The processing of information and data - especially personal data - is a matter of trust. Data protection and data security have a high priority at goCaution AG. In order to do justice to this concern, the best possible protection must be guaranteed for your data. All data that goCaution AG receives from you will be processed confidentially and in accordance with the currently applicable data protection legislation, i.e. in particular collected, stored, used, made available or deleted.

Below you will find information on how we process your personal data when you use our services or are otherwise in contact with us, communicate with us or otherwise deal with us. Within different locations, we process your personal data within the scope of this privacy policy and thus in particular for the same purposes. Insofar as we carry out our main professional activities, the Cantonal Data Protection Act of the Canton of Bern applies in principle. goCaution AG stores data relating to your person, you have the right to

• Information,
• Correction and
• Deletion/blocking of this data, unless there is a legal obligation to retain it.

This data protection notice applies to the processing of personal data by goCaution AG, Brünnenstrasse 126, 3018 Bern (hereinafter referred to as "goCaution") in the context of the provision of its services and/or its associated websites and, if applicable, apps, unless separate notices are provided there.

This applies in particular to the following websites and their content:

• www.gocaution.ch
• www.login.gocaution.ch
• www.my.gocaution.ch
• www.registration.gocaution.ch
• www.goinsure.ch
• www.xxxlutz.goinsure.ch

These Internet pages may contain links to Internet pages of other providers (e.g. in the context of so-called social plugins), to which this data protection notice and thus the data protection guaranteed by goCaution does not extend. The websites are operated by goCaution. To the extent permitted by law, goCaution therefore accepts no liability for any violations of data protection regulations and any resulting damages.

Unless otherwise stated, the services and offers brokered by goCaution via the Internet, as well as the associated information, apply only to persons and companies with their place of residence under civil law in Switzerland or Liechtenstein. Further restrictions may apply to individual products.

The data and information provided to goCaution will be used for the activities involved in the creation and administration of the insurance policy. The processing of your personal data is essential for the provision of insurance advice tailored to your needs. It is not possible to conclude or execute an insurance contract without processing your data. Your data will only ever be used for the purpose stated, for example, at the time of collection, for which you have consented, which is evident from the circumstances or which is provided for by law.

goCaution processes personal data in particular insofar as this is necessary for business processes such as acquisition, application support, risk assessment of applications, protection against insurance abuse, management of the customer relationship, provision of services, needs-based advice and support, processing of offers and contracts, as well as claims and benefits, invoicing, answering questions and concerns, and the evaluation, improvement and new development of products, services and services. In this context, goCaution also processes your personal data for advertising purposes such as customer satisfaction surveys, general customer communication and the personalized adaptation of goCaution's offers as well as for the creation of customer profiles.

The personal data processed by goCaution includes data provided by the policyholder and publicly accessible data. The data categories are:

• Customer data (such as name, address, date of birth, gender, nationality, creditworthiness data, etc.)
• Data from applications, including the associated supplementary questionnaires (such as information from the applicant on the insured risk, answers to questions, information from the previous insurer on the claims history)
• Data from contracts (such as contract duration, insured risks, benefits, data from existing contracts)
• Collection data (such as date and amount of premiums received, outstanding amounts, reminders, credit balances, payment details) and
• any damage data (such as damage reports, investigation reports, invoice documents, data relating to injured third parties)

We process and store your personal data for as long as is necessary or appropriate to fulfill our contractual and legal obligations or to comply with the relevant legal provisions, or as long as it is necessary for the purposes for which it was collected. As far as possible, we anonymize or delete your personal data as soon as it is no longer required, or at the latest after the legally prescribed retention period has expired. In addition, goCaution retains your data for the period during which claims can be asserted against goCaution companies.

You can request the deletion of your personal data yourself at any time by sending us a corresponding request to the above-mentioned contact details. We will comply with your request unless we are obliged to continue storing your data for other reasons (e.g. statutory retention obligations).

We would like to point out that communication with us via the public, freely accessible Internet is associated with certain security risks over which we have no influence and no means of control. Please contact us if you wish to communicate via a secure connection.

For security reasons, we use SSL or TLS encryption for our website and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, data that you transmit to us cannot be read by third parties.

We then apply technical and organizational measures to protect your personal data. These measures are regularly reviewed and adapted.

Data on prospective or existing customers may be collected from third parties in order to optimize the handling of the above-mentioned business processes and to ensure data accuracy, to optimize the fulfillment of business and/or customer needs and to detect or prevent insurance fraud. The following information (e.g. from credit agencies and other third parties) may be obtained.

If you request a quotation via our website, you consent to us transmitting the customer data (name, date of birth, place of birth) collected as part of the quotation request to CRIF AG, Hagenholzstrasse 81, 8050 Zurich, for the purpose of identity and credit checks.

