Data privacy
With this Privacy Policy, we inform you about the processing of personal data in connection with our activities and operations, including our website under the domain name devedis.ch. In particular, we explain what personal data we process, why, how, and where. We also inform you about the rights of individuals whose data we process.
For individual or additional activities and operations, we may publish further privacy policies or other information on data protection.
1. Contact Addresses
Responsibility for the processing of personal data:
devedis AG
Länggassstrasse 7
3012 Bern
In individual cases, third parties may be responsible for the processing of personal data, or there may be joint responsibility with third parties.
2. Terms and Legal Bases
2.1 Terms
Data subject: A natural person about whom we process personal data.
Personal data: All information that relates to an identified or identifiable natural person.
Particularly sensitive personal data: Data on trade union, political, religious or ideological views and activities, data on health, the intimate sphere or affiliation with an ethnic group or race, genetic data, biometric data that uniquely identify a natural person, data on criminal and administrative sanctions or prosecutions, and data on measures of social assistance.
Processing: Any handling of personal data, regardless of the means and procedures applied, for example querying, matching, adapting, archiving, retaining, reading, disclosing, obtaining, recording, collecting, deleting, disclosing, ordering, organizing, storing, altering, distributing, linking, destroying and using personal data.
2.2 Legal Bases
We process personal data in accordance with Swiss data protection law, in particular the Swiss Federal Act on Data Protection (Data Protection Act, FADP) and the Data Protection Ordinance (Data Protection Ordinance, DPO).
3. Nature, Scope and Purpose of the Processing of Personal Data
We process those personal data that are necessary to carry out our activities and operations on a lasting, user-friendly, secure and reliable basis. The processed personal data may in particular fall into the categories of browser and device data, content data, communication data, metadata, usage data, master data including inventory and contact data, location data, transaction data, contract data and payment data.
We also process personal data that we receive from third parties, obtain from publicly accessible sources, or collect in the course of our activities and operations, insofar as such processing is permitted for legal reasons.
We process personal data, where necessary, with the consent of the data subjects. In many cases, we may process personal data without consent, for example to fulfill legal obligations or to safeguard overriding interests. We may also ask data subjects for their consent even where their consent is not required.
We process personal data for the period required for the respective purpose. We anonymize or delete personal data in particular depending on statutory retention and limitation periods.
4. Disclosure of Personal Data
We may disclose personal data to third parties, have it processed by third parties, or process it jointly with third parties. Such third parties are, in particular, specialized providers whose services we use.
For example, we may disclose personal data to banks and other financial service providers, authorities, educational and research institutions, advisors and lawyers, interest groups, IT service providers, cooperation partners, credit and commercial information agencies, logistics and shipping companies, marketing and advertising agencies, media, organizations and associations, social institutions, telecommunications companies, and insurance companies.
5. Communication
We process personal data in order to be able to communicate with third parties. In this context, we process in particular data that a data subject submits when contacting us, for example by postal mail or email. We may store such data in an address book or with comparable tools.
Third parties who transmit data about other persons are obliged to ensure data protection vis-à-vis such data subjects. This includes, among other things, ensuring the accuracy of the transmitted personal data.
We use selected services from suitable providers in order to communicate better with third parties.
In particular, we use:
Close: Customer Relationship Management (CRM); provider: Close (Elastic Inc., USA); information on data protection: Privacy Policy.
6. Applications
We process personal data about applicants insofar as it is necessary for assessing suitability for employment or for the subsequent performance of an employment contract. The required personal data result in particular from the information requested, for example in the context of a job advertisement. We may publish job advertisements with the help of suitable third parties, for example in electronic and printed media or on job portals and recruitment platforms.
We also process personal data that applicants voluntarily share or publish, in particular as part of cover letters, CVs and other application documents as well as online profiles.
We may allow applicants to store their information in our talent pool so that we can consider them for future open positions. We may also use such information to maintain contact and to inform them of news. If we believe that an applicant is suitable for an open position based on the information provided, we may inform the applicant accordingly.
