Data Privacy

1) Preamble

Welcome to the use of our website (semis.io) and the HelloSeller App (hereinafter “App”)! We attach great importance to protecting your data and safeguarding your privacy. We would like to explain below which data we process, when and for what purpose and on what legal basis. In doing so, we would like to explain to you how our offered services work and how the protection of your personal data is guaranteed.

According to Art. 4 No. 1 GDPR, personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly. Further information on this can be found in Art. 4 No. 1 GDPR, among others.

This privacy policy can be accessed, saved and printed out at any time at https://semis.io/privacy.

As far as we cite our legitimate interest or a legitimate interest of a third party (Art. 6 para. 1 lit. f) GDPR) as the lawful basis for the processing of personal data, you have a right of objection pursuant to Art. 21 GDPR:

We will also not process your personal data for other purposes after an objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims (cf. for example Art. 21 (1) GDPR, so-called "limited right of objection"). In this case, you must provide reasons for the objection that arise from your particular situation.

You may also object to processing of your personal data on grounds relating to your particular situation which is carried out for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out in the public interest (cf. Article 21(6) of the GDPR).

We will also refer you to the right of objection again separately in the individual sections (e.g. by stating: "You have a right of objection"), if this right exists. There you will also find further information on how to exercise your right to object.

In order to keep the following privacy policy clear, we refer to information and data protection notices located on external websites at various points by means of links. We make every effort to keep the links that we list in this privacy policy up to date. However, due to the constant updating of the website and app, it cannot be ruled out that links do not function correctly. If you notice such a link, we would be pleased if you let us know so that we can add the current link.

2) Responsible Person

The controller within the meaning of Art. 4 No. 7 GDPR for the processing of personal data is:

SEMIS AG
Steinhauserstrasse 11
CH-6300 Zug
E-mail: n.colshorn@semis.io

3) Access to the HelloSeller App in the App Store

When downloading the HelloSeller App, required information is transferred to the respective app store (e.g. Google Play, App Store). In particular, the following information is transferred:

• User name
• E-mail address
• Time of the download
• Unit code number

We have no influence on this data processing and are not responsible for it.

You can find information on the data processing of the stores here:

• Information on data processing by Google can be found here: https://policies.google.com/privacy
• Information on data processing by Apple can be found here: https://support.apple.com/de-de/HT211970

The legal basis for the storage is our legitimate interest pursuant to Art. 6 para. 1 lit f) GDPR. We have a legitimate interest in tracking how many users have downloaded the HelloSeller App.

Furthermore, we store the data in order to contact you again if necessary for the purpose of evaluating a further BETA version. In this case, we will obtain your consent (see point 7 below).

No other processing of the data takes place. You can object to the processing of your personal data by us as described above here.

4) Telemetry data

When you use our website and HelloSeller App, we automatically collect data and information from your device's system and store it. As the HelloSeller App is still a beta version, we are particularly dependent on data for the purpose of debugging and further developing the website and HelloSeller App.

This covers the following information:

• IP address

The purpose of this processing is the retrievability of the website and app from your device and to enable a correct display of our website and app on your device. Furthermore, we use the data for the further development and improvement of the website and app, for statistical purposes and to ensure the security of our systems. We do not evaluate this data for marketing purposes. No user input is stored either.

The legal basis for the processing is Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in presenting you with a website and HelloSeller App that is optimized for your devices and in enabling communication between our services and your terminal device, as well as in further developing and improving our website and HelloSeller App.

The provision of personal data is neither legally nor contractually required and is also not necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide such data may result in you not being able to use the website and HelloSeller App or not being able to use it to its full extent.

5) Information on Google services

We use various services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") on our website and in our app.

You can find more information on the individual concrete services from Google that we use on this website and in the app in the further privacy policy.

Through the integration of Google services, Google may collect and process information (including personal data). It cannot be ruled out that Google also transmits the information to a server in a third country.

As can be seen from Google's Privacy Shield certification (available at https://www.privacyshield.gov/list under the search term "Google"), Google has committed to comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework on the collection, use and retention of personal data from the member states of the EU and Switzerland, respectively.

We ourselves cannot influence which data Google actually collects and processes. However, Google states that the following information (including personal data) may be processed:

• Log data (in particular the IP address)
• Site-related information
• Unique application numbers
• Cookies and similar technologies

Information on the types of cookies used by Google can be found at https://policies.google.com/technologies/types.

If you are logged into your Google Account, Google may add the processed information to your account and treat it as personal data, depending on your account settings.

You can prevent this data from being added directly by logging out of your Google account or by changing the corresponding account settings in your Google account. Furthermore, you can change your cookie settings (e.g. delete cookies, block cookies, etc.).

You can find more information in Google's privacy policy. You can find information on Google's privacy settings at https://privacy.google.com/take-control.html.

6) Functions of the Website and HelloSeller App

The website provides information about SEMIS AG, its products and investment opportunities. The mobile information app (HelloSeller) gives users maximum real-time insight into their sales, account activity, time-sensitive actions and long-term statistics.

7) Registration function

The use of the website and HelloSeller App is possible without registration.

8) Newsletter

We offer a newsletter.

If you would like to subscribe to our newsletter, we require the following personal data from you:

• E-mail address

Registration for the newsletter takes place via the Beta User registration form. The newsletter is sent exclusively with your express consent. After you have entered your surname, first name and e-mail address, you will receive a confirmation e-mail at the specified e-mail address. With an explicit confirmation by clicking on a link in the e-mail, the newsletter is sent (so-called double opt-in).

The purpose of processing and storing the e-mail address is to send you the newsletter.

