Data Privacy Policy labor team w ag

1 General information

1.1 Information on data protection
This privacy policy informs you about how we handle your personal data and your rights under the Swiss Federal Act on Data Protection (FADP) or European data protection law under Regulation (EU) 2016/679 (GDPR), depending on where you access our website from. The data controller is labor team w ag (hereinafter referred to as "we" or "us").

1.2 Contact
If you have any questions or suggestions regarding this information or would like to contact us to assert your rights, please send your enquiry to:

labor team w ag 
Blumeneggstrasse 55
9403 Goldach
P.O. Box 9001 St. Gallen 
Switzerland
+41 71 844 45 45
datenschutz@team-w.ch

1.3 Principles and purposes of data processing
The data protection term "personal data" within the meaning of the GDPR or personal data within the meaning of the Swiss FADP refers to all information relating to an identified or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the FADP. We only process data on the basis of a legal justification. We process personal data with your consent (Art. 6(1)(a) GDPR or Art. 31(1) FADP), to fulfil a contract to which you are a party, or at your request to take pre-contractual measures (Art. 6(1)(b) GDPR or Art. 31(2)(a) FADP), to fulfil a legal obligation (Art. 6(1)(c) GDPR or Art. 31(1) FADP) or if the processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, unless your interests prevail (Art. 6(1)(f) GDPR or Art. 31(1)(2) FADP).

If you apply for a vacant position in our company, we will also process your personal data in order to decide whether to establish an employment relationship.

1.4 Duration of storage
Unless otherwise specified in the following information, we only store the data for as long as is necessary to achieve the processing purpose or to fulfil our contractual or legal obligations. Such legal storage obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will store such personal data contained in our accounting data for ten years. In addition, we will store data relating to consents subject to proof and to complaints and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.

1.5 Categories of data recipients
We use contract processors to process your data. The processing operations carried out by such contract processors include, for example, hosting, email dispatch, maintenance and support of IT systems, accounting and billing, file and data carrier destruction, and payment service providers. A processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller. Processors do not use the data for their own purposes, but carry out data processing exclusively for the controller and are contractually obliged to ensure appropriate technical and organisational measures for data protection.

In addition, we may transfer your personal data to entities such as postal and delivery services, our bank, tax advisors/auditors or the tax authorities, as well as government institutions, e.g., the cantonal cancer registry or the Federal Office of Public Health. For the purpose of infection tracking, data may be transferred to the competent cantonal health authority. Further recipients may be identified in the following information.

1.6 Data transfer abroad
Visiting our website may involve the transfer of certain personal data to countries where the GDPR or the FADP does not apply. Such transfers are permitted if the legislation in the recipient country ensures adequate protection. In the absence of a decision on an adequate level of data protection by the European Commission or the Federal Council in Switzerland, personal data will only be transferred to a third country if suitable safeguards are in place.

Unless otherwise stated below, we use the European Commission's standard data protection clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of obtaining a copy of these standard data protection clauses or viewing them. To do so, please contact us at the address given under Contact.

Data processing also takes place in the following countries outside Switzerland:

• Germany / EU
• Ireland / EU

We guarantee an adequate level of data protection. This is ensured by:

• an established adequate level of data protection in accordance with Art. 16(1) of the Data Protection Act for the recipient country;
• standard data protection clauses that have been previously approved, issued or recognised by the Swiss Federal Data Protection and Information Commissioner, in particular the standard contractual clauses of the European Commission;
• an international treaty regulating an adequate level of data protection.

1.7 Processing when exercising your rights
When you exercise your rights as a data subject, we process the personal data transmitted for the purpose of implementing these rights and to be able to provide evidence of this. We will only process data stored for the purpose of providing information and preparing it for this purpose, as well as for data protection control purposes, and will otherwise restrict processing.