This data transfer takes place so that CRIF, a consumer credit agency, can carry out an identity and credit check and an assessment of solvency on our behalf. As part of the decision to enter into a contractual relationship with you, CRIF uses this information to verify your address and analyze your payment history, among other things. These score values are calculated by CRIF on the basis of a scientifically recognized, mathematical-statistical procedure, which also takes your address into account. The calculated score values are transmitted to us and we use these values to decide whether and, if so, up to what maximum amount of cover a contractual relationship for an insurance guarantee can be entered into with you.

If you request a quotation via our website, you consent to us transmitting the customer data (name, date of birth, place of birth) collected as part of the quotation request to Creditreform Egeli Zürich AG, Binzmühlestrasse 13, 8050 Zurich, for the purpose of identity and credit checks.

This data transfer takes place so that Creditreform, a consumer credit agency, can carry out an identity and credit check and an assessment of solvency on our behalf. As part of the decision to enter into a contractual relationship with you, Creditreform uses this information to verify your address and analyze your payment history, among other things. These score values are calculated by Creditreform on the basis of a scientifically recognized, mathematical-statistical procedure, which also takes your address into account. The calculated score values are transmitted to us and we use these values to decide whether and, if so, up to what maximum amount of cover a contractual relationship for an insurance guarantee can be entered into with you.

Your personal data may be passed on to third parties (so-called "data processors") for the aforementioned purposes and/or to ensure compliance with legal and regulatory provisions. goCaution may also outsource business areas, individual steps in the value chain and/or services (e.g. service processing, IT, contract administration, product development) in whole or in part to third parties in Switzerland and abroad. This also applies to the processing of personal data. In doing so, goCaution attaches great importance to ensuring that your data is protected against unauthorized access, loss or misuse.

The data may be passed on to the following categories of third parties in Switzerland and abroad:

• Service providers (internal and external), including contract data processors
• Insurance brokers and other contractual partners
• Risk carrier
• Landlords/guarantee recipients (e.g. in the event of damage)
• Local, national and foreign authorities and official bodies
• Acquirers or parties interested in acquiring business divisions, companies or other parts of goCaution
• Other parties in potential or actual legal proceedings

If necessary, goCaution or the data processors will, with your consent, consult with third parties (e.g. current or previous landlords) depending on the insurance cover to be checked. Based on your consent, these persons are expressly released from their duty of confidentiality towards goCaution and the data processors for the purpose of checking insurance cover. Data may also be passed on for the purpose of detecting or preventing insurance fraud, in particular to insurers in Switzerland and abroad and to law enforcement authorities.

If the recipient is located in a country without adequate statutory data protection, we will contractually ensure that the recipient complies with the applicable data protection regulations, unless it is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exemption clause. Such an exception may exist if you have consented to the disclosure or if it concerns data that you have made generally accessible and whose processing you have not objected to. Disclosure is also permitted in the case of legal proceedings abroad, in cases of overriding public interests or if the performance of a contract requires such disclosure.

When processing personal data, goCaution takes appropriate technical and organizational measures to prevent unauthorized access and other unauthorized processing. These are based on international standards in this area and are regularly reviewed and, if necessary, adapted accordingly.

Websites on which you transmit sensitive or personal data are secured against access by third parties by means of so-called "SSL encryption". However, as the integrity, confidentiality and security of data cannot generally be guaranteed on the Internet, goCaution accepts no liability for:

• the security of your data during transmission via the Internet;
• in the event that a third party modifies, views, takes over, uses or exploits the data entered by you or goCaution;
• Internet malfunctions, imported data of all kinds (including viruses) and links from and to other websites.
• By accessing the goCaution AG website, you declare your agreement with the above conditions.

Please note that communication by e-mail is generally not encrypted. There is a possibility that data may be lost or intercepted and/or manipulated by third parties. goCaution takes appropriate technical and organizational security measures to prevent this within the goCaution system. However, your access device (PC, smartphone, etc.) is located outside the security area that can be controlled by goCaution. As a user of the Internet, it is your responsibility to inform yourself about the necessary security precautions and to take appropriate measures (e.g. up-to-date virus protection, etc.).

If you contact goCaution via the Internet contact form, the data entered in these forms will be transmitted from your PC in encrypted form in accordance with internationally recognized security standards in order to protect it against misuse by third parties.

If you contact us via the callback service form and arrange a telephone callback, your details will be stored exclusively for the purpose of processing your callback. Your data will not be passed on without your consent. The data entered in the form will be processed exclusively on the basis of your consent. You can revoke this consent at any time.

