Privacy Policy

nextesy AG
Bändliweg 20, 8048 Zurich, Switzerland

nextesy AG, based in Zurich, is a joint-stock company in accordance with Art. 620 et seq. CC. In this privacy policy, we, nextesy AG (hereinafter referred to as we or us), explain how we collect and otherwise process personal data. This privacy policy is addressed, for example, to our clients (hereinafter referred to as "clients"), employees (including former employees as well as applicants), and suppliers/service providers or subcontractors (hereinafter referred to as you). This is not an exhaustive description; where applicable, contracts, other privacy policies, or general terms and conditions, terms of participation, and similar documents regulate specific matters. Personal data is understood to mean all information relating to an identified or identifiable person.

If you provide us with personal data of other persons (e.g. your clients, your employees, your business partners, your family members, or other third parties), please ensure that these persons are aware of this privacy policy and only share their personal data with us if you are permitted to do so and if this personal data is correct. You warrant that you have lawfully collected the personal data of third parties forwarded to us, i.e. with consent for collection and forwarding to third parties, including us.

This privacy policy is designed to meet the requirements of the Swiss Data Protection Act ("FADP") and the European General Data Protection Regulation ("EU GDPR"). Whether and to what extent these legal bases are applicable depends on the individual case.

Controller / Data Protection Officer / Representative

The controller responsible for the data processing described here is nextesy AG, Zurich. Internally, Milos Calija, CTO, is responsible for data processing. If you have any data protection concerns, you can notify us at the following contact address: nextesy AG, Bändliweg 20, 8048 Zurich, Switzerland, milos@nextesy.com.

Collection and Processing of Personal Data

We primarily process the personal data that we receive in the context of our business relationship with our clients or their contractual or legal representatives/assistants or authorized signatories, with our business partners, with our employees, and with our suppliers and subcontractors from them or from persons associated with them, or which we collect from their users during the operation of our websites and other applications.

We offer our clients comprehensive services in the field of Human Capital Management. This means that we offer our clients a wide range of procedures and solutions for recruiting as well as the management and development of a company's human capital – i.e., its workforce. If you want to become our client, we will ask you for various information. In the course of providing our services, we may receive further personal information about you, which may include the following data:

Personal information of the client or its corporate bodies and employees directly interacting with us: name, date of birth, address, e-mail address, contact details, nationality; Financial information: payment agreements, insurance information, sources of funding, etc. Personal information of our client's employees:

• Personal information of the client or its corporate bodies and employees directly interacting with us: name, date of birth, address, e-mail address, contact details, nationality;

• Financial information: payment agreements, insurance information, sources of funding, etc.

• Personal information of our client's employees:

• General personal information such as last name, first name, date of birth, religion, gender, address, names of spouses and children, salary, AHV no., copy of passports or identity cards, phone number, private e-mail;

• Recruitment information (including application documents, requirement profiles);

• Hiring information (employment contracts including all information contained therein);

• Qualifications and employee appraisals;

• Records of employee discussions;

• Measures for the support and development of employees;

• Working hours recording;

• Information on health/illness, accident, maternity and paternity leave;

• Information on financial situation and debts for transfer to the debt collection office;

• Business correspondence and e-mails;

• Trade union activities of employees;

• Criminal and debt collection register extracts;

• Calendar entries;

• Chats.

By means of this contact information, we can verify you, provide our services to your maximum satisfaction and, if necessary, inform you about changes / important situations regarding our services (for which we may send you or your relatives or representatives an e-mail or contact you or the aforementioned persons in another way).

Our services are designed to relieve our clients of as much work as possible in connection with Human Capital Management. If you use our services, we therefore ask you in detail about your personal information and give you the opportunity to provide further information about yourself on your own initiative. We also offer you the possibility to upload extensive data records about your employees onto our platform.

You are aware that sensitive personal data (e.g., regarding health, religion, trade union activity) may be collected about you as a client and, in particular, about your employees, and passed on to external providers (e.g., providers of server or cloud storage space), and you expressly agree to this.

As an employee, supplier/service provider, or subcontractor, we may ask you for the following data or request related documents and process this data:

• Personal information: name, date of birth, address, nationality, contact details, possibly data on family members (e.g. for apprentices/trainees) or emergency contacts;

• Financial information: creditworthiness information/debt collection register extracts, etc.;

• Tax information/AHV numbers, etc.;

• Information on criminal records: criminal record extracts, etc.

