DATA PRIVACY NOTICE

Data Protection at MTEL Switzerland

Status 01.05.2026

The protection of your personal data and your privacy is of particular concern to us. We therefore comply with the applicable data protection law when processing your personal data, in particular the Swiss Federal Act on Data Protection (FADP) and the Telecommunications Act (TCA). Where we refer below to “personal” or “person-related” data, this also includes personal data within the meaning of Swiss data protection law. In order to protect your data against access and misuse by unauthorised persons, we take effective technical and organisational precautions, and our employees are continuously trained in the handling of personal data. In this Privacy Policy, you will learn which personal data is collected, processed and used when concluding a contract, during the term of a contract and after the end of a contract (mobile telephony, data tariffs, TV, broadband internet), and which rights you have, subject to applicable law, in connection with the processing of your personal data.

1. Controller and scope of application

The controller responsible for processing your personal data is MTEL Schweiz GmbH, Hagenholzstr. 81a, 8050 Zurich, e-mail: data.ch@mtel.ch

This Privacy Policy applies to our website, web shop, MyMTEL Selfcare, mobile services, broadband internet services, OTT TV/radio services, prepaid registrations, number porting, customer service contacts, marketing activities, competitions, as well as additional or brokered third-party services, unless a supplementary privacy notice applies in individual cases.

2. Which categories of data we process

Depending on the product, use and contact with us, we process in particular the following categories of personal data:

2.1 Contract and master data

This includes in particular first name, last name, salutation, address, date of birth, language, contact details, customer number, contract data, information on tariff, term, correspondence, payment method, as well as further data required for the conclusion, performance, amendment or termination of a contract.

2.2 Usage and connection data

This includes in particular data arising from the use of mobile, internet, TV and OTT services, such as the time, duration, scope and type of use, functions used, streaming data, TV usage data, connection data, IP addresses, services used, technical parameters, as well as billing-relevant usage information.

2.3 Technical data

This includes in particular device information, browser data, operating system, language settings, screen resolution, device type, device identifiers, software versions, log data, error data, session information, as well as further technical information required for operation, security, error analysis, support and prevention of misuse.

2.4 Financial, creditworthiness, debt collection and verification data

This includes in particular invoice data, incoming payments, outstanding balance, prepaid credit, creditworthiness assessments, debt collection and debt enforcement information, as well as results of online verification and data matching processes.

2.5 Location data

Within MTEL, this category includes in particular Geo-IP-based location information, i.e. information that can be derived from your IP address or from comparable technical data regarding the approximate location of your end device.

2.6 Interaction, voice, chat, AI and image data

This includes in particular content and metadata from inquiries to our customer service, hotline calls, chat content, interactions with chat or AI-supported functions, as well as image or video elements insofar as these are used for online verification, identity verification or similar processes.

3. Where we obtain personal data

We primarily receive personal data directly from you, for example when you place orders, register, conclude contracts, change tariffs, port numbers, register prepaid services, submit support requests, participate in competitions or use our services.

In addition, we may receive data from third parties, in particular from sales partners, payment service providers, credit agencies, verification service providers, debt collection service providers, banks, porting offices, group companies, repair, insurance, content or platform partners, as well as from publicly accessible sources, insofar as this is legally permissible.

4. For which purposes we process personal data

We process personal data in particular for the following purposes:

4.1 Contract initiation, contract conclusion and contract performance

We process personal data in order to initiate, conclude, activate, perform, amend, extend or terminate contracts, bill services and provide our products and services.

4.2 Provision of mobile, internet and OTT TV/radio services

We process personal data in order to provide, operate, maintain and further develop mobile services, internet services, OTT TV/radio services, apps, customer accounts and the web shop.

4.3 Registration, identification and online verification

We process personal data for identity checks, registration and verification, for postpaid and prepaid services, online contract conclusions, number porting, as well as in further cases in which identification is required by law, regulation or for operational reasons.

4.4 Credit assessment, fraud and misuse prevention

We process personal data for credit assessment, the prevention of fraud, misuse and unlawful orders, as well as for safeguarding our systems, processes and claims.

4.5 Invoicing, payment, debt collection and legal enforcement

We process personal data for invoicing, payment processing, posting, reminders, debt collection, enforcement of claims, and the defence or assertion of legal claims.

