General Terms and Conditions and
Order Processing Agreement

  1. Scope
    • 1.1 These General Terms and Conditions (hereinafter the GTC) and the Order Processing Agreement (hereinafter the OPA) are valid as of January 17, 2022 and replace all previous versions.
    • 1.2 Together with the confirmed offer and any other contractual documents, these GTC and the OPA constitute the final agreement (hereinafter Agreement) between the Customer and Force8 Ltd (hereinafter Force8). These GTC and OPA are an integral part of all offers, order confirmations and invoices.
    • 1.3 These GTC and OPA shall apply exclusively. General terms and conditions of business or purchase or the customer’s own order processing contracts shall not apply. Counter-confirmations of the customer with reference to his own terms and conditions are expressly contradicted.
  2. General content of the agreement
    • 2.1 These GTC apply to the use of the Force8 Coach and My Swiss-Ski software in accordance with the current product description as “Software as a Service” (SaaS), hereinafter the Software. The Software is operated by Force8 as a SaaS solution. The Customer is enabled to use the Software stored and running on the servers of Force8 or a service provider commissioned by Force8 via an Internet connection for its own purposes during the term of this Agreement and to store and process its data with its help.
    • 2.2 Presentations, statements and the like shall only be binding upon their legally valid signature. In the case of other work results, the binding nature shall only be given if this is expressly recorded in writing. Interim reports and preliminary work results may deviate considerably from the final result and are not binding.
    • 2.3 To the extent that individual employees are named in the Agreement, Force8 shall use reasonable efforts to ensure that such named individuals are available to the Customer to support Force8’s Work during the anticipated period specified in the Agreement. Force8 shall have the right to replace individual employees. Force8 may use suitable third parties to perform its services.
    • 2.4 Deadlines shall be deemed to be general targets unless they have been expressly agreed as binding assurances.
  3. Order placement
    • 3.1 An order shall be deemed to have been placed when:
      • the customer accepts an offer,
      • a written order confirmation is available,
      • there is a verbal order confirmation or it is clear from the circumstances that the customer is willing to purchase the service or product in question,
      • or a quotation is available and Force8 has commenced work with the knowledge and consent of the customer.
    • 3.2 In the case of framework offers, the order shall also be deemed to have been placed if the further procedure is regulated in separate plans (e.g. project plans). The dates, working days or resources reserved in accordance with such plans shall be deemed to have been commissioned as part of the framework offer.
  4. Cooperation and obligations of the customer
    • 4.1 The Customer shall provide Force8 with reasonable support in the performance of the contractual services.
    • 4.2 For the use of the software, the system requirements resulting from the product description or the order sheet must be met by the customer. The customer is responsible for this.
    • 4.3 The Customer must keep the access data provided to it secret and ensure that any employees to whom access data is provided do likewise. The Service of Force8 may not be made available to third parties unless this has been expressly agreed by the Parties.
    • 4.4 The Customer undertakes not to entice away any employees of Force8 in any form whatsoever. This non-solicitation clause shall apply for the duration of the contractual relationship between Force8 and the Customer and until one year after its termination. In the event of a breach of this non-solicitation clause, the customer undertakes to pay a contractual penalty in the amount of CHF 20,000. Payment of the contractual penalty does not release the customer from the non-solicitation clause. We reserve the right to claim further damages.
  5. Type and scope of service
    • 5.1 Force8 shall make the Software available to the Customer for use in the respective agreed version at the router output of the data center in which the server with the Software is located (transfer point). The software, the computing power required for use, and the required storage and data processing space are provided by Force8. Force8 is not responsible for establishing and maintaining the data connection between the Customer’s IT systems and the transfer point described.
    • 5.2 The customer may not use the services in an abusive manner. The use takes place exclusively within the legal framework. Force8 reserves the right to suspend or delete access in the event of suspected misuse.
    • 5.3 In connection with the use of the Services, Force8 may send service announcements, administrative messages and other information. Force8 may contact the Customer through any channels.
    • 5.4 The customer is obliged to keep passwords confidential. The user is responsible for activities in the user account. Users may not reuse passwords used at Force8 Coach in third party applications.
    • 5.5. Force8 may add new features, remove features, suspend modules, or permanently discontinue its Force8 Coach software.
  6. Software availability
    • 6.1 Force8 draws the Customer’s attention to the fact that restrictions or impairments of the Software may arise that are beyond Force8’s control. This includes, in particular, actions by third parties not acting on behalf of Force8, technical conditions of the Internet that cannot be influenced by Force8, and force majeure. The hardware, software, and technical infrastructure used by the customer may also have an influence on Force8’s services. Insofar as such circumstances have an influence on the availability or functionality of the services provided by Force8, this has no effect on the contractual compliance of the services provided.
