Data protection and processing (privacy)

This data protection and processing notice for the totalsalary.ch website, the Total Salary software and the customer, supplier and user databases stored and managed by Studiosoft Sagl (hereinafter also “we/us” or “TOTAL SALARY”) informs customers, suppliers and users (hereinafter “you” or “users”) of our services, offers and products (hereinafter “services”) about the collection and processing of their data (personal data as well as non-personal data; hereinafter “data”).

1. Introduction

Below, we inform you, among other things, who is the controller of your data, what data we collect in connection with your use of our services, the purposes for which we process such data and to whom we may forward it. We also inform you of the duration of processing of your data, the legal basis for processing (where one is required), and your rights against us with regard to the processing of your data. This data protection notice applies to all your data already in our possession or that will come into our possession in the future. Please note that this data protection notice may be amended from time to time. The current, updated version published at www.totalsalary.ch applies.

Personal data means any information relating to an identified or identifiable person (hereinafter “personal data”). This includes, in particular, information such as name, address, telephone number, email address and, where applicable, IP addresses and device identifiers. In this data protection notice, the generic term “data” includes non-personal and anonymised data in addition to personal data. Processing means any handling of data, irrespective of the means and procedures used, in particular the collection, storage, use, alteration, disclosure, archiving or erasure of data (hereinafter “processing”). If you provide us with personal data relating to other individuals, please ensure that those individuals are aware of this data protection notice and disclose their data to us only if you are authorised to do so under applicable data protection law.

2. Controller

The controller responsible for data processing under this data protection notice is totalsalary.ch - STUDIOSOFT Sagl of Chiasso, Corso San Gottardo 73, Switzerland. For matters and questions concerning data protection, please contact our data protection service (available at info@studiosoft.ch).

3. Categories of data processed

We collect certain data when you use our services and software and when you contact totalsalary.ch (e.g. when visiting our websites, using one of our mobile apps or another of our digital services, entering into a contract, registering or logging into your user account, or contacting our employees). We generally collect this data directly from you. In certain cases, we may receive data from other people (e.g. if a third party submits a rating or comment about you, if your employer provides us with your contact details, or if a company with which you have a contractual relationship forwards your data to us).

The personal data we process may include the following:

• Data communicated to us when registering for one of our services (e.g. name, contact details, gender, marital status, date of birth, professional title, photograph, relatives, employees, language, payment information, login details, etc.).
• Data concerning offers and contracts entered into (e.g. date, type, content, product, parties, duration, value, contractual amendments, payment information, contact details, contact persons, billing and correspondence addresses, customer feedback, notices of termination, disputes, etc.).
• Data identified or communicated when registered and unregistered users use our services. This includes, among other things, the IP and MAC address or ID of the device used, cookies, pages accessed and search terms entered by users, entries in text fields, bookings, ratings, time and duration of visits, clicks, responses to offers from totalsalary.ch and third parties, referring/exit URLs, information about the time of use, the type of browser and device, the operating system and Internet service provider used, and the volume of data transmitted. This also includes data published or communicated through our services (including any integrated third-party services) (e.g. images, texts, comments, ratings, bookings, videos, etc.). We may link personal data associated with one of our services to data originating from another service.
• Data exchanged during or in connection with contact with us (e.g. communication by letter, telephone, fax, email, text and multimedia messages (SMS/MMS), video messages or instant messaging, responses to communications and offers from totalsalary.ch, preferred communication channels, etc.).
• Data that you or third parties communicate when participating in prize competitions, surveys and similar activities.
• Certain totalsalary.ch services may collect and store location data if the geolocation function of the device used is enabled.
• Data provided to us by third parties with whom we have business relationships (e.g. directory entries, address databases, changes to database entries, creditworthiness data, information about internal company contact persons, etc.).
• Data from public sources (e.g. commercial register entries, other directories, etc.).

The above data is not always personal data. As a rule, we cannot attribute data generated through the use of our services without registration (e.g. through a user account) to individually named persons. In particular cases, however, this may become possible in combination with other data.

To use our services, you may have to provide certain personal data that is necessary or required by law to establish and manage the contractual relationship and to fulfil the related contractual obligations. Without this personal data, we will generally be unable to conclude and perform the contract or provide a particular service.

Logging access to our digital services and the associated collection of connection data (such as the IP address) are also necessary; this functionality is activated automatically upon use and cannot be disabled for individual users. Therefore, if you do not agree to the collection of this data, you must refrain from using our services.