1.8 Your rights
As a data subject, you have the right to assert your rights as a data subject against us under the data protection law applicable to you (GDPR or FADP). In particular, you have the following rights:

• You have the right to request information about whether and, if so, to what extent we process personal data relating to you.
• You have the right to request that we correct your data.
• You have the right to request that we delete your personal data.
• You have the right to have the processing of your personal data restricted.
• You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller.
• In accordance with Art. 21(1) GDPR, you have the right to object to processing based on Art. 6(1)(e) or (f) GDPR or pursuant to Art. 32 GDPR. If we process personal data about you for the purpose of direct marketing, you may object to this processing in accordance with Art. 21(2) and (3) GDPR.
• If you have given us separate consent to process your data, you can revoke this consent at any time. Such revocation does not affect the lawfulness of the processing that took place on the basis of the consent until revocation.
• If you believe that the processing of your personal data violates the provisions of the FADP or GDPR, you have the right to lodge a complaint with the competent supervisory authority.

1.9 Contact
You can contact our representative in the European Union and our data protection officer in accordance with Art. 10 FADP at the following contact details:

Email:eu_datenschutz@team-w.ch 
Herting Oberbeck Datenschutz GmbH 
Hallerstr. 76, 20146 Hamburg, Germany  
https://www.datenschutzkanzlei.de

2 Data processing on our website
When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, we automatically collect certain information about your use of the website. In data protection law, the IP address is also considered personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.

2.1 Processing of server log files
When using our website for purely informational purposes, general information that your browser transmits to our server is initially stored automatically (i.e., not via registration). This includes, by default: the user's operating system, the user's Internet service provider, the user's IP address, the date and time of access, the page accessed, the previously visited page (referrer URL), the sub-web pages accessed via an accessing system on the website, and similar device-specific information required to establish a connection and use the website. This processing serves the technical administration and security of the website. The stored data is deleted after 30 days, unless there are concrete indications that there is a justified suspicion of illegal use and further examination and processing of the information is necessary for this reason.

We are unable to identify you as the data subject based on the stored information. The rights of data subjects therefore do not apply unless you provide additional information that enables your identification in order to exercise your rights as set out in these articles.

2.2 Contact options and enquiries
Our website contains contact forms that you can use to send us messages. Your data is transferred in encrypted form (indicated by "https" in the address bar of your browser). All data fields marked as mandatory are required to process your request. If you do not provide this information, we will not be able to process your request. The provision of further data is voluntary. Alternatively, you can also send us a message via the contact email address. We process the data for the purpose of responding to your enquiry. If your enquiry relates to the conclusion or execution of a contract with us, we process the data on the basis of Art. 6(1)(b) GDPR or Art. 31(2)(a) FADP. Otherwise, we process the data on the basis of our legitimate interest in contacting enquirers. The basis for data processing is then Art. 6 (1) (f) GDPR or Art. 31 (1) FADP.

2.3 Chat service
As soon as you visit our website, you will be offered the chatbot moin.ai from knowhere GmbH (Germany/EU). The chatbot answers your service requests and questions about our services. It automatically recognises your request and independently provides a suitable answer. The data processed by moin.ai is hosted in a data centre in Germany.

In order for the chatbot to be displayed, it processes your IP address. However, this is only stored anonymously by knowhere GmbH. Otherwise, data is only processed anonymously, except for the information that you voluntarily send to the chatbot during the chat conversation.

In addition, a personal reference can be established if you voluntarily decide to forward the chat history to our customer service using the function provided for this purpose. In this case, further information will be collected in addition to your email address so that we can process your request.

The chatbot supports fast communication with website visitors and customers. If your enquiry relates to the execution of an order with us, Art. 6(1)(b) GDPR and Art. 31(2)(a) GDPR form the basis for data processing. In addition, it serves our legitimate interest pursuant to Art. 6(1)(f) GDPR Art. 31(1) FADP to process customer enquiries quickly and efficiently.

In order for the chatbot to recognise a user who has already started a conversation with the chatbot, a localStorage key is stored in the website visitor's web browser when a conversation is started. This ensures that the user dialogue can be continued even after multiple visits to the website without losing context. The localStorage key is stored until it is manually deleted. In addition, the log files and chat histories are automatically deleted on the server side after 30 days.