    • 6.2 Customer may report functional failures, malfunctions or impairments of the Software to info@force8.coach.
  7. Support
    • 7.1 A support case exists if the software does not fulfill the contractual functions according to the product description. 
    • 7.2 If the customer reports a support case, he shall provide as detailed a description as possible of the respective malfunction in order to enable the most efficient troubleshooting possible.
    • 7.3 The parties may enter into a separate agreement on the provision of support, maintenance and servicing services.
  8. Remuneration
    • 8.1 The Customer owes Force8 the monthly license fees according to the offer.
    • 8.2 In addition to the license fees, Force8 is entitled to reimbursement for out-of-pocket expenses and third-party fees incurred. Travel time will be included in the hours required to provide the Services and will be invoiced.
    • 8.3 Cost estimates are based on estimates of the scope of activities necessarily incurred and are prepared on the basis of data provided by the customer. Therefore, they are not binding for the final calculation of the fee.
    • 8.4 All prices are exclusive of value added tax and other taxes.
    • 8.5 All invoices are payable within 30 days to the account specified by Force8. If payment is not received on time, Force8 has the right to immediately discontinue contractually guaranteed services or to deviate from the service level. This right includes the blocking of online access. Furthermore, in this case Force8 has the unilateral right to terminate the agreement without notice and extraordinarily.
    • 8.6 In the event of termination of the Agreement, the Customer shall pay Force8 for all Services provided up to the date of termination. In the event of an extraordinary termination by the Customer, the Customer shall pay all additional costs incurred by Force8 due to the early termination of the Service.
    • 8.7 Regardless of the reason for termination of the Agreement, the Customer shall bear all costs for the return of the data. Force8 will charge the prices defined in the Agreement for Services requested by the Customer beyond the Termination Date.
  9. Secrecy
    • 9.1 The parties undertake to maintain secrecy about all confidential information of which they become aware on the occasion of or in connection with the receipt or provision of services within the framework of the execution of the contractual relationship. All data concerning facts, methods and knowledge shall be deemed to be confidential, with the exception of data which is
      • are or become generally available to the public, not resulting from a breach of any obligation under this Section 9;
      • acquired from a third party without an obligation of confidentiality;
      • Are or were independently created by the recipient of the confidential information or were known to him or her prior to receipt; or
      • are generally known or can be easily determined by third parties with general knowledge.
    • 9.2 An exception to this is the disclosure of confidential information for the necessary protection of justified own interests, insofar as the respective third parties are subject to an equivalent obligation of confidentiality.
    • 9.3 Force8 is further entitled to disclose confidential information to a third party if this is necessary for the provision of the service. Force8 may process the information of which it becomes aware, in particular also the personal data of the customers, using IT technology or have it processed by third parties. This also makes the information accessible to persons who perform system support and control functions as part of the processing process. Force8 shall ensure that the relevant persons are also subject to the obligation to maintain confidentiality.
    • 9.4 Force8 explicitly points out that no sensitive personal data should be sent to it by the Customer via unencrypted methods. This applies in particular, but not exclusively, to athlete lists or athlete dossiers. 
    • 9.5 The obligation to maintain confidentiality shall survive the termination of the contractual relationship. The foregoing obligation shall not prevent Force8 from executing the same or similar orders for other customers while maintaining confidentiality.
    • 9.6 The parties may use electronic media such as telephone, fax, websites and e-mail for their communication in the course of the contractual relationship. During electronic transmission, data may be intercepted, destroyed, manipulated or otherwise adversely affected and may be lost for other reasons and arrive late or incomplete. Each party must therefore take appropriate precautions on its own responsibility to ensure error-free transmission or receipt, as well as the detection of elements that are defective in terms of content or technology. The customer acknowledges that absolute protection is not possible.
  10. Property rights and rights of use
    • 10.1 All property rights such as intellectual property rights and licensing rights to the software as well as to the documents, products or other work results produced by Force8 within the scope of the execution of the contractual relationship as well as the know-how developed or used in the process are the exclusive property of Force8, regardless of any cooperation between Force8 and the customer.
    • 10.2 The Customer grants Force8 a spatially and temporally unlimited, irrevocable, non-exclusive, royalty-free right, transferable to third parties, to exploit the Content posted on the Platform. Personal data is excluded from the exploitation. Should Content containing personal data be exploited, such Content would be anonymized. Force8 is entitled to use, edit and exploit the Content at any time. This includes, in particular, the right of reproduction, the right of distribution, and the right of public reproduction, especially the right of public access. The customer waives the right to name the author.
