Privacy Policy

nextesy AG
Bändliweg 20, 8048 Zurich, Switzerland

nextesy AG, with registered office in Zurich, is a joint-stock company in accordance with Art. 620 et seq. CO. In this privacy policy, we, nextesy AG (hereinafter referred to as we or us), explain how we collect and otherwise process personal data. This privacy policy is directed, for example, at our customers (hereinafter "customers"), employees (including former employees as well as applicants) and suppliers/service providers or subcontractors (hereinafter you). This is not an exhaustive description; where applicable, contracts, other privacy policies or general terms and conditions, terms of participation and similar documents may govern specific matters. Personal data is understood to mean all information relating to an identified or identifiable person.

If you provide us with personal data of other persons (e.g. your customers, your employees, your business partners, your family members or other third parties), please ensure that these persons are aware of this privacy policy and only share their personal data with us if you are authorised to do so and if this personal data is correct. You warrant that you have lawfully collected the personal data of third parties forwarded to us, i.e. with consent for collection and forwarding to third parties, including us.

This privacy policy is designed to meet the requirements of the Swiss Data Protection Act ("FADP") and the European General Data Protection Regulation ("GDPR"). Whether and to what extent these legal bases are applicable depends on the individual case.

Controller / Data Protection Officer / Representative

The controller responsible for the data processing described here is nextesy AG, Zurich. Internally, Milos Calija, CTO, is responsible for data processing. If you have any data protection concerns, you can communicate them to us at the following contact address: nextesy AG, Bändliweg 20, 8048 Zurich, Switzerland, milos@nextesy.com.

Collection and Processing of Personal Data

We primarily process the personal data that we receive from our customers or their contractual or legal representatives/assistants or authorised signatories, from our business partners, from our employees, as well as from our suppliers and subcontractors in the course of our business relationship with them, or which we collect from users when operating our websites and other applications.

We offer our customers comprehensive services in the field of Human Capital Management. This means that we offer our customers a wide range of procedures and solutions for recruiting as well as managing and developing a company's human capital – i.e. its workforce. If you want to become our customer, we will ask you for various pieces of information. In the course of providing our services, we may receive further personal information about you, which may include the following data:

Personal information of the customer or its corporate bodies and employees directly interacting with us: name, date of birth, address, email address, contact details, nationality; Financial information: payment arrangements, insurance information, sources of funding, etc. Personal information of our customer's employees:

• Personal information of the customer or its corporate bodies and employees directly interacting with us: name, date of birth, address, email address, contact details, nationality;

• Financial information: payment arrangements, insurance information, sources of funding, etc.

• Personal information of our customer's employees:

• General personal information such as surname, first name, date of birth, religion, gender, address, name of spouse and children, salary, OASI no., copy of passports or identity cards, telephone number, private email;

• Information on recruitment (including application documents, requirement profiles);

• Information on employment (employment contracts including all information contained therein);

• Qualifications and employee appraisals;

• Minutes of employee meetings;

• Measures for demanding and promoting employees;

• Working time tracking;

• Details of health/illness, accident, maternity and paternity leave;

• Information on financial situation and debts for transfer to the debt collection office;

• Business correspondence and emails;

• Trade union activities of employees;

• Extracts from criminal and debt collection registers;

• Calendar entries;

• Chats.

By means of this contact information, we can verify you, provide our services to your maximum satisfaction and, if necessary, inform you about changes / important situations regarding our services (for which purpose we may send you or your relatives or representatives an email or otherwise contact you or the aforementioned persons).

Our services are designed to relieve our customers of as much work as possible in connection with Human Capital Management. When you use our services, we therefore ask you in detail for your personal information and give you the opportunity to provide further details about yourself on your own initiative. We also offer you the option of uploading extensive data records about your employees to our platform.

You are aware that particularly sensitive personal data (e.g. regarding health, religion, trade union activity) may be collected about you as a customer and in particular about your employees, and may be passed on to external providers (e.g. providers of server or cloud storage), and you expressly agree to this.

As an employee, supplier/service provider or subcontractor, we may ask you for the following data or request related documents and process this data:

• Personal information: name, date of birth, address, nationality, contact details, possibly data about family members (e.g. for apprentices/trainees) or emergency contacts;

• Financial information: creditworthiness information/extracts from the debt collection register, etc.;

• Tax information/OASI numbers, etc.;

• Information about criminal convictions: extracts from criminal records, etc.

