Privacy policy

Somaha Foundation privacy policy

This Pri­vacy Policy pro­vi­des infor­ma­tion about the pro­ces­sing of per­so­nal data in con­nec­tion with our acti­vi­ties and ope­ra­ti­ons, inclu­ding our web­site under the domain name somaha-stiftung.ch. In par­ti­cu­lar, we inform you why, how, and where we pro­cess per­so­nal data. We also pro­vide infor­ma­tion about the rights of indi­vi­du­als whose data we pro­cess.

For spe­ci­fic or addi­tio­nal acti­vi­ties and ope­ra­ti­ons, we may publish fur­ther pri­vacy poli­cies or other infor­ma­tion rela­ting to data pro­tec­tion.

1. Contact Information

The con­trol­ler respon­si­ble for data pro­ces­sing within the mea­ning of data pro­tec­tion law is:

Somaha Foun­da­tion
Wein­berg­strasse 102
8006 Zürich
Switz­er­land

info@somaha-stiftung.ch

In spe­ci­fic cases, third par­ties may be respon­si­ble for the pro­ces­sing of per­so­nal data, or there may be joint respon­si­bi­lity with third par­ties. Upon request, we will gladly pro­vide infor­ma­tion regar­ding the respec­tive respon­si­bi­lity.

2.1 Definitions

Data sub­ject: A natu­ral per­son whose per­so­nal data we pro­cess.

Per­so­nal data: Any infor­ma­tion rela­ting to an iden­ti­fied or iden­ti­fia­ble natu­ral per­son.

Sen­si­tive per­so­nal data: Data rela­ting to trade union, poli­ti­cal, reli­gious or phi­lo­so­phi­cal views or acti­vi­ties, health data, data con­cer­ning inti­mate mat­ters or racial or eth­nic ori­gin, gene­tic data, bio­me­tric data uni­quely iden­ti­fy­ing a natu­ral per­son, data rela­ting to cri­mi­nal or admi­nis­tra­tive sanc­tions or pro­cee­dings, and data rela­ting to social assis­tance mea­su­res.

Pro­ces­sing: Any hand­ling of per­so­nal data, regard­less of the means and pro­ce­du­res used, such as query­ing, com­pa­ring, adap­ting, archi­ving, sto­ring, rea­ding, dis­clo­sing, obtai­ning, recor­ding, coll­ec­ting, dele­ting, reve­al­ing, orga­ni­zing, saving, modi­fy­ing, dis­se­mi­na­ting, lin­king, des­troy­ing, and using per­so­nal data.

We pro­cess per­so­nal data in accordance with Swiss law, in par­ti­cu­lar the Fede­ral Act on Data Pro­tec­tion (Data Pro­tec­tion Act, FADP) and the Ordi­nance on Data Pro­tec­tion (Data Pro­tec­tion Ordi­nance, DPO).

3. Nature, Scope, and Purpose of Personal Data Processing

We pro­cess per­so­nal data that is neces­sary to con­duct our acti­vi­ties and ope­ra­ti­ons on a sus­tainable, user-fri­endly, secure, and relia­ble basis. The per­so­nal data pro­ces­sed may include, in par­ti­cu­lar, brow­ser and device data, con­tent data, com­mu­ni­ca­tion data, meta­data, usage data, mas­ter data (inclu­ding inven­tory and cont­act data), loca­tion data, tran­sac­tion data, con­tract data, and pay­ment data. Per­so­nal data may also include sen­si­tive per­so­nal data.

We also pro­cess per­so­nal data that we receive from third par­ties, obtain from publicly available sources, or coll­ect in the course of our acti­vi­ties and ope­ra­ti­ons, to the ext­ent that such pro­ces­sing is per­mit­ted.

We pro­cess per­so­nal data, where neces­sary, with the con­sent of the data sub­jects. In many cases, we may pro­cess per­so­nal data wit­hout con­sent, for exam­ple to com­ply with legal obli­ga­ti­ons or to pro­tect over­ri­ding inte­rests. We may also request con­sent from data sub­jects even where it is not requi­red.

We pro­cess per­so­nal data for the dura­tion neces­sary for the respec­tive pur­pose. We anony­mize or delete per­so­nal data, in par­ti­cu­lar in accordance with sta­tu­tory reten­tion and limi­ta­tion peri­ods.