All you need to do is send us an informal notification by e-mail. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation. We will retain the data you provide on the form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Mandatory statutory provisions such as retention periods remain unaffected.

You can visit the goCaution website anonymously without having to provide any personal details. To do this, you must deactivate the tracking function in your browser. In any case, your IP address will only be processed in pseudonymized form.

Personal data is only processed if you provide it as part of one of the applications on the website (e.g. via a contact form, a request for a quote, an offer, a premium calculator, an online contract, a claims notification, live chats, a competition, etc.). This personal data is not transmitted or made available to third parties for any other purpose.

If data is processed by a third party when visiting the goCaution website, this data is always anonymized, which means that no personal reference can be established. An overview of third parties in this context can be found in the chapter Integration of third-party services.

The data you send to goCaution via the goCaution website is transmitted in encrypted form. However, goCaution accepts no liability for any damage you may suffer as a result of data loss or manipulation. Therefore, please ensure that your system is adequately protected at all times (e.g. virus protection) and that your systems and browser are up to date.

The Internet pages of goCaution use so-called cookies. Cookies are small files that are stored on your access device (PC, smartphone, etc.) when you visit a goCaution website. Cookies are used to collect information about the use of websites. Each time you visit this website, information is collected by the system of your access device.

Certain cookies are automatically deleted at the end of the browser session (so-called session cookies), others are stored in the user's browser for a specified period of time or permanently and then delete themselves automatically (so-called temporary or permanent cookies).

The visitor data collected in this way is pseudonymized, making it impossible to link it to a specific person. The data is not stored together with other personal data. When you access the goCaution website, you will be informed about the use of cookies for analysis purposes and your consent to the processing of the data used in this context will be obtained.

The cookies stored on your access device may also originate from other goCaution companies or third parties such as advertising partners (so-called third party cookies). They are used for individualized advertising and to measure its effectiveness. When visiting goCaution websites, third parties only receive access to data on the basis of an identification number, the so-called cookie ID. No personal data is transmitted.

You can determine the use of cookies yourself by making the appropriate browser settings. However, if the use or functionality of cookies is restricted or prevented, the use of certain websites may be limited. You can manage many online advertising cookies from companies via the EU site http://www.youronlinec-hoices.com/uk/your-ad-choices/ or the US site http://www.aboutads.info/choices/. To get an overview of all third-party access to your browser or to prevent it, you can install specialized add-ons for your browser, such as NoScript or Ghostery.

The providers of the goCaution Internet pages collect and store data in so-called log files when they are accessed. This involves the following data:

• IP address of the Internet visitor
• User name (user ID) when using the customer portal
• Date and time of access to the goCaution website
• Name of the Internet pages accessed
• Definition of the retrieved files (downloads)
• Notification of successful retrieval
• Previously visited page

This data is not stored together with other personal data of the user. In addition, this data is only collected for statistical purposes of website use, security and to optimize the offer and the website and is not passed on to third parties for other purposes.

This data is deleted as soon as it is no longer required to achieve the purpose for which it was collected or there is no legal basis for its retention. As the access data is absolutely necessary for the provision of the website, there is no option to object to this data processing.

In some cases, third-party services are displayed on the goCaution website. The functionality of these services requires that the providers store your IP address. goCaution attaches great importance to the fact that only those services are used whose respective providers only use the IP address to deliver the respective services. Your IP address is processed by third parties in accordance with their data protection regulations.

The data transmitted to goCaution by visiting the website may be processed for advertising purposes and made available to advertising partners in aggregated form on the basis of a pseudonymized identification number without personal reference (so-called cookie ID) for the purpose of target group-based advertising. goCaution does not disclose your identity to advertising partners or partners of advertising marketing networks. The parties involved are obliged to refrain from and prevent the creation of a personal reference.

The advertising partners will only be provided with anonymized information about you, such as your age group, gender and region of residence, as well as personal and household information obtained from third parties.

The services of the following advertising partners are utilized:

• Facebook Pixel
• Bing Ads Conversion
• Google Ads Conversion

Data analysis and tracking tools are used to obtain information about the use of the goCaution website and to optimize offers. These tools are provided by third parties. As a rule, the information collected for this purpose about the use of a website is transmitted to the provider's server through the use of cookies. Your IP address is also transmitted, but it is anonymized by the provider before it is saved so that it can no longer be assigned to you.

The following tools can be used on the goCaution website for the aforementioned purposes:

• Google Analytics
• Smartlook

This website uses Google Analytics, a web analysis service of Google Inc ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be shortened by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

This website uses Smartlook, a web analysis service of Smartsupp.com, s.r.o. Smartlook uses so-called "cookies", text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is collected and used to optimize the user experience.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Smartlook in the manner and for the purposes set out above.