You are aware that we use the transmitted data to develop processes and train our own systems (e.g. automated processes and self-learning programs). The content developed based on your data (e.g. processes) is our intellectual property. [You can object to the use of your data for the development of our processes and the training of our systems by declaring an opt-out before you receive our services.]

In the course of employment, we collect and process various data from employees. In addition to the data listed above, this includes the following information for the personnel file: signed/accepted contracts and regulations, sick days, insurance, start date/termination date, skills, work history, technical and interpersonal skills, absences, holidays, salary, benefits and evaluations/qualifications. This information is retained for as long as legally necessary. The personnel file is subject to regular sorting and unnecessary information is deleted from it.

When you contact us – for example, by writing us an email – we receive certain personal data about you. This data includes, in particular, contact details, the content of your communication and the content of any attachments or enclosures. We use this data to process your contact request.

Should you subscribe to our newsletter, we collect your contact details and, if necessary, information that allows us to verify that you are the owner of the email address provided and that its owner agrees to receive the newsletter. You can revoke your consent to this at any time - for example via the 'unsubscribe' link in the newsletter.

Personal Data Collected in Connection with the Use of Our Online Services

When you use our online services, we collect data on how you access and use them ("Usage Data"). This Usage Data is sent by your browser every time you visit our website and may include information such as the IP address, browser type, browser version, the pages of our website you visit, the time and date of your visit, the time spent on those pages, and other anonymised data regarding the selection made on the website. If you access our website from a mobile device, the Usage Data may also include information about the type of your device, its unique ID and other diagnostic data. The collection of this Usage Data serves to provide, maintain and improve our website and your user experience. We may also share the data in anonymised form for research purposes with selected research institutions.

We and our partners (e.g. our advertising and analysis partners) use cookies and related tracking technologies to track your use of our services and to collect certain data. For more information, please see below in this privacy policy.

Personal Data We Receive from Third Parties

Other users of our services may provide personal data about you when they contact us. We may receive data about you and your activities on and off our website from our partners (e.g. from our advertising and analysis partners). We may thus receive information about your interest in and activities related to our services. We may use this data to improve and promote our services and your user experience. Other features on our platform may require us to collect data from third-party providers on behalf of our users. Details on the individual services can be found in the following sections:

Publicly Accessible Sources

To the extent permitted, we also obtain certain data from publicly accessible sources (e.g. debt collection registers, land registries, commercial registers, press, internet) or receive such from authorities and other third parties. This applies in particular to our suppliers/service providers and our employees. In addition to the data that you give us directly, the categories of personal data we receive about you from third parties include, in particular, information from public registers, information we obtain in connection with administrative and judicial proceedings, information related to your professional functions and activities (so that we can, for example, with your help, conclude and process transactions with your employer), information about you in correspondence and meetings with third parties, creditworthiness information (insofar as we conduct business with you personally), information about you given to us by people close to you (business partners, service providers, family, advisers, legal representatives, etc.) so that we can conclude or process contracts with you or with your involvement (e.g. references), your address for deliveries, powers of attorney, information on compliance with legal requirements such as anti-money laundering and export restrictions, information from banks, insurance companies, sales and other contractual partners of ours regarding the use or provision of services by you (e.g. payments made, contract processing completed), information from the media and the internet about you (insofar as this is indicated in the specific case, e.g. as part of an application, press review, marketing/sales, etc.), your addresses and, if applicable, interests and other socio-demographic data (for marketing), data in connection with the use of the website (e.g. IP address, MAC address of the smartphone or computer, details about your device and settings, cookies, date and time of visit, pages and content accessed, functions used, referring website, location details). We may receive particularly sensitive personal data from our customers and other business partners in the course of our business relationship with them and other persons involved.

We primarily use the personal data we collect to conclude and process our contracts with our customers, business partners and employees, in particular in connection with our Human Capital Management services, the operation of our website and our online platforms, as well as to comply with our legal obligations in Switzerland and abroad. If you work for one of our customers or business partners, your personal data may of course also be affected in this capacity.

