Privacy policy

We, the Organisation of the Swiss Abroad (hereinafter "we" or "OSA"), attach great importance to respecting your privacy and protecting your personal data. We are therefore committed to protecting your rights and ensuring that your personal data is adequately protected.

OSA is regulated primarily by Swiss data protection legislation, namely the Federal Act of 25 September 2020 on Data Protection (FADP) and the Ordinance of 31 August 2022 on Data Protection (ODP).

OSA also complies with Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation, GDPR) to the extent that it applies to us. The European Commission recognises that Swiss data protection law ensures adequate data protection.

The data controller is:

Organisation of the Swiss Abroad (OSA)
Alpenstrasse 26
CH-3006 Bern
info@swisscommunity.org
Tel. +41 (0)31 356 61 00

Please do not hesitate to contact us by telephone, email or letter if you have any questions or concerns about this statement or the processing of personal data.

We use the following data protection agency in accordance with Art. 27 GDPR:

Collegamento svizzero in Italia
Via Palestro 2
Milano - 20121
Italy
presidente@collegamentosvizzero.it

The data protection agency serves as an additional point of contact for data subjects and authorities in the European Union (EU) and the rest of the European Economic Area (EEA) for enquiries related to the GDPR.

4.1. General

We process your personal data in different ways, notably if you are a user of OSA's services (including website www.swisscommunity.org, app users, newsletter subscribers, community members, etc.), if you are an employee of OSA (including job applicants), if you are a participant in youth services and/or events (leaders, participants, coaches, speakers, etc.), if you are a donor (including interested parties), if you are a contracting partner, if you contact us, etc. This data protection declaration therefore applies to all processing of personal data carried out by OSA.

Other legal documents such as General Terms and Conditions (GTC), Terms of Use or Conditions of Participation may apply to individual or additional activities and operations.

To the extent permitted, we also draw certain personal data about you from publicly accessible sources (e.g. internet and social media, press, commercial register, etc.).

4.2. Further notes on the scope of application

4.2.1. Swiss Review

All personal data of the readers of Swiss Review (postal address or email address as well as information on the language version) are managed by the Federal Department of Foreign Affairs (FDFA). The FDFA is legally responsible for this personal data. OSA has no access to this personal data.

Only the personal data of domestic readers and readers of paid subscriptions to Swiss Review are managed by OSA.

4.2.2. Recruit care packages

Every year, OSA sends "recruit care packages” to Swiss recruits from abroad. All personal data of these recruits (surnames, first names, insurance number, date of recruitment, recruit school, classification [fit/unfit], country, contact address in Switzerland, language) are managed by the Swiss armed forces. The Swiss armed forces are legally responsible for this personal data.

We process the personal data that is necessary to carry out our activities and operations in a consistent, user-friendly, secure and reliable manner.

In the course of our activities, we process the following personal data:

• Contact details: Surnames, first names, postal and/or email addresses, telephone numbers, language;
• Personal data specific to each processing operation (see below sections 5.1. - 5.7. and 6).

OSA processes highly sensitive personal data, particularly in connection with the recruitment of new staff and the management of existing staff. Personal data is also processed in connection with the organisation of youth camps and congresses. We do not pass on sensitive personal data to third parties unless we are legally obliged to do so.

We process personal data for the period of time that is required for the particular purpose(s) or by law. Personal data which no longer needs to be processed is anonymised or deleted. OSA passes on certain personal data to the Swiss Federal Archives. The personal data concerned is specified below. This archiving is subject to the Federal Act on Archiving (ArchA), whereby access to the archives is governed by Art. 9 ff ArchA.

We only process personal data with the consent of the data subject, unless the processing is permitted for other legal reasons. Processing without consent may be permissible, for example, for the fulfilment of a contract with the data subject and for corresponding pre-contractual measures, in order to protect our overriding legitimate interests, because the circumstances warrant such processing or based on prior information.

We may have data processed by third parties (so-called sub processors; see section 7). We may process personal data jointly with third parties or transmit it to third parties. These third parties are notably specialised providers whose services we use. We also guarantee data protection for such third parties.