4. Automation and Artificial Intelligence (AI)

We may pro­cess per­so­nal data auto­ma­ti­cally or use arti­fi­cial intel­li­gence to pro­cess per­so­nal data.

We may use pro­fil­ing to auto­ma­ti­cally eva­luate cer­tain per­so­nal aspects rela­ting to data sub­jects. Pro­fil­ing ser­ves, for exam­ple, to ana­lyze or pre­dict inte­rests, beha­vi­ors, or per­so­nal pre­fe­ren­ces.

We will inform you on a case-by-case basis about decis­i­ons that are based exclu­si­vely on the auto­ma­ted pro­ces­sing of per­so­nal data and that have legal con­se­quen­ces for the data sub­jects or signi­fi­cantly affect them (auto­ma­ted indi­vi­dual decis­i­ons).

5. Disclosure of Personal Data

We may dis­c­lose per­so­nal data to third par­ties, have it pro­ces­sed by third par­ties, or pro­cess it jointly with third par­ties. Such third par­ties may include, for exam­ple, spe­cia­li­zed ser­vice pro­vi­ders whose ser­vices we use. These third par­ties may, in turn, dis­c­lose per­so­nal data to other third par­ties.

In the course of our acti­vi­ties and ope­ra­ti­ons, we may dis­c­lose per­so­nal data in par­ti­cu­lar to banks and other finan­cial ser­vice pro­vi­ders, govern­ment agen­cies, edu­ca­tio­nal and rese­arch insti­tu­ti­ons, con­sul­tants and att­or­neys, accoun­ting and fidu­ciary ser­vice pro­vi­ders, debt coll­ec­tion agen­cies, inte­rest groups, IT ser­vice pro­vi­ders, coope­ra­tion part­ners, cre­dit and busi­ness infor­ma­tion agen­cies, logi­stics and ship­ping com­pa­nies, mar­ke­ting and adver­ti­sing agen­cies, media, parent, sis­ter, and sub­si­diary com­pa­nies, orga­niza­ti­ons and asso­cia­ti­ons, social insti­tu­ti­ons, tele­com­mu­ni­ca­ti­ons com­pa­nies, insu­rance com­pa­nies, and pay­ment ser­vice pro­vi­ders.

6. Communication

We pro­cess per­so­nal data in order to com­mu­ni­cate with indi­vi­du­als as well as with govern­ment agen­cies, orga­niza­ti­ons, and com­pa­nies. In doing so, we pro­cess in par­ti­cu­lar data that a data sub­ject pro­vi­des to us when cont­ac­ting us, for exam­ple by mail or email. We may store such data in an address book or with com­pa­ra­ble tools.

Third par­ties who pro­vide us with data about other indi­vi­du­als are legally obli­ga­ted to inde­pendently ensure the data pro­tec­tion of those data sub­jects. In par­ti­cu­lar, they must ensure that they are aut­ho­ri­zed to pro­vide such data, and they must also gua­ran­tee the accu­racy of the data pro­vi­ded.

7. Applications

We pro­cess per­so­nal data of appli­cants inso­far as it is neces­sary to assess their sui­ta­bi­lity for employ­ment or for the sub­se­quent per­for­mance of an employ­ment con­tract. The requi­red per­so­nal data is deri­ved in par­ti­cu­lar from the infor­ma­tion reques­ted, for exam­ple in con­nec­tion with a job pos­ting. We may publish job pos­tings with the assis­tance of sui­ta­ble third par­ties, for exam­ple in elec­tro­nic and print media or on job por­tals and recruit­ment plat­forms.

We also pro­cess per­so­nal data that appli­cants vol­un­t­a­rily pro­vide or publish, par­ti­cu­larly as part of cover let­ters, resu­mes, and other appli­ca­tion mate­ri­als, as well as through online pro­files.

We may allow appli­cants to store their infor­ma­tion in our talent pool so that we can con­sider them for future job ope­nings. We may also use such infor­ma­tion to main­tain cont­act and pro­vide updates. If we believe that an appli­cant is a sui­ta­ble can­di­date for an open posi­tion based on the infor­ma­tion pro­vi­ded, we may inform the appli­cant accor­din­gly.

8. Data Security

We imple­ment appro­priate tech­ni­cal and orga­niza­tio­nal mea­su­res to ensure data secu­rity com­men­su­rate with the respec­tive risk. Through these mea­su­res, we ensure in par­ti­cu­lar the con­fi­den­tia­lity, avai­la­bi­lity, tracea­bi­lity, and inte­grity of the per­so­nal data we pro­cess; we can­not, howe­ver, gua­ran­tee abso­lute data secu­rity.

