Privacy Policy

1. Introduction and scope

With this Privacy Policy, we transparently inform you about the processing of personal data in connection with our services as a recruitment agency for specialists and executives in information technology. In particular, we inform you about which personal data we process, for what purposes, on what legal basis, to whom we disclose data where applicable, and which rights you have as a data subject.

This Privacy Policy applies to our website at the domain name www.skybris.ch as well as to all related services and communication channels (e.g. email, telephone, messenger services).

We are subject to the revised Swiss Federal Act on Data Protection (FADP) and the associated Data Protection Ordinance (DPO). Where the General Data Protection Regulation of the European Union (GDPR) applies – in particular when processing personal data of persons resident in the European Economic Area (EEA) – we also comply with its requirements.

2. Controller and contact

The controller responsible for the processing of personal data within the meaning of Art. 5 lit. j FADP and Art. 4 No. 7 GDPR is:

For data protection inquiries, requests, or to exercise your rights, you may contact us at any time at the above address or directly at datenschutz@skybris.ch.

2.1 EU representative

Where the GDPR applies to individual data processing activities, we assess the need for an EU representative pursuant to Art. 27 GDPR. Where such representation is legally required, the relevant contact details will be set out in this Privacy Policy.

3. Definitions and legal bases

3.1 Definitions

We use the terms as defined in the FADP and GDPR. Personal data means any information relating to an identified or identifiable natural person. Processing covers any handling of personal data, regardless of the means or procedures used.

Sensitive personal data includes, for example, information on health, ethnic origin, religious or philosophical beliefs, biometric data for the unique identification of a person, and data on criminal prosecutions and sanctions.

3.2 Legal bases

We process personal data in accordance with Swiss law, in particular the FADP and DPO. Where the GDPR applies, we rely on one or more of the following legal bases:

• Art. 6(1)(a) GDPR: Consent of the data subject, e.g. for newsletters, cookies, or inclusion in our talent pool.
• Art. 6(1)(b) GDPR: Performance of a contract or pre-contractual measures, e.g. processing of applications, placement assignments, mandates.
• Art. 6(1)(c) GDPR: Compliance with a legal obligation, e.g. retention obligations, anti-money-laundering rules, tax law.
• Art. 6(1)(f) GDPR: Safeguarding of legitimate interests, where they are not overridden by interests of the data subject. Such interests include in particular the safe and reliable operation of our website, protection against misuse, direct approach (active sourcing) of suitable candidates, the efficient provision of our placement services, and the enforcement of legal claims.
• Art. 9(2)(b) GDPR: Processing of special categories of personal data in the context of application and employment relationships.

4. Nature, scope, and purpose of processing

We process only those personal data that are necessary for the provision of our services, the fulfilment of legal obligations, or the safeguarding of our legitimate interests. Depending on the business context, these may include the following categories of data:

• Master data: first name, last name, salutation, title, date of birth, nationality, residence status.
• Contact data: address, telephone and mobile number, email address, social media profiles where applicable.
• Professional and qualification data: CV, educational and employment references, diplomas, certificates, skills, language and IT proficiency, references, salary expectations, availability, notice periods, role preferences.
• Communication data: contents of emails, chats, phone notes, conversation logs, and interview notes, as well as – in connection with our cloud telephony (Aircall) and following prior notice and consent – audio recordings and automatically generated transcripts of phone conversations (see section 12.4).
• Contract and billing data: in the case of established business relationships, e.g. placement contract, fees, bank details.
• Usage and metadata: when visiting our website, see section 11.

We process personal data for the following main purposes:

• Placement of specialists and executives in information technology (job placement and direct approach).
• Advising candidates and companies.
• Initiation, handling, and billing of placement assignments and mandates.
• Maintaining our candidate and client network.
• Fulfilling statutory retention, disclosure, and notification obligations.
• Operating, securing, and developing our website and IT systems.
• Marketing on our own behalf (e.g. newsletters, events, job information), within the limits permitted by law.

5. Source of the data

We generally receive personal data directly from you, for example when you send us your application file, fill out a form on our website, have a conversation with us, or contact us by email or telephone.