5.1. Users of OSA's services

Only contact data and other personal data voluntarily provided by our users is processed on the basis of Art. 31 para. 2 lit. a FADP and Art. 6 I lit. a and b GDPR.

The purpose of the processing is to provide the services described on www.swisscommunity.org, such as sending out our newsletters and/or brochures and other promotional content or information, as well as the internal organisation of OSA and the compilation of statistics on its services.

5.2. Job applicants and OSA staff

In addition to contact details, details of professional background and skills, bank details, OASI no., identity papers and permits, marital status, medical data (insurance claims), photographs and any other personal data relevant to the performance of the employment and/or mandate contract may be processed on the basis of Art. 31 para. 1 and 2 let. a FADP.

The purpose of the processing is the recruitment, negotiation, conclusion and/or fulfilment of the contract between you and OSA, including the relevant memberships, notifications to insurance companies, internal organisation of OSA and personnel administration (including statistics).

In the event of non-employment, the application documents will be returned and/or destroyed unless the job applicant agrees to us keeping them for possible further professional opportunities. In the event of employment, the retention period varies depending on the document, but is a maximum of 10 years after termination of the contract. Mandatory legal provisions continue to apply.

5.3. Participants in youth services (young people, their parents, camp leaders, etc.)

In addition to the contact details, the following personal data may be processed on the basis of Art. 31 para. 1 and 2 lit. a FADP and Art. 6 I lit. a, b and c GDPR:

• Personal data of the participants (contact details, place of residence, country, date of birth, gender, OASI number, mobile phone number of the participants:(contact details, place of residence, date of birth, sex, OASI number, mobile phone number, nationality, nationality of parents, home canton and place, confirmation that they are Swiss citizens, languages, language skills [for language courses], types of sport, height and weight [for borrowing equipment/clothing], contact person in Switzerland for emergencies during the camp [contact details], confirmation and details of accident, health and liability insurance, interest in group arrival and departure, T-shirt size and number, health and liability insurance, consent to the use of image and video material by OSA, consent to GTC and processing of the data provided, interest in SwissCommunity newsletter, parents' address during camp participation, state of health [i.e. illnesses and allergies, health insurance, medical treatments, diet], vaccinations, extent of medication to be administered by the camp management if necessary, permission to remove ticks, swimming ability and other information provided voluntarily;
• Personal data of parents/relatives/legal representative of minors for a possible contribution reduction (contact details, occupation, family size, income and assets);
• Personal data of camp leaders (contact details, date of birth, gender, language skills, training, camp experience, driving licence, special private extract from the criminal record, train subscription, Y+S acceptance, Y+S no., SLRG recognition, OASI no., state of health [i.e. illnesses and allergies, medical treatments, diet, health insurance]);
• Photographs;
• Other personal data relevant for the running of the camp.

We process this personal data in order to handle applications for participation in the camp, to organise our camps, to keep files of participants, to manage the camp participants and to ensure their safety, to identify the participants, to report possible insurance claims to the insurance companies, to grant possible reductions in contributions, to pay the services of the camp leaders, to improve our camps and to compile statistics about our camps.

In the event of non-participation, your records will be deleted unless you agree to us keeping them for other camps that may be offered to you.

Except in the following cases, personal data will not be disclosed to third parties:

• When participating in a camp, to the other camp participants, camp leaders, camp accommodation providers and to potential third parties that help organise the camp;
• Shared use of workrooms, address database (restricted access) and educationsuisse archives (particularly sensitive personal data will not be disclosed);
• If necessary to protect the safety of the other camp participants;
• For the insurance policies taken out with REGA for the duration of the camp;
• In the case of camp leaders, the Y+S recognition is registered by the Swiss Scout Movement (with the exception of particularly sensitive personal data);
• Registration and recording of all participants and camp leaders in the National Database on Sport (NDS) (except for particularly sensitive personal data);
• If you give us your consent;
• Because of their historical and social value, transfer of photos and lists of participants to the Swiss Federal Archives, which are subject to the Federal Act on Archiving (ArchA), with access to the archives governed by Art. 9 ff ArchA;
• To our sub processors (section 7 below), which we have carefully selected;
• If this is necessary to protect our rights.