Application documents are kept for as long as necessary for the respective purpose. Unsuccessful applications are deleted after the end of the application process, unless the applicant has consented to longer retention (in particular for our talent pool).
7. Data Security
We take appropriate technical and organizational measures to ensure data security appropriate to the respective risk. With our measures we ensure in particular the confidentiality, availability, traceability and integrity of the processed personal data, without, however, being able to guarantee absolute data security.
Access to our website and our other online presence takes place via transport encryption (SSL / TLS, in particular with the Hypertext Transfer Protocol Secure, abbreviated HTTPS). Most browsers warn when visiting websites without transport encryption.
Our digital communication is subject – as is digital communication in general – to mass surveillance without cause or suspicion by security authorities in Switzerland, in the rest of Europe, in the United States of America (USA) and in other countries. We cannot have any direct influence on the corresponding processing of personal data by intelligence services, police agencies and other security authorities. Nor can we rule out the possibility that a data subject may be subject to targeted surveillance.
8. Personal Data Abroad
As a matter of principle, we process personal data in Switzerland and the European Economic Area. However, we may also disclose or export personal data to other countries, in particular in order to process it there or have it processed there.
We may disclose personal data to all countries and territories on Earth, provided that the law in the respective country, according to a decision of the Swiss Federal Council, ensures an adequate level of data protection.
We may disclose personal data to countries whose law does not ensure an adequate level of data protection, provided that an appropriate level of data protection is ensured for other reasons, in particular on the basis of standard data protection clauses or with other appropriate safeguards. In exceptional cases, we may export personal data to countries without an adequate or appropriate level of data protection if the specific data protection requirements are met, for example the explicit consent of the data subjects or a direct connection with the conclusion or execution of a contract. We are happy to provide data subjects with information about any safeguards on request, or to provide a copy of safeguards.
9. Rights of Data Subjects
9.1 Data Protection Claims
We grant data subjects all rights under applicable data protection law. In particular, data subjects have the following rights:
Access: Data subjects may request information as to whether we process personal data about them and, if so, what personal data is involved. Data subjects also receive the information that is necessary to assert their data protection rights and to ensure transparency. This includes the processed personal data as such, but also, among other things, information on the purpose of processing, the period of storage, any disclosure or export of data to other countries, and the origin of the personal data.
Rectification and restriction: Data subjects may have inaccurate personal data corrected, incomplete data completed, and the processing of their data restricted.
Deletion and objection: Data subjects may have personal data deleted («right to be forgotten») and may object to the processing of their data with effect for the future.
Data release and data portability: Data subjects may request the release of personal data or the transfer of their data to another controller.
We may postpone, restrict or refuse the exercise of the rights of data subjects within the legally permissible scope. We may inform data subjects of any requirements that must be met to exercise their data protection rights. For example, we may refuse access in whole or in part with reference to confidentiality obligations, overriding interests, or the protection of other persons. We may also, for example, refuse the deletion of personal data in whole or in part, in particular with reference to statutory retention obligations.
We may, in exceptional cases, provide for costs for the exercise of rights. We will inform data subjects in advance of any such costs.
We are obliged to identify data subjects who request information or assert other rights using appropriate measures. Data subjects are obliged to cooperate.
9.2 Legal Protection
Data subjects have the right to enforce their data protection rights through legal channels or to file a complaint or report with a data protection supervisory authority.
The data protection supervisory authority for private controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
10. Use of the Website
10.1 Cookies
We may use cookies. Cookies – both our own cookies (first-party cookies) and cookies of third parties whose services we use (third-party cookies) – are data stored in the browser. Such stored data is not necessarily limited to traditional cookies in text form.
Cookies can be stored in the browser temporarily as «session cookies» or for a certain period as so-called persistent cookies. «Session cookies» are automatically deleted when the browser is closed. Persistent cookies have a defined storage period. Cookies make it possible, in particular, to recognize a browser on the next visit to our website and thereby, for example, to measure the reach of our website. However, persistent cookies may also be used, for example, for online marketing.
Cookies can be deactivated and deleted in whole or in part at any time via the browser settings. Without cookies, our website may no longer be fully available. We actively ask – at least where and to the extent required – for explicit consent to the use of cookies.
