Privacy policy of Galliker Transport AG and Group companies

When you visit our website, the browser used on your device automatically sends information to our website server. This information is temporarily stored in a so-called log file.

Our website is hosted on the servers of Nine Internet Solutions AG.

The following data is collected without any action on your part and stored until it is automatically deleted

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the accessed file,
• Website from which the access was made (referrer URL),
• Browser type and browser version as well as other information transmitted by the browser (such as the operating system of your computer, the name of your access provider, geographical origin, language setting, etc.).
• the sub-websites that are accessed via an accessing system on our website, and
• other similar data and information used for security purposes in the event of attacks on our information technology systems.

The data in question is processed for the following purposes

• Ensuring a smooth connection to the website
• Ensuring a comfortable use of our website
• Evaluating system security and stability and for other administrative purposes
• Improvement and further development of our business and our services

Nine Internet Solutions AG, Badenerstrasse 47, 8004 Zurich

ongoing GmbH ("ongoing"), Hinterbergstrasse 34, 6312 Steinhausen, Switzerland

Neos Foundation e.V., Tatzberg 47, DE-01307 Dresden, Germany

On our website, we offer you the option of contacting us directly by telephone, video conference, email or contact form. The reason for contacting us may be, for example, questions about transport and logistics services, questions on other topics or feedback.

We do not record conversations.

The following information may be provided:

• First name and surname
• E-mail address
• Address (voluntary)
• Telephone number (optional)
• Your customer number, if applicable
• Information that you provide in writing or verbally

The data in question will be processed for the following purposes:

• Making contact
• Answering your request

Webex from Cisco Systems (Switzerland) GmbH ("Cisco"), Richtistrasse 7, 8304 Wallisellen, Switzerland

Microsoft Teams and Microsoft Outlook from Microsoft Ireland Operations Ltd ("Microsoft"), South County Business Park, One Microsoft Place, D18P521, Leopardstown, Ireland

Callmanager from Recos IC AG ("Recos"), Schützenstrasse 7, 8853 Lachen, Switzerland.

We have concluded an order processing contract with Recos.

The transfer of European or Swiss personal data to Microsoft or Cisco may result in this data being transferred to their parent company in the USA or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Microsoft and Cisco that a transfer to the USA will be based on the E.U.- US or Swiss - US Data Privacy Framework (hereinafter Data Privacy Framework) or, if the Data Privacy Framework is declared invalid or does not (yet) apply, based on so-called standard contractual clauses as well as appropriate and proportionate technical and organizational measures. By submitting your request, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP and Art. 49 para. 1 lit. a GDPR.

GTM ensures the activation of other tools, which in turn collect personal data. Depending on the integrated tool, GTM collects

• IP addresses of website visitors
• Forwarding of IP addresses to analysis programs.

If you are logged in to YouTube at the same time:

• When you access a sub-page containing a YouTube video, the specific sub-page you visit is recognized.
• This information is assigned to the corresponding YouTube account

The following personal data is processed each time you visit our website:

• Browser type
• Operating system
• basic device information

When using Google Maps, Google also collects, processes and uses data about the use of the map functions by visitors. This involves the following personal data:

• Location data
• Search history
• Device information
• Usage data
• Cookies and device identifiers:
• Communication data
• if you are logged into your Google account, also the details you provided when registering, such as your surname, first name and e-mail address.

By clicking on the map, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites.

To enable you to communicate with us, we operate a social media profile on Instagram at https://www.instagram.com/galliker _transport_ag and a Facebook profile at https://www.facebook.com/gallikertransportag/?locale=en_DE. You can contact us via these profiles.

We have also placed an Instagram social media button on our website so that you can easily link to our respective profile. This is not a plugin, but only an icon with a link. Meta does not process any of your personal data on our website in this context.

Personal data

If you contact us via our social media profile or click on a social media button, the following information will be collected from you:

• User behavior
• IP address
• Connection data
• Device and browser information
• Data about the content accessed when clicking on the social media button
• User name or first and last name
• Possibly pictures, data that you send us in the context of contacting us

By clicking on the social media button, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites.