5.4. Event participants (congresses and webinars etc.)

In addition to contact details, birth data, photos and any other personal data relevant to the running of the event may be processed on the basis of Art. 31 para. 1 and 2 let. a FADP and Art. 6 I let. a, b and c GDPR.

We process this personal data in order to handle applications for participation in events, to organise our events, to keep files of all participants, to manage the participants and ensure their safety, to identify the participants, to report insurance claims to the insurance companies, to pay for the services of the speakers, to conduct surveys, to improve our events and to compile statistics about our events.

5.5. Donors and sponsors (including potential donors)

In addition to contact details, bank details and all other relevant personal data in connection with fundraising may be processed on the basis of Art. 31 para. 1 and 2 lit. a FADP and Art. 6 I lit. a, b and c GDPR.

The purpose of the processing is fundraising and fund management by donors and sponsors (including statistics), the sending of thank you and/or greeting cards as well as the internal organisation of OSA and the compilation of fundraising statistics.

Except in the following cases, personal data will not be disclosed to third parties:

• Shared use of workrooms, address database (restricted access) and educationsuisse archives (personal data requiring special protection and financial data will not be passed on);
• If you give us your consent;
• If we are obliged to disclose due to a legal obligation or a court order;
• To our sub processors (section 7 below), which we have carefully selected.

5.6. Contractual partners (suppliers, service providers, etc.)

In addition to contact details, bank details and tax numbers may be processed if you enter into a contractual relationship with OSA, based on Art. 31 para. 1 and 2 lit. a FADP and Art. 6 I lit. a, b and c GDPR.

The purpose of the processing is the negotiation, conclusion and/or fulfilment of contracts between you and OSA, including the invoicing and/or payment of services.

Subject to legal obligations, the retention period is generally 10 years from the fulfilment of the contract, taking into account the limitation periods.

Except in the following cases, personal data will not be disclosed to third parties:

• Shared use of workrooms, address database (restricted access) and educationsuisse archives (particularly sensitive personal data will not be passed on);
• If you give us your consent;
• If we are obliged to disclose due to a legal obligation or a court order;
• To our sub processors (section 7 below), which we have carefully selected.

5.7. When making contact

When contact is made, e.g. by filling out our contact form and/or sending an email, letter or telephone call, the personal data, including the contact details provided and any other personal data voluntarily submitted, may be processed on the basis of Art. 31 para. 1 and 2 lit. a FADP and Art. 6 I lit. a and b GDPR. We may store such information, for example, in a customer relationship management system (CRM system) or with comparable tools. If we receive data about other persons, the transmitting persons are obliged to ensure data protection for these persons as well as to ensure the accuracy of this personal data.

The purpose is to process the request.

Except in the following cases, personal data will not be disclosed to third parties:

• Shared use of premises, database (restricted access) and SJAS (Foundation for Young Swiss Abroad) and educationsuisse archives (except for medical and financial personal data);
• If you give us your consent;
• If we are obliged to transfer data due to a legal obligation or a court order;
• To our sub processors (section 7 below), which we have carefully selected.

6.1. Cookies

We may use cookies. Cookies - our own cookies (first-party cookies) as well as cookies from third parties whose services we use (third-party cookies) - are data that are stored in the browser. Such stored data need not be limited to traditional cookies in text form.

Cookies can be stored in the browser temporarily as "session cookies" or for a certain period of time as so-called permanent cookies. "Session cookies" are automatically deleted when the browser is closed. Permanent cookies have a specific storage period. Cookies make it possible notably to recognise a browser the next time it visits our website and thus, for example, to measure the reach of our website.

Cookies can be completely or partially deactivated and deleted at any time in the browser settings. Without cookies, our website may no longer be fully available. We actively request your express consent - if and to the extent necessary - to the use of cookies.