For cookies used for measuring success and reach or for advertising, a general objection («opt-out») is possible for numerous services via AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).
10.2 Logging
We may log at least the following information for each access to our website and our other online presence, provided that such information is transmitted to our digital infrastructure during such accesses: date and time including time zone, IP address, access status (HTTP status code), operating system including user interface and version, browser including language and version, the specific subpage of our website accessed including the amount of data transferred, the website most recently accessed in the same browser window (referer or referrer).
We log such information, which may also constitute personal data, in log files. The information is necessary to provide our online presence on a lasting, user-friendly and reliable basis. The information is also necessary to ensure data security – including by third parties or with the help of third parties.
10.3 Tracking Pixels
We may embed tracking pixels in our online presence. Tracking pixels are also referred to as web beacons. Tracking pixels – also from third parties whose services we use – are usually small, invisible images or scripts written in JavaScript that are automatically retrieved when our online presence is accessed. Tracking pixels can capture at least the same information as log files.
11. Notifications and Communications
11.1 Measurement of Success and Reach
Notifications and communications may contain web links or tracking pixels that capture whether an individual message has been opened and which web links were clicked. Such web links and tracking pixels can also capture the use of notifications and communications on a personal basis. We need this statistical capture of usage for measuring success and reach in order to send notifications and communications effectively and user-friendly as well as on a lasting, secure and reliable basis, based on the needs and reading habits of the recipients.
11.2 Consent and Objection
As a rule, you must consent to the use of your email address and your other contact addresses, unless the use is permitted for other legal reasons. For obtaining any double-confirmed consent, we may use the «double opt-in» procedure. In that case, you will receive a message with instructions for the double confirmation. We may log obtained consents including IP address and timestamps for evidence and security reasons.
As a rule, you may object to receiving notifications and communications such as newsletters at any time. With such an objection, you can simultaneously object to the statistical capture of usage for measuring success and reach. Necessary notifications and communications in connection with our activities and operations remain reserved.
11.3 Service Providers for Notifications and Communications
We send notifications and communications with the help of specialized service providers.
In particular, we use:
Mailtrap: Transactional email delivery; provider: Railsware Products, Inc. (USA); information on data protection: Privacy Policy.
12. Social Media
We are present on social networks and platforms with our own profiles and pages in order to communicate with interested parties and inform them about our activities and operations. In connection with such profiles and pages, the respective provider of the social network or platform may process personal data – also automatically and regardless of whether a data subject has their own account. Where a data subject holds and is logged into such an account, the provider may directly attribute collected personal data to the account.
We process personal data we receive via the named social networks and platforms within the scope of our communication with the data subjects, as well as for the evaluation of statistical reach and usage information that the respective provider makes available.
We are in particular present on:
LinkedIn: social network; provider: LinkedIn Ireland Unlimited Company (Ireland) and LinkedIn Corporation (USA); information on data protection: Privacy Policy, Cookie Policy.
GitHub: software development platform; provider: GitHub, Inc. (USA); information on data protection: Privacy Statement.
13. Services of Third Parties
We use services of specialized third parties in order to carry out our activities and operations on a lasting, user-friendly, secure and reliable basis. With these services, we can for example integrate functions and content into our website. As part of this integration, the named third parties record, for technically mandatory reasons, at least the IP address of the respective users in order to deliver this content to their browsers. The named third parties also record date and time, including the time zone, as well as further technical information about the respective browser, operating system and immediate referring page.
The named third parties may further use tracking pixels to record and evaluate the data named above – as well as further personal and usage-related data – also across devices and pages, for example for statistical purposes as well as for advertising. The named third parties may process the recorded personal data under their own responsibility in the USA and in other countries.
13.1 Digital Infrastructure
We use services of specialized providers in order to operate our website and our other digital infrastructure.
In particular, we use:
Vercel: hosting of the website and edge network; provider: Vercel Inc. (USA), hosting in the Frankfurt (Germany) data centre; information on data protection: Privacy Policy, Data Processing Addendum.