We are joint controllers with Meta in accordance with Art. 26 GDPR, but only with regard to the collection and transmission of data. Meta is solely responsible for the subsequent processing of the information by Meta. We have concluded a joint controllership agreement with Meta to determine the respective responsibilities for fulfilling the obligations under the GDPR. Accordingly, we are responsible for informing users of our website, while Meta is responsible for fulfilling requests regarding the rights of data subjects in accordance with Art. 15 to 21 GDPR. However, within the framework of joint controllership, you can in principle assert your data subject rights against each of the joint controllers. You can find out more about the joint controllership agreement here: https://de-de.facebook.com/legal/controller_addendum

The transfer of European or Swiss personal data to Meta may result in the transfer of data to its parent company in the USA or to third parties in a country that does not have an equivalent level of data protection. We have agreed with Meta that a transfer to the USA will be based on the E.U.- US or Swiss - US Data Privacy Framework (hereinafter Data Privacy Framework) or, if the Data Privacy Framework is declared invalid or does not (yet) apply, based on so-called standard contractual clauses and appropriate and proportionate technical and organizational measures.

By using the Galliker social media profiles, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP and Art. 49 para. 1 lit. a GDPR.

Meta is solely responsible for the subsequent processing of the information by Meta.

Storage period

To enable you to communicate with us, we operate a social media profile on LinkedIn at https://ch.linkedin.com/company/gallikertransportag. You can contact us via this profile.

We have also placed a LinkedIn social media button on our website so that you can easily link to our profile. This is not a plugin, but only an icon with a link. LinkedIn does not process any of your personal data on our website in this context.

If you contact us via our social media profile or click on a social media button, the following information will be collected from you:

• User behavior
• IP address
• Connection data
• Device and browser information
• Data about the content accessed when clicking on the social media button
• User name or first and last name
• Possibly picture, data that you send us in the context of contacting us

By clicking on the social media button, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites.

To enable you to communicate with us, we operate a social media profile on TikTok at https://www.tiktok.com/@galliker _transport_ag

We have also placed a TikTok social media button on our website so that you can easily link to our TikTok profile. This is not a plugin, but only an icon with a link. TikTok does not process any of your personal data on our website in this context.

If you contact us via our social media profile or click on a social media button, the following information will be collected from you:

• User behavior
• IP address
• Connection data
• Device and browser information or app information
• Data about the content accessed
• User name or first and last name
• Possibly picture, data that you send us in the context of contacting us

By clicking on the button, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites.

You have the option of creating a password-protected online customer account with us in the Galliker customer portal, provided that you have concluded a contract or our GTC and an order processing agreement with us. You can use the login data you have created to access the customer portal applications.

We provide you with the following services and information in the customer portal:

• Galliker Customer Center
• Track & Trace
• e-Delivery bill download
• Galliker VMS
• Galliker Photo Cloud
• Galliker Dock

The customer account is used to administer the services you have purchased from Galliker. You can also retrieve and manage information on services purchased in the past and inventory data.

The following data is processed during access via the website

• E-mail address
• Password

Further personal data may be processed as part of the individual services and are regulated in the order processing contract.

• Track & Trace / Galliker VMS: Bauer Software GmbH ("Bauer Software"), Alfred-Nobel-Allee 52, 66793 Saarwellingen, Germany
• Galliker Photo Cloud: komola GmbH ("komola"), Steintorwall 4, 38100 Braunschweig, Germany.
• Galliker Dock: Ehrhardt + Partner GmbH & Co KG ("Ehrhardt + Partner"), Alte Römerstraße 3, D-56154 Boppard-Buchholz, Germany.

Bauer Software: https://www.vsb-soft.de/de/impressum-datenschutz/datenschutz.php

Ehrhardt + Partner: https://www.epg.com/datenschutz

The following personal data is processed:

• First name and surname of employees of customers or potential customers
• Contact details of potential customers

If Galliker provides a service (especially deliveries) directly to the customer's end customer, Galliker may process personal data of end customers.

The customer of Galliker guarantees that Galliker may process the data of the end customers.