You are aware that we use the transmitted data for the development of processes and the training of our own systems (e.g., automated processes and self-learning programs). The content developed based on your data (e.g. processes) is our intellectual property. [You can object to the use of your data for the development of our processes and the training of our systems by declaring an opt-out before you obtain our services.]

In the context of employment, we collect and process various data of employees. In addition to the data listed above, this includes the following information for the personnel file: signed/accepted contracts and regulations, sick days, insurance, start date/termination date, skills, work history, technical and interpersonal skills, absences, holidays, salary, benefits, and evaluations/appraisals. This information is stored for as long as legally required. The personnel file is subject to regular triage, and unnecessary information is deleted from it.

When you contact us – for example, by writing us an e-mail – we receive certain personal data about you. This data includes, in particular, contact details, the content of your communication, and the content of any attachments or enclosures. We use this data to process your contact request.

Should you subscribe to our newsletter, we collect your contact details and, if applicable, information that allows us to verify that you are the owner of the specified e-mail address and that its owner agrees to receive the newsletter. You can withdraw your consent to this at any time - for example, via the 'unsubscribe' link in the newsletter.

Personal Data that We Collect in the Context of Using Our Online Services

When you use our online services, we collect data on how you access and use them ("usage data"). This usage data is sent by your browser each time you visit our website and may include information such as the IP address, browser type, browser version, the pages of our website that you visit, the time and date of your visit, the time spent on those pages, and other anonymised data regarding the selections made on the website. If you access our website from a mobile device, the usage data may also include information about the type of your device, its unique ID, and other diagnostic data. The collection of this usage data serves to provide, maintain, and improve our website and your user experience. We may also share the data in anonymised form for research purposes with selected research institutions.

We, as well as our partners (e.g., our advertising and analytics partners), use cookies and related tracking technologies to track your use of our services and to collect certain data. You can find more information about the cookie categories we use and third-party providers in our cookie information. You can adjust your choices at any time via the cookie settings.

Personal Data We Receive from Third Parties

Other users of our services may provide personal data about you when they contact us. We may receive data about you and your activities on and off our website from our partners (e.g. from our advertising and analytics partners). We can thus receive information about your interest in and activities related to our services. We may use this data to improve and promote our services and your user experience. Other functions on our platform may require us to collect data from third-party providers on behalf of our users. Details on the individual services can be found in the following sections:

Publicly Accessible Sources

Insofar as this is permitted, we also obtain certain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, the press, the internet) or receive such data from public authorities and other third parties. This applies in particular to our suppliers/service providers and our employees. In addition to the data that you provide to us directly, the categories of personal data that we receive about you from third parties include, in particular, information from public registers, information that we learn in connection with official and judicial proceedings, information in connection with your professional functions and activities (so that we can, for example, conclude and process transactions with your employer with your help), information about you in correspondence and discussions with third parties, credit checks (insofar as we process transactions with you personally), information about you given to us by people in your environment (business partners, service providers, family, advisors, legal representatives, etc.) so that we can conclude or process contracts with you or involving you (e.g. references), your address for deliveries, powers of attorney, information on compliance with legal requirements such as anti-money laundering and export restrictions, information from banks, insurance companies, sales and other contractual partners of ours regarding the use or provision of services by you (e.g. payments made, contract processing completed), information about you from media and the internet (insofar as this is indicated in the specific case, e.g. in the context of an application, press review, marketing/sales, etc.), your addresses and, if applicable, interests and other sociodemographic data (for marketing), data in connection with the use of the website (e.g. IP address, MAC address of the smartphone or computer, details of your device and settings, cookies, date and time of the visit, accessed pages and content, used functions, referring website, location details). In the context of our business relationship with our clients and other business partners, we may receive sensitive personal data from them and other involved persons.

We use the personal data we collect primarily to conclude and process our contracts with our clients, business partners, and employees, in particular in connection with our Human Capital Management services, the operation of our website and our online platforms, and to comply with our legal obligations in Switzerland and abroad. If you work for one of our clients or business partners, you may of course also be affected by your personal data in this capacity.