Access to our web­site and our other digi­tal pre­sence is secu­red via trans­port encryp­tion (SSL / TLS, in par­ti­cu­lar using the Hyper­text Trans­fer Pro­to­col Secure, abbre­via­ted as HTTPS). Most brow­sers warn users before visi­ting a web­site wit­hout trans­port encryp­tion.

Our digi­tal com­mu­ni­ca­ti­ons – like all digi­tal com­mu­ni­ca­ti­ons in gene­ral – are sub­ject to mass sur­veil­lance wit­hout cause or sus­pi­cion by secu­rity aut­ho­ri­ties in Switz­er­land, the rest of Europe, the United Sta­tes of Ame­rica (USA), and other count­ries. We have no direct influence over the cor­re­spon­ding pro­ces­sing of per­so­nal data by intel­li­gence agen­cies, police depart­ments, and other secu­rity aut­ho­ri­ties. Nor can we rule out the pos­si­bi­lity that a data sub­ject may be spe­ci­fi­cally moni­to­red.

9. International Data Transfers

We gene­rally pro­cess per­so­nal data in Switz­er­land. Howe­ver, we may also dis­c­lose or export per­so­nal data to other count­ries, in par­ti­cu­lar to pro­cess it there or have it pro­ces­sed there.

We may dis­c­lose per­so­nal data to any coun­try on Earth and else­where in the uni­verse, pro­vi­ded that the legal frame­work in the respec­tive coun­try ensu­res an ade­quate level of data pro­tec­tion as deter­mi­ned by a decis­ion of the Swiss Fede­ral Coun­cil.

We may dis­c­lose per­so­nal data to count­ries whose legal sys­tems do not pro­vide an ade­quate level of data pro­tec­tion, pro­vi­ded that appro­priate safe­guards are in place for other reasons, in par­ti­cu­lar on the basis of stan­dard data pro­tec­tion clau­ses or other sui­ta­ble gua­ran­tees. In excep­tio­nal cases, we may trans­fer per­so­nal data to count­ries wit­hout ade­quate or appro­priate data pro­tec­tion if the spe­ci­fic legal requi­re­ments are met, for exam­ple the expli­cit con­sent of the data sub­jects or a direct con­nec­tion with the con­clu­sion or per­for­mance of a con­tract. Upon request, we will gladly pro­vide data sub­jects with infor­ma­tion on any safe­guards in place or pro­vide a copy of such safe­guards.

10. Rights of Data Subjects

10.1 Data Protection Rights

We grant data sub­jects all rights in accordance with appli­ca­ble law. Data sub­jects have in par­ti­cu­lar the fol­lo­wing rights:

  • Right of access: Data sub­jects may request infor­ma­tion as to whe­ther we pro­cess per­so­nal data about them and, if so, what per­so­nal data is invol­ved. They also receive the infor­ma­tion neces­sary to assert their data pro­tec­tion rights and to ensure trans­pa­rency. This includes the per­so­nal data its­elf, but also, among other things, infor­ma­tion on the pur­pose of pro­ces­sing, the reten­tion period, any dis­clo­sure or trans­fer of data to other count­ries, and the ori­gin of the per­so­nal data.
  • Rec­ti­fi­ca­tion and rest­ric­tion: Data sub­jects may request the cor­rec­tion of inac­cu­rate per­so­nal data, the com­ple­tion of incom­plete data, and the rest­ric­tion of pro­ces­sing of their data.
  • Right to express their point of view and request human review: Data sub­jects may, in the case of decis­i­ons based solely on auto­ma­ted pro­ces­sing of per­so­nal data that pro­duce legal effects con­cer­ning them or signi­fi­cantly affect them (auto­ma­ted indi­vi­dual decis­i­ons), pre­sent their own point of view and request a review by a human.
  • Dele­tion and objec­tion: Data sub­jects may request the dele­tion of their per­so­nal data («right to be for­got­ten») and object to the pro­ces­sing of their data with effect for the future.
  • Data dis­clo­sure and data por­ta­bi­lity: Data sub­jects may request the dis­clo­sure of their per­so­nal data or the trans­fer of their data to ano­ther con­trol­ler.