In addition, we process personal data of you and other persons, to the extent permitted and deemed appropriate, also for the following purposes, in which we (and sometimes also third parties) have a legitimate interest corresponding to the purpose:

• Offering and further development of our offers, services, websites and platforms on which we are present;

• Support services for users of our offers, services, websites, software and other platforms;

• Communication with third parties and processing of their inquiries (e.g. applications, media inquiries);

• Review and optimization of procedures for needs analysis for the purpose of direct customer approach and collection of personal data from publicly accessible sources for the purpose of customer acquisition;

• Advertising and marketing (including organizing events), provided you have not objected to the use of your data (if we send you advertising as an existing customer, you can object to this at any time, we will then put you on a blocklist against further advertising mailings);

• Market and opinion research, media monitoring;

• Assertion of legal claims and defence in connection with legal disputes and official proceedings;

• Prevention and investigation of crimes and other misconduct (e.g. conducting internal investigations, data analysis to combat fraud, compliance and adherence to regulatory requirements);

• Ensuring our operations, in particular IT, our websites, apps if applicable, and other platforms;

• Video surveillance to protect house rules and other measures for IT, building and facility security and protection of our employees and other persons and values belonging or entrusted to us (such as access controls, visitor lists, network and mail scanners, telephone recordings);

• Acquisition and sale of business divisions, companies or parts of companies and other corporate transactions and, associated therewith, the transfer of personal data as well as measures for business management and, to the extent necessary, to comply with legal and regulatory obligations and internal regulations of ours.

Insofar as you have given us consent to process your personal data for specific purposes (for example, when you register to receive newsletters or conduct clarifications), we process your personal data within the scope of and based on this consent, unless we have another legal basis and we require one. Consent given can be revoked at any time, which however has no effect on data processing that has already taken place, to which you have (impliedly, if applicable) consented.

We only process particularly sensitive personal data if this is strictly necessary to conclude and process our contracts with our customers and business partners. In particular, these are not used for advertising and marketing purposes or passed on to third parties without compelling necessity.

Cookies / Tracking and Other Technologies Related to the Use of Our Website

We typically use cookies and similar techniques on our websites and platforms with which your browser or device can be identified. A cookie is a file that is sent to your computer or automatically stored on your computer or mobile device by the web browser used when you visit our website or use a platform. When you visit this website again, we can recognize you, even if we do not know who you are. In addition to cookies that are only used during a session and deleted after your website visit ("session cookies"), cookies can also be used to store user settings and other information over a certain period of time (e.g. two years) ("permanent cookies"). However, you can set your browser to reject cookies, store them for one session only, or otherwise delete them prematurely. Most browsers are preset to accept cookies. We use permanent cookies so that you can store user settings (e.g. language, auto-login), so that we can better understand how you use our offers and content, and so that we can show you offers and advertisements tailored to you (which can also happen on websites of other companies; however, they will not learn who you are from us, if we even know that ourselves, because they only see that the same user is on their website who was also on a certain page of ours). Some of the cookies are set by us, some also by contractual partners with whom we cooperate. If you block cookies, it may be that certain functionalities (such as language selection, contact forms, platform processes, etc.) no longer work.

Our website may contain links to websites of other providers. We have no influence on these websites, their content, offers or availability, or the privacy policies and provisions applicable there. Any liability for third-party websites is rejected.

In our newsletters and other marketing emails, we partially and to the extent permitted also integrate visible and invisible image elements, through the retrieval of which from our servers we can determine whether and when you have opened the email, so that we can also measure and better understand how you use our offers and tailor them to you. You can block this in your email program; most are preset to do this. By using our websites and consenting to receive newsletters and other marketing emails, you agree to the use of these techniques. If you do not want this, you must set your browser or email program accordingly.

We sometimes use Google Analytics or similar services on our websites. This is a service of third parties, who may be located in any country in the world (in the case of Google Analytics, it is Google Ireland (with registered office in Ireland), Google Ireland relies on Google LLC (with registered office in the USA) as processor (both "Google"), www.google.com), with which we can measure and evaluate the use of the website (non-personally identifiable). For this purpose, permanent cookies are also used, which the service provider sets. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and therefore cannot be traced back. We have turned off the "Data sharing" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google may draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these persons. If you have registered with the service provider yourself, the service provider also knows you. The processing of your personal data by the service provider then takes place under the responsibility of the service provider in accordance with its data protection provisions. The service provider only informs us how our respective website is used (no personal information about you).