    • 10.3 Force8 grants the customer in each case a non-exclusive and non-transferable right of use for the customer’s own exclusive use for the term of the contract to the software as well as to the documents, products and other work results provided to the customer, including the respective associated know-how.
    • 10.4 The customer is not entitled to reproduce, modify, distribute, sell or rent any part of the software. The software may not be reverse engineered nor may any attempt be made to extract the source code.
    • 10.5 The Customer may only pass on documents, products and other work results or parts thereof as well as individual technical statements to third parties with the express written consent of Force8.
    • 10.6 The Customer shall refrain from modifying the documents provided to it by Force8, in particular the binding reporting. The same applies to products and other work results insofar as their purpose is not precisely to be further processed by the customer.
    • 10.7 Permission to make reference to the existing contractual relationship between the parties, in particular in the context of advertising or as a reference, is hereby granted in full. For this purpose, images of the customer’s company logo may also be used on the Internet, in company presentations, brochures, advertisements, etc.
  11. Warranty and liability
    • 11.1 Force8 disclaims all warranties of merchantability and title in the Software and in any documents, products or other work product created in the performance of the contractual relationship. Force8 expressly disclaims all warranties of any kind, statutory or otherwise, including but not limited to the warranties of merchantability, fitness for a particular purpose.
    • 11.2 Force8 does not warrant that the functions performed by the Website or the Service will be uninterrupted, timely, secure, or error-free, or that defects in the Website or the Service will be corrected.
    • 11.3 Force8 does not guarantee the results that may be obtained from the use of the Software.
    • 11.4 Force8 does not warrant the accuracy or completeness of the Software and its contents or the correction of any errors in the contents. The Software and its contents are provided “as is” and “as available” only.
    • 11.5 Force8’s liability for all types of damages, including direct and indirect damages, direct and indirect damages, and consequential damages (including lost profits) arising from or in connection with the operation of the Software or with the documents, products, or other work results produced in the course of the execution of the contractual relationship is excluded. In particular, Force8’s liability for damages is excluded:
      • as a result of disruptions in the communications networks, such as transmission errors, technical defects in the network infrastructure, disruptions in the Internet, unlawful interference with the communications networks or overloading of the communications networks; 
      • as a result of malfunctions or interruptions in the terminal equipment (computer or smartphone) of the removal company;
      • as a result of malfunctions or interruptions of the Internet Platform or the unavailability of the Internet Platform, provided that Force8 has exercised the usual care;
      • As a result of hacker attacks, cyber attacks, computer viruses or other malicious software; and
      • as a result of force majeure events or events beyond the control of Force8, improper use of the Internet Platform or external environmental influences.
    • 11.6 If applicable law does not permit the exclusion or limitation of liability to the extent set forth above, some of the above limitations may not apply. In this case, Force8’s liability is limited and the warranty is excluded to the fullest extent permitted by applicable law.
  12. Duration of the agreement
    • 12.1 The agreement is valid from the start date specified in the agreement or, if no start date has been defined, from the date of signing the agreement by both parties.
    • 12.2 Unless otherwise agreed in individual cases, the licenses are concluded for a period of 12 months. The invoice is always issued annually in advance. If the customer does not cancel the license no later than 60 days before the expiration of the license period, the license is automatically extended for another 12 months.
    • 12.3 If the Customer violates any provision of the Agreement, Force8 may immediately suspend or terminate the Services.
    • 12.4 Both parties reserve the right to extraordinary termination for good cause if the legal requirements are met. An important reason for Force8 exists in particular if the customer is more than two months in arrears with the payment of a due remuneration despite a reminder. If the customer is responsible for the reason for termination, the customer is obligated to pay Force8 the agreed remuneration less the expenses saved by Force8 until the date on which the contract would end at the earliest in the event of ordinary termination.
    • 12.5 Declarations of termination must be made in text form to be effective. Compliance with this form is a prerequisite for the effectiveness of the termination.
  13. General
    • 13.1 Except for Customer’s obligation to pay for the Services provided, neither party shall be responsible for any failure to perform any obligation under this Agreement for reasons beyond its reasonable control.
    • 13.2 If any provisions of the Agreement are invalid in whole or in part, such provisions shall be excluded from this Agreement. However, this shall not affect the enforceability of the remaining provisions of this Agreement.
    • 13.3 Force8 is entitled to provide services for other customers.
    • 13.4 Force8 may amend these GTC at any time. The customer should therefore review these GTC regularly.
    • 13.5 Notifications must be made in text form.
    • 13.6 The agreement is subject to Swiss law.
    • 13.7 The courts of Zurich, Canton of Zurich, Switzerland, shall have exclusive jurisdiction over any dispute arising out of the Agreement.