We may defer, rest­rict, or deny the exer­cise of data sub­jects’ rights within the limits per­mit­ted by law. We may inform data sub­jects of any pre­re­qui­si­tes that must be met in order to exer­cise their data pro­tec­tion rights. For exam­ple, we may refuse to pro­vide infor­ma­tion in whole or in part, citing con­fi­den­tia­lity obli­ga­ti­ons, over­ri­ding inte­rests, or the pro­tec­tion of other indi­vi­du­als. We may also refuse to delete per­so­nal data in whole or in part, in par­ti­cu­lar citing sta­tu­tory reten­tion obli­ga­ti­ons.

In excep­tio­nal cases, we may charge a fee for the exer­cise of these rights. We will inform data sub­jects in advance of any such costs.

We are obli­ga­ted to iden­tify data sub­jects who request infor­ma­tion or assert other rights through appro­priate mea­su­res. Data sub­jects are requi­red to coope­rate.

Data sub­jects have the right to enforce their data pro­tec­tion rights through legal chan­nels or to file a com­plaint with a data pro­tec­tion super­vi­sory aut­ho­rity.

The data pro­tec­tion super­vi­sory aut­ho­rity for pri­vate con­trol­lers and fede­ral bodies in Switz­er­land is the Fede­ral Data Pro­tec­tion and Infor­ma­tion Com­mis­sio­ner (FDPIC).

11. Use of the Website

11.1 Cookies

We may use coo­kies. Coo­kies – inclu­ding our own coo­kies (first-party coo­kies) and coo­kies from third par­ties whose ser­vices we use (third-party coo­kies) – are data stored in the brow­ser. Such stored data is not neces­s­a­rily limi­ted to tra­di­tio­nal text-based coo­kies.

Coo­kies may be stored tem­po­r­a­rily in the brow­ser as «ses­sion coo­kies» or for a spe­ci­fic period as so-cal­led per­ma­nent coo­kies. «Ses­sion coo­kies» are auto­ma­ti­cally dele­ted when the brow­ser is clo­sed. Per­ma­nent coo­kies have a spe­ci­fic sto­rage dura­tion. Coo­kies enable, in par­ti­cu­lar, the reco­gni­tion of a brow­ser upon the next visit to our web­site and ther­eby, for exam­ple, the mea­su­re­ment of our web­site’s reach. Per­ma­nent coo­kies may also be used for online mar­ke­ting.

Coo­kies can be fully or par­ti­ally deac­ti­va­ted, rest­ric­ted, or dele­ted at any time in the brow­ser set­tings. Brow­ser set­tings often also allow for auto­ma­ted dele­tion and other manage­ment of coo­kies. Wit­hout coo­kies, our web­site may no lon­ger be fully available. We actively seek – at least to the ext­ent requi­red by appli­ca­ble law – your express con­sent to the use of coo­kies.

11.2 Logging

For every access to our web­site and our other digi­tal pre­sence, we may log at least the fol­lo­wing data, pro­vi­ded that this infor­ma­tion is auto­ma­ti­cally coll­ec­ted or trans­mit­ted to our digi­tal infra­struc­ture during such access: date and time inclu­ding time zone, IP address, access sta­tus (HTTP sta­tus code), ope­ra­ting sys­tem inclu­ding user inter­face and ver­sion, brow­ser inclu­ding lan­guage and ver­sion, indi­vi­dual sub­pages of our web­site acces­sed inclu­ding the amount of data trans­fer­red, the last web­page acces­sed in the same brow­ser win­dow (refer­rer).

We log such infor­ma­tion, which may also con­sti­tute per­so­nal data, in log files. The infor­ma­tion is neces­sary to make our digi­tal pre­sence available on a per­ma­nent, user-fri­endly, and relia­ble basis. The infor­ma­tion is also neces­sary to ensure data secu­rity – inclu­ding through third par­ties or with the assis­tance of third par­ties.

11.3 Tracking Pixels

We may incor­po­rate track­ing pixels into our digi­tal pre­sence. Track­ing pixels are also known as web bea­cons. Track­ing pixels – inclu­ding from third par­ties whose ser­vices we use – are typi­cally small, invi­si­ble images or scripts for­mu­la­ted in Java­Script that are auto­ma­ti­cally loa­ded when our digi­tal pre­sence is acces­sed. Track­ing pixels can coll­ect at least the same infor­ma­tion as is recor­ded in log files.