4. Purposes of processing and legal bases

To the extent permitted by applicable law, personal data will be processed in particular for the following purposes:

• initiating, concluding, fulfilling and performing contracts;
• offering, further developing and improving our services, developing new services, operating, maintaining, optimising and ensuring the security of our services and infrastructure;
• managing users of our services, identity checks, logins and other authentication;
• maintaining, administering and developing our customer relationships, communicating with customers and third parties, customer service and support, promotions, advertising and marketing, creating user profiles, offering personalised services and relevant content;
• managing and publishing directories (on paper, on data media and/or on the Internet), managing, comparing and updating databases, including central directories of addresses and contact details relating to our company and companies with which we have a contractual relationship;
• protecting users, our employees and third parties, and protecting our data, secrets and assets, and securing our systems, buildings and other infrastructure;
• quality control, market research, calculating statistics, preparing reports, developing information relevant to business management, administering and developing the company, our offering and our activities, acquiring and disposing of business units, companies and parts thereof;
• complying with legal and regulatory obligations and internal rules, enforcing the law, civil, administrative and criminal litigation, complaints, combating abuse, investigations and responding to enquiries from authorities and administrative bodies.

We may also process personal data for other purposes insofar as processing is required by a legal obligation, we provide information about it elsewhere, or the processing was apparent from the circumstances at the time the data was collected.

We use personal data for the above purposes on the following legal bases, insofar as required under applicable data protection law:

• performance of the contract;
• compliance with legal obligations;
• consent given to us or to third parties;
• our legitimate interests and those of third parties, in particular:
• offering and providing services;
• advertising and marketing;
• maintaining contacts and communicating with users and third parties;
• understanding users’ behaviour, preferences and needs, market research;
• further developing and improving our services, developing new services;
• user management, identity checks, logins, authentication;
• protecting users, our employees and third parties, our data, secrets, infrastructure and assets;
• maintaining and ensuring the security, efficiency and effectiveness of the organisation of business operations, including secure, efficient and effective management and further development of digital services and other IT systems, troubleshooting;
• appropriate business management and development, the sale or purchase of business units, companies or parts of companies and other commercial-law transactions;
• complying with legal and regulatory obligations and internal rules, enforcing the law, civil, administrative and criminal proceedings, complaints, combating abuse, investigations and responding to enquiries from authorities.

5. Publication and transfer of data

We may publish and transfer data as set out below:

Publication

Certain of our services involve the publication of data. Published data can generally be accessed anywhere, including outside Switzerland. For example, data in published directories is publicly available (e.g. on Facebook.com, Linkedin.com, etc.). Data published through the corresponding functions of our services (e.g. posts, images, texts, videos, comments, ratings, etc.) may also be publicly accessible. The same applies to the username used in that context. Published data may also be published by us or third parties on other platforms and in other media (e.g. printed materials), with appropriate adaptations where necessary. Data published on our services is also likely to be indexed by search engines (e.g. Google) or further disseminated by third parties, over which we have no influence; consequently, such data may remain publicly available in every country in the world even after it has been deleted from our systems.

Processors

We may appoint third parties to perform certain services (e.g. in IT, application management, administration, printing, dispatch, etc.) and to process and store data (so-called “processors”). Processors may access personal data and process it on our behalf. In this regard, we require processors to comply with data protection law and to process data only as we do ourselves. Processors that may receive personal data may be located in any country, in particular Switzerland, EU and EEA countries and the United States.

Contractual partners

We may transfer data to contractual partners (for example sales partners, service providers, customers, suppliers, financial companies, etc.). This occurs, for example, to fulfil contractual obligations, offer certain services, compare, validate and update databases (including central directories of our addresses and contact details and those of our contractual partners), for debt collection and marketing purposes, to analyse use and manage our services, systems and infrastructure, and to execute payments. Possible recipients may also include purchasers or parties interested in purchasing business units, companies or parts thereof. Contractual partners may gain access to personal data and process it for their own purposes (for example to perform a contract or fulfil their own legal obligations). In doing so, they are required to comply with applicable data protection laws. Contractual partners that may receive personal data may be located in any country, in particular Switzerland, EU and EEA countries and the United States.

Transfer to authorities and other transfers for legal reasons

In certain situations, we may disclose data to authorities, bodies and other third parties (e.g. in connection with requests from authorities or official requests, investigations and enquiries, administrative or criminal investigations, civil and/or criminal litigation). We do so where officially requested or requested by authorities, where we believe we are obliged to do so, or where we can address cases of fraud or security flaws or protect the rights and property of totalsalary.ch. If data that is not already public in itself is transferred to a country without adequate data protection, we ensure adequate data protection by using sufficient contractual safeguards, in particular based on the EU standard contractual clauses or Binding Corporate Rules, or by relying on the exceptions for consent, performance of a contract, the establishment, exercise or enforcement of legal claims, overriding public interests, or because this is necessary to protect the integrity of a data subject. Where applicable data protection law so provides, you may obtain from our data protection service a copy of the contractual safeguards relating to your personal data or find out where you can request them. We reserve the right to redact such copies for reasons arising from data protection legislation or to protect confidentiality.

6. Retention period

We store personal data for as long as necessary for the purposes for which we collected it. Certain personal data is also subject to legally binding retention obligations of ten or more years, with which we comply. We may also store personal data for at least the duration of the applicable limitation periods, which in various cases are five or ten years. Personal data generated in connection with the use of our services (e.g. records, logs, analyses, etc.) that is not subject to such retention or limitation periods is generally deleted earlier, as soon as there is no longer an interest in processing it. Data may also be retained for longer in anonymised form. Unless expressly agreed by contract, we have no obligation towards you to retain data for a particular period.