2.4 Cookies
We use cookies and similar technologies ("cookies") on our website. Cookies are small data files that are stored by your browser when you visit a website. This identifies the browser used and allows it to be recognised by web servers. You have full control over the use of cookies through your browser. You can delete cookies at any time in your browser's security settings. You can object to the use of cookies in your browser settings either generally or in specific cases.

The use of cookies is technically necessary for the operation of our website and is therefore permitted without the user's consent. We may also use cookies to offer special functions and content, as well as for analysis and marketing purposes. These may also include cookies from third-party providers (so-called third-party cookies). We only use such technically unnecessary cookies with your consent in accordance with Art. 6 (1) (a) GDPR or Art. 31 (1) FADP. Information on the purposes, providers, technologies used, stored data and storage duration of individual cookies can be found in the cookie settings of our consent management tool.

2.5 Consent management tool
This website uses a consent management banner to control cookies. The consent banner allows users of our website to give their consent to certain data processing procedures or to revoke consent that has already been given. By confirming the "I accept" button or by saving individual cookie settings, you consent to the use of the associated cookies. The legal basis for data protection is your consent within the meaning of Art. 6 (1) (a) GDPR or Art. 31 (1) FADP.

In addition, the banner helps us to provide evidence of the declaration of consent. For this purpose, we process information about the declaration of consent and further log data relating to this declaration. Cookies are also used to collect this data.

Cookies are also used to collect this data. The processing of this data is necessary in order to be able to prove that consent has been given. The basis for this is our legal obligation to document your consent (Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR).

You can revoke your consent to cookies here: 

2.6 Analysis of our website and tracking

2.6.1 Matomo
Software for measuring reach. Visits to our website are recorded and evaluated anonymously without the use of tracking cookies. The IP address is anonymised immediately after collection and before storage. Therefore, no further processing of personal data takes place when using Matomo.

This data processing is carried out to safeguard our legitimate interests in measuring reach and statistically analysing the use of our website. The processing is based on Art. 6 (1) (f) GDPR and Art. 31 (1) FADP and is necessary for our legitimate interest in optimising our offering and, where possible, avoiding the processing of personal data.

You can object to this data processing altogether. In this case, a so-called opt-out cookie will be stored in your browser. As a result, no session data will be collected via Matomo. If you delete your cookies in your internet browser, the opt-out cookie will also be deleted. If you visit our website again, you will have to object again.

2.6.2 New Relic
Our website uses New Relic, an analysis service provided by New Relic Inc. (New Relic/USA). New Relic is a web analysis tool that collects user data from a website in order to analyse and monitor the website's performance, for example to improve the loading times of individual parts of the website.

Some of this data is information stored on your device. In addition, further information is stored on your device via the cookies used. Such storage of information by New Relic or access to information already stored on your device only takes place with your consent.

The setting of cookies and the further processing of personal data described here is carried out with your consent. The basis for data processing in connection with the New Relic service is therefore Art. 6 (1) (a) GDPR or Art. 31 (1) FADP.

Further information on these processing activities, the technologies used, the data stored and the storage period can be found in the settings of our consent management tool.

When using New Relic, the transfer of data to New Relic Inc. in the USA cannot be ruled out. Please note the information in the section "Data transfer to third countries". Further information on data protection and the cookies used can be found on the Internet at https://newrelic.com/privacy.

3 Further data processing

3.1 Order entry and information on findings
You have the option of placing orders with us in paper form, by telephone or online. When processing orders, we only process the data, in particular health data, that has been provided, e.g., in the input mask or by telephone. We process personal data exclusively for the purpose of contract processing and to provide you with the analysis results. Positive analysis results are stored and used by us in pseudonymised form for internal quality control purposes. Analysis results can be accessed online on our website, using the "LabHub" app after entering your username and password. Customers can obtain these access data on request from our service hotline. All data fields marked as mandatory are required to process your order. Failure to provide this information will result in us being unable to process your order. The basis for processing is Art. 6 (1) (b) GDPR, Art. 9 (2) (h) GDPR or Art. 31 (2) (a) FADP, as applicable. The provision of further data is voluntary. We process such voluntarily provided data on the basis of Art. 6 (1) (f) GDPR or Art. 31 (1) FADP.