Google Cloud Storage: storage of media, document and form attachments; provider: Google Ireland Limited (Ireland), Google LLC (USA); information on data protection: Privacy Policy, Cloud Privacy Notice.
Sentry: error and performance monitoring; provider: Functional Software, Inc. dba Sentry (USA); information on data protection: Privacy Policy.
13.2 Automation and Artificial Intelligence
We use services with which inputs from users – for example in a chat window on our website – are processed by means of large language models (LLM) in order to generate answers or classify requests.
In particular, we use:
DeepInfra: hosting and provision of large language models (incl. Google Gemini, Meta Llama); provider: DeepInfra, Inc. (USA); information on data protection: Privacy Policy.
13.3 Scheduling
We use services that allow appointments such as initial calls to be arranged online.
In particular, we use:
Cal.com: scheduling and booking widget; provider: Cal.com, Inc. (USA); information on data protection: Privacy Policy.
13.4 Audio and Video Conferencing
We use services for audio and video conferencing in order to communicate with clients and other third parties.
In particular, we use:
Google Meet: audio and video conferencing; provider: Google Ireland Limited (Ireland), Google LLC (USA); information on data protection: Privacy Policy, «Google Meet Security and Privacy for Users».
Zoom: audio and video conferencing; provider: Zoom Video Communications, Inc. (USA); information on data protection: Privacy Statement.
13.5 Online Collaboration
We use services for collaboration in teams and with third parties, in order to jointly work on documents, tasks and messages.
In particular, we use:
Google Workspace: email, calendar, documents and file storage; provider: Google Ireland Limited (Ireland), Google LLC (USA); information on data protection: Privacy Policy.
Slack: communication in teams and with selected third parties; provider: Slack Technologies Limited (Ireland), Slack Technologies LLC (USA); information on data protection: Privacy Policy, Cookie Policy.
Linear: project and task management; provider: Linear Orbit, Inc. (USA); information on data protection: Privacy Policy.
13.6 Fonts
We integrate fonts into our website. The fonts used are served entirely from our own servers; no transmission of personal data to third parties takes place.
13.7 Advertising
We use services with which we can run advertising, measure its effectiveness, and address potential prospects. Such services in particular record whether users have performed certain actions on our website after clicking on an advertisement (conversion tracking).
In particular, we use:
Google Ads: advertising in Google Search and the Google Display Network, conversion tracking; provider: Google Ireland Limited (Ireland), Google LLC (USA); information on data protection: Privacy & Terms for Advertising.
LinkedIn Ads (Insight Tag): advertising in the LinkedIn network, conversion tracking, website demographics and retargeting; provider: LinkedIn Ireland Unlimited Company (Ireland), LinkedIn Corporation (USA); information on data protection: Privacy Policy, Cookie Policy.
14. Measurement of Success and Reach
We measure the success and reach of our website and our other digital presence in order to be able to evaluate and further develop them. In doing so, we in particular process browser and device data, usage data and metadata. We may use cookies, tracking pixels and similar technologies for this purpose.
We use services that we orchestrate by means of a tag management system. The measurement and analytics services named below are integrated into and controlled on our website via the tag management system.
In particular, we use:
Google Tag Manager: tag management system for managing the measurement and advertising services named below; provider: Google Ireland Limited (Ireland), Google LLC (USA); information on data protection: Privacy Policy for Google Tag Manager.
Mixpanel: product and usage analytics with data processing in the European Economic Area (EU Data Residency, api-eu.mixpanel.com); provider: Mixpanel, Inc. (USA), data processing in the EU; information on data protection: Privacy Policy.
Plausible Analytics: cookieless reach measurement; provider: Plausible Insights OÜ (Estonia, EU); information on data protection: Data Policy.
Google Analytics 4: reach measurement and usage analytics; provider: Google Ireland Limited (Ireland), Google LLC (USA); information on data protection: Privacy Policy for Google Analytics.
15. Concluding Notes on the Privacy Policy
We may update this Privacy Policy at any time. We will inform you about updates in an appropriate form, in particular by publishing the current Privacy Policy on our website.