4.6 Customer service and communication

We process personal data in order to handle inquiries, complaints, fault reports and other requests, provide customer service, send contract information and deliver important notifications relating to products and services.

4.7 Marketing, customer surveys and product improvement

Where legally permitted and, where required, on the basis of your consent, we process personal data in order to contact you regarding our own offers, customer benefits, promotions, services and customer surveys, to evaluate usage behaviour and to improve our products, services and processes.

4.8 Competitions, additional services and brokered third-party services

If you participate in competitions or obtain additional or brokered services, we process the data required for this in order to administer participation, identify winners, deliver prizes, and provide additional services or brokered third-party offers.

4.9 Chat and AI-supported functions

If you use chat or AI-supported functions, we process your inputs and technical usage data in order to answer your inquiry, provide support, support digital advisory processes and prevent misuse. We make it recognisable when you interact with such a function.

4.10 Legal and regulatory obligations

We process personal data insofar as this is necessary to comply with legal obligations, regulatory requirements, court or official orders, as well as obligations under telecommunications and data protection law.

5. On what basis we process personal data

Where individual processing activities require a justification, we rely in particular on:

• the initiation, conclusion and performance of contracts,
• your consent,
• overriding private or public interests, in particular in the secure, efficient and economic provision of services, in combating misuse, quality assurance, product improvement and legal enforcement, as well as
• legal obligations or official orders.

6. Profiling and automated individual decisions

We may evaluate personal data by automated means, in particular for credit checks, online verification, fraud and misuse prevention, offer optimisation, marketing personalisation, as well as for the preparation of contract decisions.

Where a decision is made exclusively by automated means and has a legal effect on you or causes you a significant disadvantage, we will inform you accordingly. In this case, you have the right to state your point of view and to request that the decision be reviewed by a natural person. For such a review, you may contact us at data.ch@mtel.ch

This does not apply where a statutory exception applies, in particular where your request is fully granted in direct connection with a contract or where you have expressly consented to the automated decision.

7. To whom we disclose personal data

We may disclose personal data to employees and group companies as well as to external recipients, insofar as this is necessary for the stated purposes. These include in particular:

• IT, hosting, cloud, customer service, communication, chat, AI, printing, postal, logistics, repair, payment, identification, verification, fraud, marketing, analytics and support service providers,
• telecommunications, roaming, content and platform partners,
• sales partners, banks and payment service providers,
• credit agencies and verification service providers,
• debt collection service providers,
• insurance and device protection partners,
• lawyers, auditors, authorities and courts.

Where third-party providers render their own services directly to you or where such services are brokered, they may process personal data under their own responsibility. In such cases, their own privacy policies shall additionally apply.

8. Disclosure abroad

We may also process personal data abroad or have it processed abroad, insofar as this is necessary for the stated purposes, in particular in connection with group services, IT and support services, telecommunications and roaming relationships, content and platform services, chat/AI functions, international connections or the use of third-party services.

Group companies of the Telekom Serbia Group in Austria, Serbia, Bosnia & Herzegovina and Montenegro:

• MTEL Austria GmbH, Am Euro Platz 2, 1120 Wien, Austria
• MTEL Global DOO Beograd, Bulevar Franse d´Eperea 88, 11000 Belgrad, Serbia
• Telekom Srbija a.d., Takovska 2, 11000 Belgrad, Serbia
• mts sistemi i integracije d.o.o., Bulevar Milutina Milankovića 11g 11000 Beograd, Serbia
• Logate d.o.o, Vojislavljevića bb, Dahna, Poslovni centar "Knjaz", 81000 Podgorica, Montenegro
• YUnet International d.o.o., Dubrovačka 35, 11000 Beograd, Serbia
• m:tel, Telekomunikacije Republike Srpske a.d., Vuka Karadzica 2, 78000 Banja Luka, Bosnia
• LOGOSOFT d.o.o, Grbavička 4, 71000 Sarajevo, Bosnia

In order to ensure an adequate level of data protection, we have concluded an intra-group data processing agreement with the group companies in Serbia, Bosnia & Herzegovina and Montenegro. We will be pleased to inform you about these existing safeguards.