3.2 Fulfilment of statutory reporting and information obligations
We are obliged to report certain findings (including the name of the data subject) to official bodies (e.g., cancer registries, cantonal health authorities, Federal Office of Public Health FOPH) on the basis of legal provisions (e.g., infectious diseases or cancer).

Furthermore, we provide information to the competent authorities (such as public prosecutors, courts and health authorities) upon request, if and to the extent that there is a legal obligation to do so.

The basis for processing is Art. 6(1)(c) GDPR or Art. 31(1) FADP, as applicable.

3.3 Webshop
If you register as a customer with one of our partners for the web shop and indicate that you wish to work with labor team w ag, we will receive a confirmation request from our partner. For this purpose, we process your address data and compare it with our customer database in order to confirm the cooperation to our partner by sending them your customer code.

Some products ordered from our partner's online shop are shipped by labor team w ag. In this case, we only process the data you have provided yourself and, if applicable, payment information as part of the booking or ordering process. In order to deliver the products, you have ordered, we transfer the data required for delivery to one of our shipping service providers as specified in the order.

The basis for processing is Art. 6 (1) (b) GDPR or Art. 31 (2) (a) FADP, as applicable. All data fields marked as mandatory are required to process your booking or order. If you do not provide the mandatory information, we will not be able to process your booking or order. You can also provide us with additional data on a voluntary basis. We process the data provided voluntarily on the basis of Art. 6 (1) (f) GDPR or Art. 31 (1) FADP.

3.4 Newsletter
We offer the option of subscribing to our newsletter on our website. After subscribing, we will regularly inform you about the latest news regarding our offers. A valid email address is required to subscribe to the newsletter. To verify your email address, you will first receive a registration email that you must confirm via a link (double opt-in). When you subscribe to the newsletter on our website, we process personal data such as your email address and your name on the basis of the consent you have given. The processing is based on Art. 6 (1) (a) GDPR or Art. 31 (1) FADP. You can revoke your consent at any time with future effect, for example by clicking on the "Unsubscribe" link in the newsletter or by contacting us via the channels mentioned above. The legality of the data processing operations already carried out remains unaffected by the revocation.

When you subscribe to the newsletter, we also store your IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The basis for this is our legal obligation to document your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR or Art. 31(1) in conjunction with Art. 6(6) FADP).

We also analyse the reading behaviour and opening rates of our newsletter. We evaluate the data generated during the delivery and retrieval of our emails in aggregated and anonymised form (delivery rate, opening rate, click rates, unsubscribe rate, bounce rate, visits, completions) in order to measure the use and success of the emails. The basis for the analysis of our newsletter is Art. 6 para. 1 lit. a GDPR or Art. 31 para. 1 FADP, and the processing serves our legitimate interest in optimising our newsletter.

On the other hand, we also evaluate the data generated when you retrieve and use these emails (opening time, hyperlinks clicked, documents downloaded) as well as movement data on downstream websites in connection with your email address in order to send you individualised information in the future that best suits your interests and needs. We use the anonymous and personal data collected to provide you with personalised content and individualised information in our promotional emails and on downstream websites. The basis for data processing in the context of emails is Art. 6 (1) (a) GDPR and Art. 31 (1) FADP. You can revoke your consent at any time with effect for the future, for example via the "unsubscribe" link in the newsletter or by contacting us via the above-mentioned channels.

3.5 Registration for events
If you register for one of our conferences or training events, we will process your data to the extent necessary to hold the event and, if applicable, within the scope of our contractual relationship. This regularly includes the processing of contact and communication data, the name and address of the practice and, if applicable, payment details. The basis for this processing is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR or Art. 31(1) FADP and Art. 31(2)(a) FADP.