For cookies used for performance and reach measurement or for advertising, a general objection ("opt-out") is possible for many services via AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAd-Choices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

6.2. Server log files

We may collect the following information for each access to our website, provided that this information is transmitted by your browser to our server infrastructure or can be determined by our web server: date and time including time zone, Internet Protocol (IP) address, access status (HTTPS status code), operating system including user interface and version, browser including language and version, individual sub-page of our website accessed including amount of data transferred, website last accessed in the same browser window (referer or referrer).

We store such information, which may also constitute personal data, in server log files. The information is required to ensure that our website is always available, user-friendly and reliable and to ensure data security and thus in particular the protection of personal data - also by third parties or with the help of third parties.

6.3. Tracking pixels

We may use tracking pixels on our website. Tracking pixels are also known as web beacons. Tracking pixels - also from third parties whose services we use - are small, usually invisible images that are automatically retrieved when you visit our website. Pixel counters can be used to collect the same information as server log files.

6.4. Comments

We enable you to publish comments on our website. In this context, we process notably the information that the person making the comment transmits to us, but also the Internet Protocol (IP) address used as well as the date and time. This information is required to enable the publication of comments and to ensure protection against misuse, which is in our overriding legitimate interest.

6.5. Notifications and messages

We send notifications and communications by email and through other communication channels.

6.5.1. Success and reach measurement

Notifications and messages may contain web links or tracking pixels that record whether an individual message has been opened and which web links have been clicked on. Such web links and tracking pixels may also track usage of notifications and communications on a person-specific basis. We need this statistical recording of usage for performance and reach measurement in order to be able to send notifications and messages based on the needs and reading habits of the recipients in an effective and user-friendly manner as well as consistently, securely and reliably.

6.5.2. Consent and objection

As a matter of principle, you must expressly consent to the use of your email address and other contact addresses, unless such use is permitted for other legal reasons. For any consent, we use the "double opt-in" procedure where possible, i.e. you will receive an email with a web link that you must click to confirm so that no misuse by unauthorised third parties can take place. We may log such consents including Internet Protocol (IP) address, date and time for evidence and security reasons.

In principle, you can object to receiving notifications and communications such as newsletters at any time. With such an objection, you can simultaneously object to the statistical recording of use for performance and reach measurement. Necessary notifications and communications in connection with our activities and operations remain reserved.

6.5.3. Service provider for notifications and messages

We send notifications and messages with the help of specialised service providers.

6.6. Social media

We are present on social media platforms and other online platforms in order to communicate with interested persons and to provide information about our activities and operations. In connection with such platforms, personal data may also be processed outside Switzerland and the EEA.

The General Terms and Conditions (GTC) and Terms of Use as well as data protection declarations and other provisions of the individual operators of such platforms also apply in each case. These provisions notably provide information about the rights of data subjects vis-à-vis the given platform.

For our social media presence on Facebook, including so-called page insights, we are - if and insofar as the GDPR is applicable - jointly responsible with Meta Platforms Ireland Limited (Ireland). Meta Platforms Ireland Limited is part of the Meta companies (including in the USA). Page insights provide information about how visitors interact with our Facebook presence. We use Page Insights to help us deliver our social media presence on Facebook in an effective and user-friendly way.

6.7. Third-party services

We use services provided by specialised third parties in order to carry out our activities and operations in a consistent, user-friendly, secure and reliable manner. Such services enable us, among other things, to embed functions and content in our website. In the case of such embedding, the services used record the Internet Protocol (IP) addresses of the users at least temporarily where this is technically essential.

For necessary security-related, statistical and technical purposes, third parties whose services we use may process data in connection with our activities and operations in aggregated, anonymised or pseudonymised form. This includes, for example, performance or usage data in order to offer a given service.

We use in particular:

• Google services: Provider: Google LLC (USA)/Google Ireland Limited (Ireland) for users in the EEA and Switzerland; General information on data protection: Data protection and security principles; Privacy policy; Google is committed to complying with applicable data protection laws; How Google uses information from sites or apps that use our services; How Google uses cookies.
• Services from Microsoft: Providers: Microsoft Corporation (USA)/Microsoft Ireland Operations Limited (Ireland) for users in the EEA, the UK and Switzerland; General information on data protection: Privacy at Microsoft; Data protection and privacy (Trust Center); Privacy statement; Data protection dashboard (data and privacy settings).