Appendix 1
Order Processing Agreement (OPA) according to Art. 28 para. 3 GDPR

  1. Subject and duration of processing
    • 1.1 The object of the commissioned processing is the operation of the Force8 Coach software (an athlete and team management system) in the sense of a software-as-a-service for the Customer by Force8 Ltd (hereinafter Force8). In doing so, Force8 processes personal data for the Customer within the meaning of Art. 4 No. 2 and Art. 28 GDPR on the basis of this Agreement.
    • 1.2 The contractually agreed service is provided exclusively in a member state of the European Union, in a contracting state of the Agreement on the European Economic Area or in Switzerland. According to the decision of the European Commission, Switzerland has an adequate level of data protection within the meaning of Art. 45 (1) GDPR in conjunction with Art. 45 (6) GDPR.
    • 1.3 The contract and the data processing shall commence upon the effective date of the contract. The contract or data processing is concluded or continued for an indefinite period.
    • 1.4 If the data processing is subject to Swiss data protection law, references to the GDPR in this Agreement shall also be deemed references to the corresponding provisions of Swiss data protection law.
  2. Nature and purpose of the processing, type of personal data and categories of data subjects
    • 2.1 The type of processing of personal data consists of the following activities (according to the definition of Art. 4 No. 2 GDPR): collecting, recording, organizing, arranging, storing, adapting or modifying, reading out, querying, using, disclosing by transmission, comparing, restricting, deleting and destroying.
    • 2.2 The following type of personal data (according to the definition of Art. 4 No. 1, 13, 14 and 15 GDPR2) are affected by the processing:
      • Basic data: Name, address, phone number, e-mail, date of birth, performance level, status (fit, injured, sick, suspended, excused, army), teams, training groups, (social) insurance data, bank details.
      • Trainings: training planning, attendance/absence monitoring, training statistics, training analysis, training feedback, training journal
      • Competition: competition planning, competition statistics, competition analysis
      • Tests: standardized and individual tests, test statistics, test analyses
      • Ratings: Individual assessments, assessment statistics, assessment analysis.
      • Ratings: individual ratings, rating statistics, rating analyses
      • Questionnaires: Standardized and individual questionnaires, questionnaire statistics, questionnaire analyses
      • Conversations: individual conversation recording, conversation statistics, conversation analysis
      • Videos: Sharing training and/or competition videos, instructional videos.
      • Academy: Sharing files for continuing education
      • GPS: GPS data (via sensor), GPS statistics, GPS analyses 
      • Fitness trackers: sports watches or heart rate monitors data (such as Polar, Suunto, Garmin), fitness statistics, fitness analysis.
      • Medical Data: Physician name, insurance details, allergies, blood type, intolerances, congenital diseases, injuries (past and present), surgeries (past or planned), under medical treatment, pain (chronic), daily values (sleep duration and quality, state of mind, health report), SPU report, medical interviews, medical certificates, laboratory results, medical reports.
    • 2.3 The following categories of data subjects (according to the definition of Art. 4 No. 1 GDPR) are affected by the processing: 
      • Administrators
      • Coaches, Team Managers and Instructors
      • Athletes, employees
      • Staff (Supervisor)
      • Helper
  3. Rights and duties as well as powers of instruction of the customer
    • 3.1 The customer alone is responsible for assessing the permissibility of the processing pursuant to Art. 6 (1) GDPR and for safeguarding the rights of the data subjects pursuant to Art. 12 to 22 GDPR. Nevertheless, Force8 is obligated to immediately forward all such requests to the customer, provided they are recognizably directed exclusively to the customer. 
    • 3.2 Changes to the subject matter of the Processing and process changes shall be mutually agreed upon between the Customer and Force8 and shall be set forth in writing or in a documented electronic format. The customer shall generally issue all orders, partial orders and instructions in writing or in a documented electronic format. Verbal instructions must be confirmed immediately in writing or in a documented electronic format and are not valid without such documentation. 
    • 3.3 The Customer is obligated to treat all knowledge of Force8’s trade secrets and data security measures obtained within the scope of the contractual relationship as confidential. This obligation shall remain in force even after termination of this contract.
  4. Instructions
    • 4.1 Communication channels to be used for instruction: E-mail
    • 4.2 In the event of a change or long-term prevention of the contact persons, the contract partner must be informed immediately and in writing or electronically of the successors or the representatives.
    • 4.3 Force8 will immediately notify the Customer if, in its opinion, an instruction issued by the Customer violates statutory provisions (Art. 28 (3) sentence 3 GDPR). Force8 is entitled to suspend the implementation of the corresponding instruction until it is confirmed or changed by the Responsible Party at the Customer after review. 