3.6 Applications
You can apply for a job via our website in the "Careers" section. For this purpose, we collect personal data from you, including in particular your name, CV, cover letter and other content provided by you. Your personal application data will be processed exclusively for the purpose of assessing your suitability for employment, i.e., for purposes related to your interest in current or future employment with us and the processing of your application. Your application will only be processed and reviewed by the relevant contact persons at our company. All employees entrusted with data processing are obliged to maintain the confidentiality of your data. If we are unable to offer you employment, we will delete the data you have provided immediately after our rejection. This does not apply if the data provided is required to defend against claims by the applicant, if legal provisions prevent deletion, or if you have expressly consented to longer storage.

The basis for collecting and processing your personal data in the application process is Art. 6(1)(b) GDPR and Art. 328b Swiss Code of Obligations (CO) in conjunction with Art. 31(2)(a) GDPR (implementation of pre-contractual measures). The basis for storing your data beyond the application process is Art. 6(1)(f) GDPR or Art. 31(1) FADP (pursuit of legitimate interests). Our interest then lies in asserting or defending claims, e.g., in the context of a burden of proof in legal proceedings.

If we store your applicant data for a period of six months and you have expressly consented to this, we would like to point out that this consent can be freely revoked at any time. Such revocation does not affect the lawfulness of the processing that took place on the basis of the consent until revocation.

3.7 Customer and prospect data
If you contact our company as a customer or prospective customer, we will process your data to the extent necessary to establish or implement the contractual relationship. This regularly includes the processing of the personal master data, contract data and payment data provided to us, as well as the contact and communication data of our contact persons at commercial customers and business partners. The basis for this processing is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR or Art. 31(1) FADP and Art. 31(2)(a) FADP.

We also process customer and prospect data for evaluation and marketing purposes. This processing is carried out on the basis of Art. 6(1)(f) GDPR and serves our interest in further developing our offering and providing you with targeted information about our offerings. Further data processing may take place if you have given your consent (Art. 6(1)(a) GDPR or Art. 31(1) FADP) or if this is necessary to fulfil a legal obligation (Art. 6(1)(c) GDPR or Art. 31(1) FADP).

3.8 Competitions
If you participate in a competition, we will process your personal data for the purpose of conducting and processing the competition. This includes, in particular, selecting the winners, notifying them of their prize and delivering the prize. In the event that certain prizes are delivered or provided by another company (e.g., a cooperation partner), we will transfer the winner's data to this company to the extent necessary. After the competition has ended, we will delete the data unless there are legal retention obligations that prevent immediate deletion. The basis for processing is Art. 6 (1) (b) GDPR or Art. 31 (2) (a) FADP.

4 Data processing via our app
We provide you with mobile apps that you can download to your mobile device. Below, we provide information about the collection and processing of personal data when using our mobile apps.

The declaration does not apply to the processing of personal data after it has left the apps, for example, after it has been downloaded or shared with third parties. This data processing is carried out under the responsibility of the person who initiates or carries out this processing and cannot be influenced by us.

4.1 Downloading the apps
When you download the apps, certain necessary information is transmitted to the app store you have selected (e.g., Google Play or Apple App Store). In particular, your user name, email address, customer number, time of download and individual device number may be processed. This data is processed exclusively by the provider of the respective app store and is beyond our control.

4.2 Permissions on the end device when using the app
When using the apps, it may be necessary to access certain functions of the end device used. The apps require the following permissions for this purpose:

• Internet access: This is required so that the end device can establish a connection to our server in order to retrieve information such as diagnostic data.
• Camera access: This is required so that the app user can scan QR codes (for easy transfer of user data from our website).
• Face recognition (Face ID) or fingerprint: This is required so that the app user can use the login procedure via face recognition (Face ID) or fingerprint.
• Access to external storage: This is required so that app users can save data on their device for further processing.
• Messages/notifications: This is required so that push notifications can be sent, e.g., to alert users to new analysis results (where subscribed).

4.3 Processing of personal data when using the apps

4.3.1 LabHub  
We use the app to process personal data for order entry and results information. Further information on this can be found in the section "Order entry and results information".