6.7.1. Digital infrastructure

We use services from specialised third parties to provide us with the digital infrastructure we need in connection with our activities and operations. These include, for example, hosting and storage services from selected providers.

We use in particular:

• METANET: Hosting provider: METANET AG (Switzerland); Data protection information: Privacy policy.

6.7.2. Scheduling

We use the services of specialised third parties to make appointments online, for example for meetings. In addition to this data protection declaration, any directly visible conditions of the services used, such as terms of use or data protection declarations, also apply.

We use in particular:

• Doodle: Online appointment scheduling; provider: Doodle AG (Switzerland) as a subsidiary of TX Group AG (Switzerland); Data protection information: Privacy policy; General Terms and Conditions of the Processing of Personal Data.

6.7.3. Audio and video conferences

We use specialised audio and video conferencing services to communicate online. For example, to hold virtual meetings or conduct online lessons or webinars. For participation in audio and video conferences, the legal texts of the individual services such as data protection declarations and terms of use also apply.

Depending on the circumstances, we recommend muting the microphone by default when participating in audio or video conferences, as well as blurring the background or fading in a virtual background.

We use in particular:

• Microsoft Teams: platform for, among other things, audio and video conferencing; provider: Microsoft; Teams-specific information: Privacy and Microsoft Teams.
• Zoom: video conferencing; provider: Zoom Video Communications Inc. (USA); data protection information: Privacy statement; Privacy at Zoom; Legal compliance.

6.7.4. Fonts

We use third-party services to embed selected fonts as well as icons, logos and symbols on our website.

We use in particular:

• Google Fonts: fonts; provider: Google; Google fonts-specific information: Privacy and Google Fonts; Privacy and data collection.

6.8. Website extensions

We use extensions for our website in order to use additional functions.

We use in particular:

• Google reCAPTCHA: Spam protection (distinguishing between wanted comments from humans and unwanted comments from bots such as spam); provider: Google; Google reCAPTCHA-specific details: What is reCAPTCHA?.

6.9. Success and reach measurement

We use services and programmes to determine how our online offering is used. For example, we may measure the success and reach of our activities and operations and the impact of third-party links on our website. But we can also, for example, test and compare how different versions of our online offer or parts of it are used (A/B test method). Based on the results of the success and reach measurement, we can notably correct errors, strengthen popular content or make improvements to our online offer.

When using services and programmes for performance and reach measurement, the Internet Protocol (IP) address of individual users must be stored. IP addresses are always shortened (IP masking) in order to follow the principle of data economy through the corresponding pseudonymisation and thus to improve the data protection of users.

When using services and programmes for performance and reach measurement, cookies may be used and user profiles may be created. User profiles include, for example, the pages visited or content viewed on our website, information on the size of the screen or browser window and the - at least approximate - location. As a matter of principle, user profiles are only created pseudonymously. We do not use user profiles to identify individual users. Individual services of third parties with which users are registered may be able to assign the use of our online services to the user account or user profile of the given service.

We use in particular:

• AWStats: Success and reach measurement; developer: AWStats (free open-source software); Data protection information: What is AWStats / Overview of functions.
• Google Analytics: performance and reach measurement; provider: Google; Google Analytics-specific information: measurement also across different devices and browsers (cross device tracking) as well as with pseudonymised Internet Protocol (IP) addresses, which are only transmitted in full to Google in the USA as an exception, data protection, browser add-on to deactivate Google Analytics.
• Google Tag Manager: Integration and management of other services for performance and reach measurement as well as other services from Google and third parties; provider: Google; Google Tag Manager-specific information: Data collected with Google Tag Manager; further information on data protection can be found in the individual integrated and managed services.