Google Ads

We use Google Ads on our website. Google Ads is an online advertising program of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on the user data available at Google (e.g. location data and interests) (target group targeting). As the website operator, we can evaluate this data quantitatively by, for example, analysing which search terms led to the display of our advertisements and how many ads led to corresponding clicks.
The use of this service is based on your consent. Consent can be revoked at any time. The transfer of data to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

Data Transfer and Transmission

Within the scope of our business activities and the purposes in accordance with Section 3, we also disclose data to third parties, to the extent permitted and deemed appropriate, either because they process it for us or because they want to use it for their own purposes. This concerns in particular the following bodies:

Group companies,

Service providers of ours, including their processors (such as IT providers, server providers, consultants and lawyers, providers of Artificial Intelligence solutions and plugins);

Dealers, suppliers, subcontractors and other business partners;

External service providers of our customers;

Authorities, official agencies or courts;

Media;

Public, including visitors of websites and social media;

Competitors, industry organizations, associations, organizations and other bodies;

Acquirers or parties interested in acquiring business divisions, companies or other parts of our operations;

Other parties in potential or actual legal proceedings;

all together hereinafter "Recipients".

These recipients are located in Switzerland, Germany, Serbia and the USA, but can be worldwide. If a recipient is located in a country without adequate statutory data protection, nextesy contractually obliges the recipient to comply with applicable data protection (for this purpose we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exemption clause.

Particularly sensitive personal data will only be passed on if this is strictly necessary to conclude and process our contracts with our customers and business partners or if we are legally obliged to do so.

Retention Period of Personal Data

We process and store your personal data for as long as it is necessary for the fulfillment of our contractual and legal obligations or otherwise the purposes pursued with the processing, i.e. for example for the duration of the entire business relationship (from the initiation, processing to the termination of a contract) as well as beyond that in accordance with the legal retention and documentation obligations according to the Code of Obligations or the Business Record Ordinance. It is possible that personal data will be kept for the period in which claims can be asserted against our company and to the extent that we are otherwise legally obliged to do so or legitimate business interests require this (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for the above-mentioned purposes, it will in principle and as far as possible be deleted or anonymized. For operational data (e.g. system logs), generally shorter retention periods of twelve months or less apply.

Data Security

We take appropriate technical and organizational security measures to protect your personal data from unauthorized access and misuse, such as issuing instructions, training, IT and network security solutions, and encryption of data carriers and transmission.

Particularly sensitive personal data is only processed by qualified employees who have signed a corresponding confidentiality agreement.

Obligation to Provide Personal Data

Within the scope of our business relationship, you must provide those personal data that are necessary for the initiation and execution of a business relationship and the fulfillment of the associated contractual obligations (you generally do not have a legal obligation to provide us with data, unless this is requested by courts or supervisory authorities). Without this data, we will generally not be able to enter into or process a contract with you (or the entity or person you represent). Also, the website cannot be used if certain information to ensure data traffic (such as IP address) is not disclosed.

Profiling and Automated Decision-Making

We process your personal data partially automated with the aim of evaluating certain personal aspects (profiling). We use profiling in particular to provide our services and to enable you to have effective Human Capital Management. Furthermore, we use profiling to be able to inform and advise you about products. For this purpose, we use evaluation tools that enable us to communicate and advertise according to your needs, including market and opinion research.

Rights of the Data Subject

You have the right of access, rectification, deletion, the right to restrict data processing and otherwise to object to our data processing, in particular those for direct marketing purposes, profiling carried out for direct advertising, and other legitimate interests in the processing within the framework of the data protection law applicable to you and to the extent provided therein, as well as to the disclosure of certain personal data for the purpose of transfer to another body (so-called data portability). Please note, however, that we reserve the right to assert the statutory restrictions on our part, for example if we are obliged to retain or process certain data, have an overriding interest therein (insofar as we are entitled to rely thereon) or need them for the assertion of claims. If costs are incurred by you, we will inform you in advance. We have already informed you about the possibility of revoking your consent in Section 3. Note that the exercise of these rights may conflict with contractual agreements and this may have consequences such as premature contract termination or cost implications. We will inform you in advance in this case, where this is not already contractually regulated.

The exercise of such rights generally requires that you clearly prove your identity (e.g. by a copy of your ID card, where your identity is otherwise not clear or cannot be verified). To assert your rights, you can contact us at the address given in Section 1.

Every data subject also has the right to enforce their claims in court or to file a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

Changes

We can adjust this privacy policy at any time without prior notice. The current version published on our website applies. Insofar as the privacy policy is part of an agreement with you, we will inform you about the change in the event of an update by email or in another suitable manner.