In addition, we process personal data about you and other persons, where permitted and where we deem it appropriate, for the following purposes, in which we (and sometimes third parties) have a legitimate interest corresponding to the purpose:

• Offering and developing our offers, services, websites, and platforms on which we are present;

• Support services for users of our offers, services, websites, software, and other platforms;

• Communication with third parties and processing of their inquiries (e.g. applications, media inquiries);

• Testing and optimization of procedures for needs analysis for the purpose of direct client contact as well as collection of personal data from publicly accessible sources for the purpose of client acquisition;

• Advertising and marketing (including holding events), provided you have not objected to the use of your data (if we send you advertising as an existing client of ours, you can object to this at any time; we will then put you on a blocklist against further advertising mailings);

• Market and opinion research, media monitoring;

• Assertion of legal claims and defence in connection with legal disputes and official proceedings;

• Prevention and investigation of criminal offenses and other misconduct (e.g. conducting internal investigations, data analyses to combat fraud, compliance, and adherence to regulatory requirements);

• Ensuring our operations, in particular the IT, our websites, apps if applicable, and other platforms;

• Video surveillance to maintain house rights and other measures for IT, building, and facility security and protection of our employees and other persons and values belonging or entrusted to us (such as access controls, visitor lists, network and mail scanners, telephone recordings);

• Purchase and sale of business divisions, companies, or parts of companies and other corporate transactions and, associated therewith, the transfer of personal data as well as measures for business management and, to the extent necessary, to comply with legal and regulatory obligations as well as internal regulations of ours.

Insofar as you have given us consent to process your personal data for specific purposes (for example, when registering to receive newsletters or conducting clarifications), we process your personal data within the scope of and based on this consent, unless we have another legal basis and we require one. Consent that has been granted can be withdrawn at any time, which, however, has no effect on data processing that has already taken place and to which you (possibly implicitly) consented.

We only process sensitive personal data if this is absolutely necessary to conclude and process our contracts with our clients and business partners. In particular, these are not used for advertising and marketing purposes or passed on to third parties without compelling necessity.

Cookies / Tracking and Other Technologies in Connection with the Use of Our Website

We typically use cookies and comparable techniques on our websites and platforms with which your browser or device can be identified. A cookie is a file that is sent to your computer or automatically stored on your computer or mobile device by the web browser used when you visit our website or use a platform. If you call up this website again, we can recognize you, even if we do not know who you are. In addition to cookies that are only used during a session and deleted after your website visit ("session cookies"), cookies can also be used to store user settings and other information over a certain period of time (e.g. two years) ("permanent cookies"). However, you can set your browser so that it rejects cookies, only saves them for one session, or otherwise deletes them prematurely. Most browsers are preset to accept cookies. We use permanent cookies so that you can save user settings (e.g. language, auto-login), so that we can better understand how you use our offers and content, and so that we can show you offers and advertisements tailored to you (which can also happen on websites of other companies; however, they do not learn from us who you are, if we even know that ourselves, because they only see that on their website is the same user who was also with us on a certain page). Some of the cookies are set by us, and some are also set by contractual partners with whom we work. If you block cookies, it may be that certain functionalities (such as language selection, contact forms, platform processes, etc.) no longer work.

Our website may contain links to websites of other providers. We have no influence over these websites, their content, offers, or availability, or the privacy policies and regulations applicable there. Any liability for third-party websites is rejected.

In our newsletters and other marketing e-mails, we also partially and to the extent permitted include visible and invisible image elements, by retrieving which from our servers we can determine whether and when you opened the e-mail, so that we can also measure and better understand how you use our offers and tailor them to you. You can block this in your e-mail program; most are preset to do this. By using our websites and consenting to receive newsletters and other marketing e-mails, you agree to the use of these techniques. If you do not want this, you must set your browser or e-mail program accordingly.

We sometimes use Google Analytics or comparable services on our websites. This is a service provided by third parties, which may be located in any country in the world (in the case of Google Analytics, it is Google Ireland (based in Ireland), Google Ireland relies on Google LLC (based in the USA) as its processor (both "Google"), www.google.com), with which we can measure and evaluate the use of the website (not personally identifiable). Permanent cookies are also used for this purpose, which the service provider sets. We have configured the service so that the IP addresses of visitors from Google in Europe are shortened before being forwarded to the USA and therefore cannot be traced. We have switched off the "Data sharing" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles, and link this data to the Google accounts of these persons. Insofar as you have registered with the service provider yourself, the service provider also knows you. The processing of your personal data by the service provider then takes place under the responsibility of the service provider in accordance with its data protection provisions. The service provider merely informs us how our respective website is used (no information about you personally).

A detailed overview of the cookie categories we use and third-party providers can be found in our cookie information.