The legal basis for the processing of personal data described here within the scope of the newsletter is your express consent pursuant to Art. 6 (1) a) GDPR.

9) Hubspot Pixel

We use services from Hubspot, HubSpot, Inc ("HubSpot"), 25 First Street, 2nd Floor Cambridge, MA 02141, USA on our website and in our app.

Hubspot uses "cookies", which are text files placed on your device, to help the website analyse how users use the websites/apps they visit. Hubspot may also use so-called web beacons or pixels (invisible graphics). These web beacons or pixels can be used to analyse information such as visitor traffic to websites/apps. The information generated by cookies and web beacons / pixels about the use of our app (including the user's IP address) is transmitted to a Hubspot server and stored there. This information may be passed on by Hubspot to their contractual partners.

The data is transferred to the USA. The legal basis depends on the function in which personal data is transferred.

As part of the user analysis, Hubspot processes the following (personal) data:

• Geographical position
• Browser type
• Navigation information
• Reference URL
• Performance data
• Frequency of application use
• Mobile apps data
• Login information for the Hubspot subscription service
• Files displayed on site
• Domain names
• Aggregated use
• Duration of the visit
• Access times
• Clickstream data

Furthermore, we have concluded an order processing agreement with Hubspot Inc. for the use of Hubspot (Art. 28 GDPR). Hubspot processes the data on our behalf in order to evaluate your use of the website and app, to compile reports on website and app activities for us and to provide us with other services related to website and app use and internet use.

By integrating Hubspot, we pursue the purpose of analysing user behaviour on our website and app and being able to react to this. This allows us to continuously improve our offer.

The legal basis for the processing of personal data described here in the context of the measurement procedure is your express consent pursuant to Art. 6 (1) a) GDPR.

As part of the order processing, Hubspot is entitled to engage subcontractors. A list of subcontractors can be found at: https://legal.hubspot.com/de/dpa

10) Google Analytics

We use Google Analytics on our website and in our app, a web analytics service provided by Google Inc ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses "cookies", which are text files placed on your device, to analyse how users use the website and app. The information generated by cookies and web beacons about the use of our website and app (including the user's IP address) is transmitted to a Google server, possibly in the USA or other third countries, and stored there.

The following types of data are processed by Google:

• Online identifiers (including cookie identifiers)
• IP address
• Device identifiers
• Click path
• Date and time of the visit
• Location information
• Pages visited
• Visited URL
• Referrer URL
• Browser information
• Hostname
• Browser language
• Browser type
• Screen resolution
• Device operating system
• Interaction data
• User behaviour

We only use Google Analytics with activated IP anonymisation ("anonymize IP"). This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Furthermore, we have concluded an order processing agreement with Google for the use of Google Analytics (Art. 28 GDPR).

The legal basis for the processing of personal data described here in the context of the measurement procedure is your express consent pursuant to Art. 6 (1) a) GDPR.

As part of the order processing, Google is entitled to engage subcontractors. A list of these subcontractors can be found at https://privacy.google.com/businesses/subprocessors/.

For further information on data handling in connection with Google Analytics, please refer to Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de

11) Use of YouTube

We use videos from YouTube on our website. YouTube is a service provided by YouTube LLC ("YouTube"), 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube is integrated by embedding the service on our website using a so-called "iFrame". When loading this iFrame, YouTube or Google may collect and process information (including personal data). It cannot be ruled out that YouTube or Google also transmits the information to a server in a third country.

12) Social Networks & External Links

Our app and website may contain links to social networks and external websites (e.g. LinkedIn, Instagram, Facebook). When you click on these links, you will be redirected to the respective external platforms. We have no influence on the data processing by the operators of these platforms.

Data processing on these platforms is subject to the respective privacy policies of the providers. We recommend that you inform yourself about the respective privacy policies of the platforms before using their services.

The legal basis for providing the links is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR, to maintain our presence on social media and to give our users the opportunity to contact us through various channels.

13) Cookies

Our app and website use cookies. Cookies are small text files that are stored on your device and saved by your browser. They serve to make our offering more user-friendly, effective, and secure.

Some cookies are "session cookies" that are automatically deleted after your browser session ends. Other cookies remain stored on your device until you delete them or they expire. These cookies enable us to recognise your browser on your next visit.

You can set your browser to inform you about the setting of cookies and only allow cookies on a case-by-case basis, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of our app and website may be limited.

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f) GDPR. The legal basis for the processing of personal data using cookies for analysis purposes is your consent pursuant to Art. 6 para. 1 lit. a) GDPR.

14) Data security

We use technical and organisational security measures to protect the data managed by us against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

We use SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

15) Amendment to the privacy policy

We reserve the right to amend this privacy policy at any time in compliance with the applicable data protection regulations. This may be necessary, for example, to comply with new legal provisions or to take account of changes to our website and app or new services. The version current at the time of your visit shall apply.

16) Revocation

Insofar as the processing of your personal data is based on your consent, you have the right to revoke your consent at any time. The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

You can inform us of your revocation at any time informally, e.g. by e-mail to n.colshorn@semis.io.

17) Data subject rights

Under the GDPR, you are entitled to the following rights:

• Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether personal data concerning you is being processed, and, where that is the case, access to the personal data and further information and a copy of the data.
• Right to rectification (Art. 16 GDPR): You have the right to obtain the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed.
• Right to erasure (Art. 17 GDPR): You have the right to obtain the erasure of your personal data where one of the grounds set out in Art. 17 GDPR applies.
• Right to restriction of processing (Art. 18 GDPR): You have the right to obtain the restriction of processing where one of the conditions set out in Art. 18 GDPR is met.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller.
• Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR.

To exercise your rights, you can contact us at any time.