  5. Duties of Force8
    • 5.1 Force8 processes Personal Data exclusively within the framework of the agreements made and in accordance with the Customer’s instructions, unless it is required to do so by the law of the European Union or the Member States to which Force8 is subject (e.g. investigations by law enforcement or state protection authorities). In such a case, Force8 shall notify the Controller of such legal requirements prior to the processing, unless the relevant law prohibits such notification due to an important public interest (Article 28 (3) sentence 2 (a) GDPR).
    • 5.2 Force8 does not use the personal data provided for processing for any other purposes, in particular for its own purposes.
    • 5.3 Force8 assures that it will familiarize the employees engaged in the performance of the work with the provisions of data protection applicable to them before they commence their activities and that they will be bound to secrecy in an appropriate manner for the duration of their activities as well as after termination of the employment relationship (Art. 28 (3) sentence 2 letter b and Art. 29 GDPR). Force8 may only provide information about personal data from the contractual relationship to third parties or the data subject after prior instruction or consent by the customer.
    • 5.4 Force8 shall cooperate to the necessary extent in the Customer’s compliance with the rights of data subjects pursuant to Articles 12 to 22 of the GDPR, in the creation of directories of processing activities, and in any necessary data protection impact assessments of the Customer, and shall provide the Customer with appropriate support to the extent possible (Article 28 (3) sentence 2 letters e and f of the GDPR). Such support services on the part of Force8 are subject to a charge and all costs and expenses shall be borne by the customer.
    • 5.5 Force8 shall notify the Customer without undue delay of any violations of the protection of personal data pursuant to Art. 33 (2) GDPR.
    • 5.6 Upon termination of the present Agreement, Force8 shall delete or destroy/have destroyed all personal data in its possession and in the possession of subcontractors that are related to the contractual relationship in accordance with data protection requirements (Article 28 (3) sentence 2 letter g GDPR).
    • 5.7 Force8 shall provide the Customer with all reasonably necessary information to demonstrate compliance with the obligations set forth in Art. 28 DS-GVO (Art. 28 para. 3 sentence 2 letter h GDPR). 
    • 5.8 Force8 agrees that the Customer is entitled, by appointment and with two months’ notice, to monitor compliance with the provisions on data protection and data security as well as the contractual agreements to a reasonable and necessary extent itself or through third parties commissioned by the Customer, in particular by obtaining information and inspecting the stored data and the data processing programs as well as through on-site reviews and inspections (Article 28 (3) sentence 2 letter h GDPR).
  6. Technical and organizational measures
    • 6.1 A level of protection appropriate to the risk to the rights and freedoms of the natural persons concerned by the processing is ensured for the specific commissioned processing (Art. 28 (3) sentence 2 letter d GDPR). To this end, the protection objectives of Art. 32 (1) GDPR are taken into account with regard to the nature, scope, circumstances and purpose of the processing operations in such a way that the risk is permanently contained by means of appropriate technical and organizational remedies.
    • 6.2 The data protection concept described in Appendix2 – Technical and Organizational Measures presents the selection of technical and organizational measures appropriate to the identified risk, taking into account the state of the art protection goals.
    • 6.3 Decisions on the organization of data processing and on the procedures used that are significant for security must be coordinated between Force8 and the Customer. 
    • 6.4 The measures at Force8 can be adapted to technical and organizational developments in the course of the contractual relationship, but must not fall below the agreed standards. 
    • 6.5 Force8 must coordinate significant changes with the customer in documented form (in writing, electronically). 
  7. Subcontracting relationships with subcontractors 
    • 7.1 Force8 is only permitted to engage subcontractors to process the Customer’s data with the Customer’s consent (Art. 28 (2) GDPR). Force8 will always inform the Customer of any intended change with regard to the involvement of new or the replacement of existing subcontractors, which gives the Customer the opportunity to object to such changes
    • 7.2 Subcontractors may only be engaged in third countries if the special requirements of Art. 44 et seq. GDPR are met (e.g., adequacy decision of the Commission, standard data protection clauses, approved codes of conduct).
    • 7.3 Force8 must contractually ensure that the agreed provisions between the Customer and Force8 also apply to subcontractors. The contract with the subcontractor must be drawn up in writing, which may also be in an electronic format (Art. 28 (4) and (9) GDPR).
    • 7.4 The Customer hereby authorizes the involvement of Binary Tailors – Design e Web Lda, Rua Brito Pais No 8 5 Esq, 1495-028 Algés, Portugal as subcontractor and subprocessor. This subcontractor develops, maintains and operates the Force8 Coach software on behalf of Force8.