For this purpose, Galliker processes the following data

• First name and surname of the end customer
• Contact details of the end customer

Processing is based on the following purposes:

• Fulfillment of the contract
• Operation

Coordination and agreement between Galliker and its suppliers is necessary for the procurement of services and ultimately for the mutual fulfillment of the contract.

For their part, the suppliers of Galliker are requested to inform their employees about their rights and obligations in the area of data protection.

For this purpose, Galliker processes the following data

• First name and surname of the suppliers' employees
• Contact details of the supplier's employee

Processing is based on the following purposes:

• Contract fulfillment
• Operation

You have the option of applying to us via our web-based application tool (at jobs.galliker.com), by post or by e-mail.

Our web-based application tool includes an online application form. We use Refline for this form. The application data you provide is stored on a secure Refline server and can be viewed by us. Your data will only be stored if you are offered employment with us.

In connection with apprenticeships in Switzerland, we use the service www.yousty.ch. Our vacancies are advertised on the platform. You have the option of uploading your application documents to the platform.

You have the option of applying to us by e-mail. In these cases, we process all data that you send us with your application dossier using MS Outlook (for more information on how we handle your personal data when using MS Outlook, see "II Processing activities, B. Contacting us" above).

The following information may be processed when you submit an application:

• Applicant master data (first and last name, e-mail address, telephone number, address, date of birth, citizenship)
• Qualification data (cover letter, letter of motivation, CV, previous activities, professional qualifications and skills)
• Voluntary information, e.g. title, photo, applicant source or other information that you voluntarily provide in your application
• Other data/data categories, e.g. publicly accessible, job-related data, e.g. a public profile on social media networks.

Refline AG ("Refline"), Bösch 65, 6331 Hünenberg, Switzerland

Yousty AG ("Yousty"), Limmatstrasse 21, 8005 Zurich, Switzerland

https://refline.ch/de/datenschutz/

https://www.yousty.ch/de-CH/privacy

You have the option of registering for a job newsletter "JobMail" on our website. We use this newsletter to inform you about current vacancies and related information.

Registration for the newsletter is only possible with a double opt-in: After you have registered on our website, you will receive an e-mail in which you must click on the confirmation to receive a newsletter. If you do not wish to do this, ignore the confirmation e-mail.

If you wish to unsubscribe from the newsletter at a later date, you can click on the unsubscribe link that is sent to you with every e-mail newsletter.

We collect the following information for registration and sending the newsletter:

• First name and surname
• E-mail address

We then process data that can be used to determine whether a newsletter message has been opened and which links, if any, have been clicked on. Technical information is also collected, such as

• Time of retrieval
• IP address
• Browser type
• Click behavior
• Operating system

With your consent, you have the option of having your application documents stored in our talent pool. For open positions, we would then ask you whether you might be interested in a position.

If we add your documents to the talent pool, you will receive an e-mail asking you to submit a double opt-in. You will receive an e-mail in which you must click on the confirmation to receive job offers. If you do not wish to do this, ignore the confirmation e-mail.

If you wish to unsubscribe from the talent pool at a later date, you can click on the unsubscribe link that is sent to you with every request.

• We collect the following information for registration and sending the newsletter:
• Applicant master data (first and last name, e-mail address, telephone number, address, date of birth, citizenship)
• Qualification data (cover letter, letter of motivation, CV, previous activities, professional qualifications and skills)
• Voluntary information, e.g. title, photo, applicant source or other information that you voluntarily provide in your application
• Other data/data categories, e.g. publicly accessible, job-related data, e.g. a public profile on social media networks.

We then process data that can be used to determine whether a message has been opened and which links, if any, have been clicked on. Technical information is also recorded, such as

• Time of access
• IP address
• Browser type
• Click behavior
• Operating system

To requestinformation about your personal data processed by us. In particular, information in accordance with Art. 25 ff. FADP or Art. 15 GDPR may contain information

• about the purposes of processing
• the category of personal data
• the categories of recipients to whom your data has been or will be disclosed
• the planned storage period
• the existence of a right to rectification, erasure, restriction of processing or objection
• the existence of a right to lodge a complaint
• the origin of your data if it was not collected by us
• the existence of automated decision-making, including profiling and, where applicable, meaningful information about its details