Google Ads

We use Google Ads on our website. Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads allows us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on the user data available at Google (e.g. location data and interests) (target group targeting). As the website operator, we can quantitatively evaluate this data by, for example, analyzing which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.
The use of this service is based on your consent. Consent can be withdrawn at any time. The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

Data Disclosure and Data Transfer

In the context of our business activities and the purposes set out in Section 3, we also disclose data to third parties, where permitted and where we deem it appropriate, whether because they process it for us or because they want to use it for their own purposes. This involves, in particular, the following entities:

Group companies,

service providers of ours, including their processors (such as IT providers, server providers, consultants and lawyers, providers of Artificial Intelligence solutions and plug-ins);

dealers, suppliers, subcontractors, and other business partners;

external service providers of our clients;

authorities, official agencies, or courts;

media;

the public, including visitors to websites and social media;

competitors, industry organizations, associations, organizations, and other bodies;

acquirers or parties interested in acquiring business units, companies, or other parts of our operations;

other parties in potential or actual legal proceedings;

all together hereinafter referred to as "recipients".

These recipients are located in Switzerland, Germany, Serbia, and the USA, but can be anywhere in the world. If a recipient is located in a country without adequate statutory data protection, nextesy contractually obliges the recipient to comply with the applicable data protection (for this purpose we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless they are already subject to a legally recognized framework to ensure data protection and we cannot rely on an exemption provision.

Sensitive personal data will only be passed on if this is absolutely necessary to conclude and process our contracts with our clients and business partners or if we are legally obliged to do so.

Duration of Storage of Personal Data

We process and store your personal data as long as it is required to fulfill our contractual and legal obligations or otherwise for the purposes pursued with the processing, i.e., for example, for the duration of the entire business relationship (from the initiation, processing to the termination of a contract) as well as beyond that in accordance with the statutory retention and documentation obligations under the Code of Obligations or the Business Record-Keeping Ordinance. It is possible that personal data will be kept for the period during which claims can be asserted against our company and insofar as we are otherwise legally obliged to do so or legitimate business interests require this (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for the purposes mentioned above, it will in principle and as far as possible be deleted or anonymized. For operational data (e.g. system protocols, logs), generally shorter retention periods of twelve months or less apply.

Data Security

We take appropriate technical and organizational security precautions to protect your personal data from unauthorized access and misuse, such as issuing instructions, training courses, IT and network security solutions, as well as encryption of data carriers and transmission.

Sensitive personal data is only processed by qualified employees who have signed a corresponding confidentiality agreement.

Obligation to Provide Personal Data

In the context of our business relationship, you must provide those personal data that are necessary for the initiation and execution of a business relationship and the fulfillment of the associated contractual obligations (you do not usually have a statutory obligation to provide us with data, unless requested by courts or supervisory authorities). Without this data, we will usually not be able to conclude or process a contract with you (or the entity or person you represent). Also, the website cannot be used if certain information to ensure data traffic (such as IP address) is not disclosed.

Profiling and Automated Decision-Making

We process your personal data partially automatically with the aim of evaluating certain personal aspects (profiling). We use profiling in particular to provide our services and to enable you to have effective Human Capital Management. Furthermore, we use profiling to be able to inform and advise you about products. In doing so, we use evaluation tools that enable us to carry out needs-based communication and advertising, including market and opinion research.

Rights of the Data Subject

Within the framework of the data protection law applicable to you and to the extent provided for therein, you have the right to access, rectification, erasure, the right to restrict data processing and otherwise to object to our data processing, in particular that for the purposes of direct marketing, profiling carried out for direct marketing, and other legitimate interests in the processing, as well as the right to receive certain personal data for the purpose of transfer to another entity (so-called data portability). Please note, however, that we reserve the right to assert the statutory restrictions on our part, for example if we are obliged to store or process certain data, have an overriding interest in doing so (insofar as we are entitled to rely on this), or require it for the assertion of claims. If you incur costs, we will inform you in advance. We have already informed you about the possibility of withdrawing your consent in Section 3. Note that the exercise of these rights may conflict with contractual arrangements and this may have consequences such as premature contract termination or cost implications. We will inform you in advance in this case, where this is not already contractually regulated.

The exercise of such rights usually requires that you clearly prove your identity (e.g. by a copy of an ID card, where your identity is otherwise not clear or cannot be verified). To assert your rights, you can contact us at the address specified in Section 1.

Every data subject also has the right to enforce their claims in court or to file a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

Amendments

We can adjust this privacy policy at any time without prior notice. The current version published on our website applies. Insofar as the privacy policy is part of an agreement with you, we will inform you of the change in the event of an update by e-mail or in another appropriate way.