Appendix 2
Technical and organizational measures

1 Technical measures
The software is hosted by the Portuguese company PTISP. Therefore, their legal documents apply: https://ptisp.pt/company/legal

2 Organizational measures
The data protection measures taken by Force8 have the goal of ensuring data availability, integrity, confidentiality, non-concatenation by purpose, transparency by auditability, and intervenability by anchor points.

Our data security measures have the goal of a permanent, high resilience of our systems and services with regard to the associated data processing. We ensure the ability to quickly restore the availability of and access to personal data in the event of a physical or technical incident. Furthermore, we use a procedure to regularly review, assess and evaluate the effectiveness of the technical and organizational measures to ensure the security of the processing. Furthermore, the Controller as well as the Processor take steps to ensure that natural persons under their authority who have access to personal data only process it on the instructions of the Controller, unless they are required to process it under European Union or Member State law.

Force8’s business processes are based on the requirements of Article 32 of the General Data Protection Regulation (GDPR).

2.1 Protection against unauthorized access to employee and customer data as well as other personal data requiring protection.

Force8 assures that unauthorized persons are prevented from using the data processing systems by the following measures: 

  • Password protection: passwords with min. 8 characters incl. one special character 
  • Personal and individual user log-in when logging in to the system or Company network
  • One user master record per user
  • IP-restricted access to server
  • Authorization concept for digital access

The confidentiality and integrity measures taken at the company ensure that those authorized to use a data processing system can only access the data subject to their access authorization. In addition, it is ensured that personal data cannot be read, copied, modified or removed without authorization during processing, use and after storage.

Force8’s business processes are supported by the measures listed below:

  • Differentiated and task-related authorizations, profiles
  • Regular review of log files
  • Commitment of all employees to data privacy and telecommunications secrecy.

The measures taken in the company ensure sufficient forwarding control. Personal data is not read, copied, modified or removed without authorization during electronic transmission or during its transport or storage on data media, without being able to be checked, detected and prevented.

Force8 hereby assures that, beyond the exceptional cases provided for by law, no data will be disclosed to third parties. The measures taken to achieve this goal are listed below:

  • 256 bit SSL encryption
  • there are regulations for data destruction and deletion (deletion concept)

The measures taken in the company ensure a high level of protection in the area of order control. Personal data processed on behalf of the customer are processed only in accordance with the customer’s instructions. This is supported by the following measures:

  • Written contract (incl. terms of use) for commissioned processing according to Art. 28 DS-GVO with regulations on the rights and obligations of Force8 and the customer
  • formalized ordering

The separation control measures taken within the company also ensure that personal data collected for different purposes can also be processed separately.