12. Notifications and Communications

12.1 Performance and Reach Measurement

Noti­fi­ca­ti­ons and com­mu­ni­ca­ti­ons may con­tain web links or track­ing pixels that record whe­ther a spe­ci­fic mes­sage has been ope­ned and which web links were cli­cked. Such web links and track­ing pixels may also record the use of noti­fi­ca­ti­ons and com­mu­ni­ca­ti­ons on a per­so­nal basis. We require this sta­tis­ti­cal recor­ding of usage for per­for­mance and reach mea­su­re­ment in order to send noti­fi­ca­ti­ons and com­mu­ni­ca­ti­ons effec­tively and in a user-fri­endly man­ner, as well as on a sus­tainable, secure, and relia­ble basis, based on the needs and rea­ding habits of the reci­pi­ents.

You must gene­rally con­sent to the use of your email address and other cont­act infor­ma­tion, unless such use is per­mit­ted on other legal grounds. To obtain any dou­ble-con­firmed con­sent, we may use the «dou­ble opt-in» pro­ce­dure. In this case, you will receive a mes­sage with ins­truc­tions for the dou­ble con­fir­ma­tion. We may log obtai­ned cons­ents, inclu­ding IP address and timestamp, for evi­den­tiary and secu­rity pur­po­ses.

You may gene­rally object to recei­ving noti­fi­ca­ti­ons and com­mu­ni­ca­ti­ons, such as news­let­ters, at any time. With such an objec­tion, you may simul­ta­neously object to the sta­tis­ti­cal recor­ding of usage for per­for­mance and reach mea­su­re­ment. This does not apply to neces­sary noti­fi­ca­ti­ons and com­mu­ni­ca­ti­ons rela­ted to our acti­vi­ties and ope­ra­ti­ons.

12.3 Service Providers for Notifications and Communications

We send noti­fi­ca­ti­ons and com­mu­ni­ca­ti­ons with the help of spe­cia­li­zed ser­vice pro­vi­ders.

In par­ti­cu­lar, we use:

13. Social Media

We main­tain a pre­sence on social media plat­forms and other online plat­forms to com­mu­ni­cate with inte­res­ted indi­vi­du­als and pro­vide infor­ma­tion about our acti­vi­ties and ope­ra­ti­ons. In con­nec­tion with such plat­forms, per­so­nal data may also be pro­ces­sed out­side of Switz­er­land.

The Gene­ral Terms and Con­di­ti­ons (GTC) and Terms of Use, as well as pri­vacy poli­cies and other pro­vi­si­ons of the respec­tive ope­ra­tors of such plat­forms, also apply in each case. These pro­vi­si­ons pro­vide infor­ma­tion in par­ti­cu­lar about the rights of data sub­jects directly vis-à-vis the respec­tive plat­form, inclu­ding, for exam­ple, the right of access.

14. Third-Party Services

We use ser­vices from spe­cia­li­zed third par­ties to enable us to carry out our acti­vi­ties and ope­ra­ti­ons on a sus­tainable, user-fri­endly, secure, and relia­ble basis. With such ser­vices, we can, among other things, embed func­tions and con­tent into our web­site. With such embed­ding, the ser­vices used coll­ect users’ IP addres­ses for tech­ni­cally man­da­tory reasons, at least tem­po­r­a­rily.

For neces­sary secu­rity-rela­ted, sta­tis­ti­cal, and tech­ni­cal pur­po­ses, third par­ties whose ser­vices we use may pro­cess data rela­ted to our acti­vi­ties and ope­ra­ti­ons in aggre­ga­ted, anony­mi­zed, or pseud­ony­mi­zed form. This includes, for exam­ple, per­for­mance or usage data requi­red to pro­vide the respec­tive ser­vice.

Digital Infrastructure

We use ser­vices from spe­cia­li­zed third par­ties to access the digi­tal infra­struc­ture requi­red for our acti­vi­ties and ope­ra­ti­ons. These include, for exam­ple, hos­ting and sto­rage ser­vices from sel­ec­ted pro­vi­ders.

In par­ti­cu­lar, we use:

15. Final Notes on the Privacy Policy

We may update this Pri­vacy Policy at any time. We will inform you of updates in an appro­priate man­ner, in par­ti­cu­lar by publi­shing the cur­rent ver­sion of the Pri­vacy Policy on our web­site.