7. Cookies, web analytics and tracking tools and other technologies

We use various common technologies to record, store and analyse data when you use our services.

These technologies include, in particular, cookies that allow your browser or terminal device to be identified. A cookie is a small file sent to your computer or automatically stored by the browser you use on your computer or mobile device when you access one of our services. If you access a service again, that service can recognise your browser or terminal device using the cookie. Cookies can store user settings and other information. In addition to so-called session cookies, which are automatically deleted again after a visit to our services, we also use temporary and permanent cookies that remain stored on your computer or mobile device for longer. The cookies used primarily serve to make the functions of the various services available to you more easily and securely (such as logging into your user account).

Furthermore, information collected through cookies allows us to improve our services in line with customers’ wishes and to present you with personalised offers and advertising messages. We consider that, by using our services and their functions (e.g. language selection, automatic login), users consent to the use of these cookies. You can block the use of cookies or delete them in your browser settings. Please note that if you do not consent to cookies, you may not be able to make full use of all the functions of a service, and that deleting cookies will also delete any opt-out cookies you may have set. These opt-out cookies would then need to be reactivated when you next visit the relevant service. Otherwise, you will be recognised as a new user and your data will need to be collected again.

In addition to cookies, we may use other technologies (e.g. pixels, web beacons, tags, advertising IDs) to analyse the use of our services, personalise them and display personalised offers and advertising messages to you. When sending newsletters and emails, for example, we may use technologies that enable us to analyse which content interests users and whether, when and how they respond to our offers (e.g. by downloading images in an email, clicking URLs in an email or on a website, filling in form data, etc.). We consider that, by using such functions, users consent to the use of the corresponding technologies.

Finally, we use common web analytics and tracking tools to evaluate and analyse the use of our services. These tools, mostly provided by third parties, give us information and statistics about the use of our services, helping us to understand it better and adapt our services to users’ needs accordingly. Google servers in the United States and stored there. IP address anonymisation has been activated for Google Analytics on our services. Your IP address is therefore first truncated by Google within Member States of the European Union or in other contracting states of the EEA. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. Google uses this information to analyse the use of the relevant website, compile reports on website activity and provide the website operator with further services relating to website and Internet use.

Please note that selected third parties (e.g. advertising partners) may also use cookies and other technologies on our services to analyse the use of the services, personalise the services themselves and display personalised offers and advertising messages to you. You can find an overview of the third parties with whom we work in this area here. Their own terms of use and data protection provisions apply to data processing by these third parties.

8. Social media plugins and integration of third-party offerings

We integrate social network plugins into our services (e.g. Facebook, Linkedin, Twitter, etc.). These plugins make it easier to share content on those platforms.

When you visit our services containing these plugins, a connection may automatically be established with the relevant provider’s server. In this context, certain data (such as the time of the visit to the service, browser type, IP address) is collected and stored by that server. If you have a user account with one of these providers, that provider may associate this information with your profile. If you also interact with these plugins (e.g. by clicking the “like” button or leaving a comment), this information will also be transmitted to the provider, stored by it and possibly published. When you use a social login service (e.g. Facebook Connect), the provider may transmit to us personal data about you held in its records, such as your name, email address and profile picture.

We also integrate third-party services into our services that allow you to interact with customers and other totalsalary.ch users and with third parties (e.g. to make a booking through a booking service or to submit ratings and comments). In this connection, any data provided is transmitted to those third parties for processing and performance of the relevant service, or is processed directly by those third parties.

Please note that their own terms of use and data protection provisions apply to data processing by these third parties.

9. Rights of data subjects

Every data subject has a right of access to personal data concerning them. Data subjects also have the right to require us to rectify, erase and restrict data concerning them and to object to such processing of personal data. Exercising these rights generally requires the data subject to be able to prove their identity unequivocally. Where the processing of personal data is based on consent, the data subject may withdraw that consent at any time. In EU or EEA states, data subjects have the right, in certain cases, to receive data generated during the use of online services in a structured, commonly used and machine-readable format enabling further use and transmission. Requests in connection with these rights must be addressed to the data protection service (see section 2 above). We reserve the right to restrict data subjects’ rights within the limits of the legislation currently applicable and, for example, not to provide complete information or not to erase data. We also draw your attention to the fact that, if your personal data is erased, some or all of the services may no longer be usable or available.

If we automatically make a decision concerning an individual that produces legal effects concerning the data subject or similarly significantly affects them, the data subject may speak to a competent person within our company and ask them to reconsider that automated decision, or request a human assessment from the outset, insofar as applicable law provides for this. In that case, the data subject may no longer be able to use certain automated services. The person will be informed separately.

Every data subject has the right to lodge a complaint with the competent data protection authority. For a controller in Switzerland, this is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).