We take care to ensure appropriate data protection when choosing our sub processors. Our most important sub processors are:

• General cooperation: Foundation for Young Swiss Abroad (FYSA), Switzerland; Swiss federal and cantonal administration (FOSPO Youth and Sport, Federal Archives, Sport Office of the canton of Berne, etc.);
• IT providers: Plus und Plus AG, Switzerland; Hausformat GmbH, Switzerland; ProIT Informatik AG, Switzerland; DataTrust AG, Switzerland; Cobra Computer's Brainware AG, Switzerland; etc;
• Human Resources: HR Service Center GmbH, Switzerland;
• Accounting and payment transactions: Sage Schweiz AG, Switzerland; Payrexx AG, Switzerland; Paypal Inc, USA; Stripe Inc, USA.
• Various insurance companies, in particular social insurance companies and REGA AG, Switzerland;
• Newsletter and Community: MAXONY Suisse SA, Switzerland; Hivebrite, France; Hivebrite has compiled a list of subcontractors for data subjects: https://hivebrite.com/legal/subprocessors
• Emails and related data: Microsoft (Outlook, SSL-protected), USA.
• Telephony: gfeller elektro (part of ETAVIS Bern-Mittelland AG), Switzerland; Swisscom AG, Switzerland; Wingo (part of Swisscom (Schweiz) AG), Switzerland;
• Video conferencing: Zoom Video Communications Inc, USA; Microsoft Teams, USA; see also section 6.7.3.
• Mailings: Post CH AG, Switzerland; SwissMail International AG, Switzerland; G3 Worldwide Mail (Switzerland) AG, Switzerland; Arcmedia AG, Switzerland; Twipe Mobile Solutions, Belgium;
• Surveys: SurveyMonkey Inc, USA;
• Swiss Review readership surveys: Jörg Schneider, js studien und analysen, Switzerland.

We process personal data in Switzerland and the EEA. However, we may also export or transfer personal data to other countries, in particular in order to process it or have it processed there.

We may export personal data to all states and territories on earth, provided that the law there ensures adequate data protection in accordance with the decision of the Swiss Federal Council and - if and insofar as the GDPR applies - in accordance with the decision of the European Commission.

We may transfer personal data to countries whose law does not guarantee adequate data protection, provided that data protection is guaranteed by other means, in particular on the basis of standard data protection clauses or with other appropriate guarantees. By way of exception, we may export personal data to countries without adequate or appropriate data protection if the special data protection law requirements are met, for example the express consent of the data subjects or a direct connection with the conclusion or fulfilment of a contract. We will be happy to provide data subjects with information on any guarantees or a copy of any guarantees on request.

We take appropriate technical and organisational measures to ensure data security commensurate with the risk involved. By way of illustration, the personal data we process is secured and access to this data is restricted to those who need it. Our staff are trained, and various internal procedures and policies are in place. However, we cannot guarantee absolute data security.

To avoid data loss, OSA's data is backed up daily in a DataTrust AG data centre. From there, the data is distributed to two other DataTrust AG data centres so that the data is always available. All DataTrust AG data centres are located in Switzerland. The daily data is archived by DataTrust AG for 10 years in accordance with the law.

Access to our website is via transport encryption (SSL/TLS, in particular with the Hypertext Transfer Protocol Secure, abbreviated HTTPS). Most browsers indicate transport encryption with a padlock in the address bar.

Our digital communication - like all digital communication in principle - is subject to mass surveillance without cause or suspicion and other surveillance by security authorities in Switzerland, the rest of Europe, the United States of America (USA) and other countries. We cannot directly influence the processing of personal data by secret services, police agencies and other security authorities.

Any person affected by data processing as set out in this privacy policy may contact OSA to exercise the rights guaranteed by applicable Swiss or European law, i.e. the right of access, the right of rectification, the right to be forgotten, the right to restrict processing, the right to object and, in certain cases, the right to data transfer, as well as the right to lodge a complaint with the competent authority.

To exercise these rights, you must submit a request to OSA (using the contact details in section II). We will endeavour to respond to this within 30 days.

If data processing is based on consent, this can be revoked at any time without giving reasons with future effect (using the contact details in section II). In this case, you will be sent instructions on how to do it.

This privacy policy has been created in part using the data protection generator of Datenschutzpartner.

We reserve the right to change this privacy policy at any time. The currently valid version is the version published on the OSA website: www.swisscommunity.org.

In the event of any discrepancies between the different language versions of this privacy policy, the German version shall prevail.