In addition, we process the personal data described below to enable convenient use of the functions and to ensure stability and security:

• User name
• IP address
• Date and time of the request
• ID of the opened findings data

The basis for processing this data is Art. 6(1)(f) GDPR and Art. 31(1) FADP.

4.3.2 myLab
We process master, usage and communication data in the app. This includes:

• User
• Email
• Date of birth
• IP address
• Employer
• Courses attended, comments, likes
• Communication data
• Data resulting from the bonus programme
• Data resulting from app usage (see section 2.6.1 – Matomo).

We use this data to enable the use of the app, to enable communication with other app users and to contact you and, for example, suggest interesting events.

The basis for processing this data is Art. 6(1)(f) GDPR and Art. 31(1) FADP.

5 Data processing on our social media pages
We are represented on several social media platforms with a company page. In this way, we would like to offer further opportunities to provide information about our company and to exchange ideas. Our company has company pages on the following social media platforms:

• Facebook of Meta Platforms Ireland Limited, (Ireland, EU), hereinafter referred to as "Meta";
• Instagram by Meta Platforms Ireland Limited, (Ireland, EU), hereinafter referred to as "Meta";
• LinkedIn, LinkedIn Ireland Unlimited Company (Ireland, EU), hereinafter referred to as "LinkedIn"

When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile also regularly constitutes personal data. This includes messages and statements made using the profile. In addition, when you visit a social media profile, certain information about it is often automatically collected, which may also constitute personal data.

5.1 Visiting a social media page
When you visit our social media page, where we present our company or individual products from our range, certain information about you is processed. The operators of the social media platforms are solely responsible for this processing of personal data. Further information on the processing of personal data can be found in their privacy policies, which we link to below:

• Meta (https://www.facebook.com/privacy/explanation). Meta offers the option to object to certain data processing; information on this and opt-out options can be found at https://www.facebook.com/settings?tab=ads;
• LinkedIn (https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy).

The operators of social media platforms collect and process event data and profile data and provide us with statistics and insights in anonymised form for our pages, which help us to gain insights into the types of actions that people take on our page (so-called "page insights"). These Page Insights are created on the basis of certain information about people who have visited our page. This processing of personal data is carried out by the social media operators and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our site and improving our site based on these insights. The basis for this processing is Art. 6(1)(f) GDPR and Art. 31(1) FADP.

We cannot assign the information obtained via Page Insights to individual user profiles that interact with our pages. We have entered into agreements with the operators of the social media platforms as joint controllers, which define the distribution of data protection obligations between us and the operators. Details about the processing of personal data for the creation of page insights and the agreement concluded between us and the operators can be found at the following links:

• Meta (https://www.facebook.com/legal/terms/information_about_page_insights_data);
• LinkedIn (https://legal.linkedin.com/pages-joint-controller-addendum).

You also have the option of asserting your rights against the operators. Further information on this can be found at the following links:

• Meta (https://www.facebook.com/privacy/explanation);
• LinkedIn (https://www.linkedin.com/help/linkedin/ask/PPQ?lang=en).

We have agreed with Meta and LinkedIn that the Irish Data Protection Commission is the lead supervisory authority that oversees the processing for Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

6 Comments and direct messages
We also process information that you have provided to us via our company page on the respective social media platform. Such information may include the username used, contact details or a message to us. We process this information as the sole controller. We process this data on the basis of our legitimate interest in contacting enquirers. The basis for data processing is Art. 6(1)(f) GDPR or Art. 31(1) FADP. Further data processing may take place if you have given your consent (Art. 6(1)(a) GDPR or Art. 31(1) FADP) or if this is necessary to fulfil a legal obligation (Art. 6(1)(c) GDPR or Art. 31(1) FADP).

7 Changes to our privacy policy
We reserve the right to amend and update this privacy policy so that it complies with current legal requirements or to adequately reflect and implement changes to our services in the privacy policy. When you visit our website or use our services, the current version of the privacy policy at that time applies.