual measures.
Recipients: Internal HR department, IT partners.

6.9. Analysis of user interactions using heat map technology

We use heat map technology on our website to better understand user behaviour on our website and to continuously optimise our offering.

Purpose of processing

The analysis serves the statistical evaluation of user interactions, in particular to improve the user-friendliness, structure and conversion optimisation of our online offering.

Type of data processed

The following information may be processed:

Mouse movements and click behaviour
Scroll behaviour
Length of stay on individual pages
Pages visited and navigation paths
Device type, screen resolution, browser type
Truncated or anonymised IP address

No personal content from form fields (e.g. name, email address, payment details or login information) is collected. Input fields are automatically masked and not stored.

Legal basis

Processing takes place:

within the EU in accordance with Art. 6(1)(a) GDPR (consent),
in Switzerland on the basis of Art. 31 revDSG (overriding legitimate interest in optimising our offering) and on the basis of consent granted in accordance with the Telecommunications Act, insofar as cookies or similar technologies are used.

The analysis is only activated after express consent has been given via our consent management tool.

Storage period

The data collected is only stored for as long as is necessary for evaluation and is then deleted or anonymised.

Order processing

If an external service provider is used, processing is carried out within the framework of an order processing agreement in accordance with Art. 28 GDPR or Art. 9 revDSG.

Third country transfers

If data is transferred to countries outside the EU or Switzerland, this will only be done in compliance with the legal requirements (e.g. by concluding standard contractual clauses).

Revocation

You can revoke your consent at any time with future effect via the cookie settings on our website.

7. Cookies and Tracking

7.1. Definition: Small text files that are stored on end devices.

7.2. Cookie types:

• Necessary: Functionality guarantee (login, shopping cart)

• Statistics: User behavior (Analytics)

• Functional: Language, Settings

• Marketing: Remarketing, Conversion

7.3. Consent & Administration: Can be controlled via cookie banner and browser settings. Revocation possible at any time.

8. Data recipients Recipients of personal data may be:

• IT-Provider (Hosting, Webplattformen)

• Payment service providers (Stripe, PayPal)

• Shipping service providers (Swiss Post, DHL)

• Analytics & Marketing Services (Google, Meta)

• Processor with DPA

• Authorities when legally obliged

• Group companies within CH/EU

International transfer only with appropriate safeguards (SCC, adequacy decision).

9. Storage periods and deletion

Storage period according to purpose:

• Accounting: 10 years

• Contract dates: 7–10 years

• Newsletter: Until revoked

• Web analysis: Max. 2 years

• Applications: 6 months after graduation

Data will be deleted as soon as it is no longer needed or must be deleted by law.

10. Rights of data subjects

You have the right to:

• Information (Art. 15 GDPR / revDSG)

• Correction (Art. 16 GDPR / Art. 25 revDSG)

• Deletion (Art. 17 GDPR / Art. 26 revDSG)

• Restriction (Art. 18 GDPR / Art. 27 revDSG)

• Objection (Art. 21 GDPR / Art. 28 revDSG)

• Data portability (Art. 20 GDPR)

• Revocation (Art. 7 para. 3 GDPR)

• Complaint to data protection authorities

11. Data security

We use technical and organizational measures (TOMs):

• SSL/TLS encryption

• Access controls & authorization concepts

• Firewall, Anti-Malware, Monitoring

• Training our employees

12. Scope of application GDPR & revDSG

• GDPR applies to offers made to EU citizens or EU locations.

• RevDSG applies to processing in Switzerland.

If they apply simultaneously, the stricter regulations apply.

13. Integration of external services & plugins

• Google Analytics (mit IP-Masking)

• Matomo (on-premise)

• Facebook Pixel / Meta API

• LinkedIn Insight Tag

• YouTube (privacy mode recommended)

• Newsletter-Tools (mit AVV)

• Payment services (encrypted, no storage by us)

14. Data protection with third-party providers

• AVV concluded with processors

• SCC for third country transfers

• No use of Privacy Shield

• Privacy by Design & Default as a principle

15. Changes to this Privacy Policy This privacy policy may be updated from time to time. The most recent version can be found at:
https://www.rocketgames.ch/datenschutz
As of: June 6, 2025

16. Contact Rocket Games AG
Glattalstrasse 501
8153 Rümlang, Switzerland
E-mail: info@rocket-games.ch
Phone: +41 44 123 45 67

Supervisory authorities:

• Germany: responsible state data protection authority

• Switzerland: EDÖB, Feldeggstrasse 1, 3003 Bern
  E-mail: edoeb@edoeb.admin.ch

17. Cookie Policy (Summary)

• _rocket_sid: Session, technically necessary, storage duration: browser session

• Google Analytics / Matomo: Statistics, max. 2 years

• Facebook Pixel / LinkedIn / Google Ads: Marketing, up to 2 years

• Settings can be changed at any time via cookie banner or browser

18. Minors Our offerings are aimed at adults. Persons under 16 require parental consent.

19. Third-party online services For external links, their privacy policy applies. We assume no responsibility for third-party content.

20. Automated decision-making & profiling We currently do not use automated decision-making. You will be informed and asked for your consent if you use our website in the future.

21. Use of the AI chatbot "ChatLab"

21.1. Data processed: Chat histories, timestamps, IP (pseudonymized), device data, voluntary information.

21.2. Profiling: Personalized recommendations based on chat history and technical features.

21.3. Storage period: Maximum 12 months, after which deletion or anonymization.

21.4. Legal basis: Consent (Art. 6 (1) (a) GDPR) and legitimate interest (lit. f).

21.5. Processing & Storage: Hosting within Switzerland or the EU. No third-country processing without protective mechanisms.

21.6. Your rights: Information, deletion, objection regarding ChatLab data via info@rocket-games.ch.