You can deactivate this analysis by clicking on the following link:

https://www.smartlook.com/de/opt-out

By means of so-called "re-targeting" tags, visitors to goCaution websites can be made aware of goCaution again on third-party websites with advertising from goCaution.

On the goCaution website, services from the following providers can be used for this purpose:

• Facebook Remarketing
• Google Remarketing
• Bing Remarketing

You can object to the data processing of these providers at any time. The links required for this can be found in the section Restriction of third-party services under "Advertising partners".

We sometimes use Google reCAPTCHA on our websites. The purpose of reCAPTCHA is to check whether the data entry in the contact form is made by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent on the website by the website visitor or mouse movements made by the user). The data collected during the analysis is forwarded to Google. The reCAPTCHA analyses run completely in the background. Further information on Google re-CAPTCHA and Google's privacy policy can be found at the following link: https://www.google.com/intl/de/policies/privacy/ .

goCaution AG uses so-called social plugins on its website. The plugins can be recognized by the logo of the respective social network. All plugins used are set up using the 2-click method. This means that the respective plugins are only activated when the provider's icon is clicked.

When you access a page on our website that contains an activated plugin, your browser establishes a direct connection to the provider's servers. The content of the plugin is transmitted directly to your browser by the respective provider and integrated into the page. By integrating the plugins, certain information is transmitted to the third-party provider and stored by them.

If you are not a member of the relevant social networks, it is still possible for them to find out and save your IP address via the social plugin. If you are logged in to one of the social networks, the third-party providers can directly associate your visit to our website with your personal profile on the social network. If you interact with the plugins, for example by clicking the "Like", "+1", "Twitter" or "Instagram" button, the corresponding information is also transmitted directly to a server of the third-party provider and stored there. The information is also published on the social network, on your Twitter or Instagram account and displayed there to your contacts. The purpose and scope of the data collection and the further processing and use of the data by the third-party providers as well as your rights in this regard and setting options to protect your privacy can be found in the third-party providers' data protection notices. A list of the plugins we use and further information from the respective providers can be found here:

https://www.facebook.com/policy.php
Opt-Out: https://www.facebook.com/settings?tab=ads und http://www.youronlinechoices.com
Through certification in accordance with the EU-US Privacy Shield ("EU-US Privacy Shield")
https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&stat us=Active

If we receive your e-mail address in connection with the conclusion of the contract and the provision of products and you have not expressly objected to this, we reserve the right to send you offers for similar products from our range by e-mail at regular intervals. You have the option to object to the use of your e-mail address for this purpose at any time, either by sending a message to the contact option specified above or by using the unsubscribe link provided in the advertising e-mails. This objection is free of charge for you, with the exception of the normal transmission costs in accordance with the basic rates.

In connection with sending the newsletter, this data is not passed on to third parties for other purposes. For statistical purposes, anonymized link tracking is carried out when the newsletter is sent. You can unsubscribe from goCaution newsletters using the special links provided.

In principle, you have the right to obtain information from us at any time as to whether we are processing personal data about you. You also have the option of having your personal data corrected, blocked or deleted by us. This does not apply to data that we need to process outstanding orders or to enforce existing rights and claims, or to data that we are required to retain by law. You can also object to the disclosure of certain personal data. You can also request that we return the data you have provided to us. You can withdraw your consent to the use of your personal data at any time. However, your revocation is limited to the storage and use of personal data that we are not allowed to store or use without your consent due to legal permissions. Your revocation also has no effect on previous processing operations that were carried out on the basis of your consent.

Within the framework of the applicable data protection regulations and insofar as these are applicable (for example in accordance with the GDPR), we would like to inform you that you have these specific rights with regard to your personal data:

• Right to information: You have the right to receive information about which of your personal data is processed by us.
• Right to rectification: If your personal data is incorrect or incomplete, you have the right to request that it be rectified.
• Right to erasure: Under certain circumstances, you can request the erasure of your personal data.
• Right to restriction of processing: You have the right to restrict the processing of your personal data in certain situations.
• Right to object: You may object to the processing of your personal data unless there are compelling legitimate grounds for the processing.
• Right to data portability: You have the right to receive certain personal data that you have provided to us in a structured, commonly used and machine-readable format in order to transmit it to another entity.

Please note that in some cases we may have legal obligations to retain or process certain data. In such cases, we may restrict these rights in accordance with applicable laws and regulations. If there are costs associated with exercising these rights, we will inform you in advance.

We reserve the right to amend this privacy policy at any time. The current version published on our website or the version that we may have provided to you elsewhere shall apply. If you are affected by a change to the privacy policy, we will inform you of such a change in an appropriate form. The privacy policy does not establish any contractual or other formal legal relationship with or on behalf of a party.