As part of our placement activities – in particular what is known as active sourcing – we additionally obtain personal data from publicly accessible sources, to the extent permitted by applicable law. These include in particular professional networks (e.g. LinkedIn, XING), job portals, company websites, trade publications, industry directories, and other sources publicly available on the internet. We use such data exclusively to identify and contact suitable candidates for specific vacancies of our clients.

We receive personal data about clients and their employees in the course of the business relationship, for example from employment conditions, job advertisements, or in the course of carrying out an assignment.

6. Disclosure of personal data to third parties

We disclose personal data to third parties only where this is necessary for the provision of our services, the fulfilment of legal obligations, or the safeguarding of our legitimate interests. In particular, personal data may be disclosed to third parties in the following situations:

• Potential employers / client companies: We forward candidate files to companies seeking to fill a specific vacancy only after prior notification and consent of the candidates concerned.
• Reference providers: We obtain references only with the express consent of the candidate concerned.
• Processors and service providers: hosting and IT providers, the provider of our applicant tracking and CRM system (Spott), the provider of our cloud telephony solution (Aircall), email and communication services, payment service providers, fiduciary and accounting service providers, legal advisors. We contractually bind these parties to comply with data protection requirements. An overview of the specific third-party services we use can be found in section 12.
• Authorities and courts: insofar as we are required to do so by law or official order, or where this is necessary to safeguard our rights.
• Group and cooperation partners: insofar as this is necessary for the provision of our services and no overriding interests of the data subjects oppose such disclosure.

7. International data transfers

As a rule, we process personal data in Switzerland and the European Economic Area (EEA). In individual cases, personal data may also be transferred to other countries, in particular where we rely on services from providers based in third countries (e.g. providers of analytics or communication services based in the United States).

Where transfers are made to countries whose level of data protection is not equivalent to that of Switzerland or the EEA, we ensure the protection of your personal data through appropriate safeguards, in particular through the conclusion of standard contractual clauses or through an adequacy decision. We will provide information about the safeguards taken upon request.

8. Retention period

We process and store personal data only for as long as is necessary for the respective processing purpose or as required by statutory retention obligations. The following guideline values apply in particular:

• Contact requests without contractual relationship: deletion after the request has been handled, usually within 12 months.
• Application data without successful placement: as a rule, deletion six (6) months after the conclusion of the specific application procedure, unless you wish to be added to our talent pool (see section 10.2).
• Talent pool: Inclusion in the talent pool continues until revoked. We periodically check whether your data is still current and whether there continues to be an interest in working together.
• Contract and business data: for the statutory retention period (generally ten years under the Swiss Code of Obligations).
• Log files and technical data: a maximum of 12 months, unless longer retention is required for security analysis or evidence preservation.

9. Data security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, and against unauthorised access or disclosure. These include in particular encrypted data transmission (TLS/SSL), access controls, authorisation concepts, regular updates of our systems, and the awareness training of our employees.

We note that the transmission of data over the internet (e.g. when communicating by email) may, in principle, have security gaps. Complete protection against access by third parties is not possible.

10. Applications, placement, and talent pool

10.1 Processing of application and candidate data

When you apply to us for a specific vacancy or send us your application file on a speculative basis, we process your personal data for the purpose of assessing your suitability, placement with client companies, and the initiation and handling of the resulting mandate or employment relationship.

We recommend that you only provide us with the personal data necessary to assess your suitability. Please refrain from sending us sensitive personal data (e.g. information on health, religious or political beliefs) without explicit necessity.

Applications by email and speculative applications: If you send us your documents on your own initiative – for example by email or following personal contact – we regard this as your wish to be considered for suitable positions. In this case, processing is carried out to perform pre-contractual measures. We inform you about the processing via this privacy policy and, where possible, with an acknowledgment of receipt. You may object to inclusion in our talent pool at any time and revoke any consent given at any time, informally by email to datenschutz@skybris.ch.