Where disclosure is made to a state with an adequate level of data protection, we rely on the relevant adequacy decision. Where disclosure is made to a state without an adequate level of data protection, we implement appropriate safeguards, in particular standard contractual clauses, or rely on a statutory exception. For certified U.S. companies, we may rely on the Swiss-U.S. Data Privacy Framework.

In all other respects, your personal data is processed in third countries where this is necessary for the performance of the contract, for example for the provision of telecommunications services such as calls to third countries or roaming connections, where you have consented or where there is a legal obligation.

9. How long we retain personal data

We retain personal data only as long as this is necessary for the respective purposes, for legal obligations, for the safeguarding of legitimate interests, or for the assertion or defence of claims. Thereafter, data is deleted, anonymised or blocked.

The following principles apply in particular:

• We generally retain contract, invoice, accounting and correspondence data for up to 10 years, unless legal or procedural reasons justify longer retention.
• We generally retain data from credit assessments for up to 1 year.
• We regularly retain call recordings for 6 months.
• Copies of identification documents created exclusively for legally required identification are retained only as long as necessary for service provision or legal obligations.
• We retain traffic and service-specific usage data only as long as necessary for service provision, billing, misuse prevention, legal enforcement or legal obligations.
• We process the verification confirmation resulting from the online verification process, as well as image and video elements, only as long as necessary for service provision or for the fulfilment of legal obligations.

10. Your settings and rights

You can make certain settings concerning the processing of your personal data yourself. In MyMTEL Seflcare, you can in particular determine whether we may contact you for marketing purposes and customer surveys via telephone, post, SMS, e-mail or social networks. A separate setting is available for each of these contact channels. You can adjust your consents and withdrawals there at any time with effect for the future. These settings do not apply to contract-related service, security, billing or fault notifications.

Irrespective of this, subject to applicable law, you have in particular the following rights:

• information as to whether and which personal data we process about you,
• rectification of incorrect or incomplete personal data,
• deletion, destruction or cessation of unlawful processing within the legal framework,
• provision or transfer of your personal data in a common electronic format where the legal requirements are met,
• withdrawal of consent granted with effect for the future,
• objection to direct marketing,
• stating your point of view and requesting a human review in the case of automated individual decisions.

To exercise your rights, you may contact us at data.ch@mtel.ch or in writing at the address stated above. We may require appropriate proof of identity in order to process your request.

Information is generally provided free of charge and, as a rule, within 30 days. Only where a request causes disproportionate effort may MTEL Switzerland charge an appropriate cost contribution based on the effort involved, up to a maximum of CHF 299. We will inform you of any such cost contribution before providing the information. You may withdraw your request within 10 days after this notification.

If you are of the opinion that the processing of your personal data violates Swiss data protection law, you may contact the Federal Data Protection and Information Commissioner (FDPIC).

11. Cookies and similar technologies

When you visit our website, we use cookies and similar technologies. In doing so, we distinguish in particular between technically necessary cookies and analytics and marketing technologies. Further information on the types, purposes, providers, settings and withdrawal options can be found in our separate Cookie Notice. Where legally required, we obtain your consent for the use of certain technologies. Otherwise, we transparently inform you about their use and give you the option to make settings or object to the processing.

12. Special information on interaction, voice, chat, AI and image data

We record hotline calls only if you consent to the recording. You may decline the recording.

Sales calls for the telephone conclusion of mobile, OTT TV or broadband internet subscriptions may be recorded after prior notice. Such recordings serve the purposes of contract documentation and evidence.

Recordings are not transcribed and are not used for training AI or speech systems.

Image and video elements from online verification processes are processed by MTEL itself and archived after completion of the verification process.

13. Location data

In this context, MTEL does not process location data from the mobile network and does not process GPS, Bluetooth or WLAN-based location data for marketing, movement or people-flow analyses. We process location data exclusively in the form of Geo-IP-based location information, in particular in order to provide content in the appropriate language or country version, to implement geoblocking and licence-related usage restrictions, to ensure the security of our online offerings, and to prevent misuse and fraud.

14. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, unintended disclosure or unlawful processing. These include in particular access restrictions, logging, encryption, backup copies, internal instructions, training, as well as contractual protection and confidentiality obligations vis-à-vis engaged service providers.

15. Changes to this Privacy Policy

We may amend this Privacy Policy at any time, in particular if we change our services, processing activities, recipients, technical processes or legal requirements. The version currently published on our website shall apply.