10.2 Talent pool / pending applications

Already in the application form, you can give us your explicit consent to store your application materials in our talent pool beyond the specific application process. If we cannot currently offer you a suitable position, we may also approach you about this afterwards. Inclusion in the talent pool is based exclusively on your explicit consent (Art. 6(1)(a) GDPR). You may revoke your consent at any time with effect for the future, for example by email to datenschutz@skybris.ch.

To ensure data quality, we review your data in the talent pool periodically – typically every two to three years. If you do not respond to an update request despite a reminder, we will assume that there is no further interest and will delete your data.

10.3 Active sourcing / direct approach

As part of our activity as a specialised IT recruitment agency, we identify and approach suitable specialists and executives in a targeted manner. To this end, we obtain – to the extent permitted by applicable law – personal data from publicly accessible sources such as professional networks (e.g. LinkedIn, XING), job portals, company websites, or trade publications. We will inform you no later than the first time we contact you about the origin of the data and your rights. In doing so, we refer you to this privacy policy. You may object to any further processing or to inclusion in our talent pool at any time – informally by email to datenschutz@skybris.ch.

10.4 References

We obtain references about candidates only with their prior, express consent. You decide for yourself which referees we may contact. The contents of reference conversations are treated confidentially.

10.5 Forwarding to client companies

We forward candidate files (in particular CV, references, and diplomas) to specific client companies only with your express case-by-case consent. You retain control at all times over which companies your file is shared with.

11. Use of our website

11.1 Server log files

When you visit our website, our web server automatically collects information that your browser transmits to us (server log files). This includes in particular: IP address, date and time of the request, content of the request, access status (HTTP status code), volume of data transferred, referring URL, browser type and version, and operating system. Log files are deleted no later than 12 months after collection.

11.2 Cookies and similar technologies

Our website uses cookies and similar technologies (e.g. local storage, tracking pixels). In particular, we distinguish between:

• Technically necessary cookies: required for the operation of the website. The legal basis is Art. 6(1)(f) GDPR.
• Analytics and marketing cookies: for statistical evaluations or advertising purposes, used exclusively on the basis of your consent (Art. 6(1)(a) GDPR), which you can provide via our cookie banner and revoke at any time.

11.3 SSL/TLS encryption

For security reasons, our website uses SSL/TLS encryption. You can recognise an encrypted connection by «https://» in the address bar and the padlock symbol.

11.4 Contact and application forms

On our website we provide you with a contact form and an application form. The data entered into these forms is used exclusively to process your inquiry or application.

12. Third-party services used

12.1 Google Tag Manager

We use Google Tag Manager from Google Ireland Limited. Google Tag Manager itself does not create user profiles, does not store cookies, and does not carry out any independent analyses. It is used only to manage and deliver the tools integrated through it. For more information: policies.google.com/privacy

12.2 Google Analytics

We use Google Analytics for the statistical evaluation of the use of our website. The processing is carried out exclusively on the basis of your consent (Art. 6(1)(a) GDPR), which you can give via our cookie banner and revoke at any time. You can also prevent data collection via Google's browser add-on.

12.3 CRM and applicant tracking system (Spott)

To manage candidate, client, and contact data, we use the CRM and applicant tracking system of Spott BV, Leuven, Belgium. Spott BV acts as our processor. All personal data is stored exclusively on servers within the European Union. No transfer to third countries takes place. For more information: spott.io

12.4 Cloud telephony and recording / transcription (Aircall)

For our telephony we use the cloud telephony solution of Aircall SAS, Paris, France. Via Aircall, call data and – where activated – audio recordings and machine-generated transcripts are processed. In detail, we process the following data:

• Connection data: phone numbers, date, time, and duration of calls.
• Audio recordings: where activated and announced in the individual case.
• Transcripts and summaries: generated automatically via «Aircall AI» (using sub-processors such as OpenAI).
• Linkage with Spott: call data is linked to the corresponding contact in our CRM.

We actively inform you at the start of each phone call if the call is being recorded and obtain your consent. No recording takes place without your consent. For more information: aircall.io/privacy

12.5 Hosting (Hostpoint)

Our website is hosted by Hostpoint AG, Rapperswil-Jona, Switzerland. All personal data is stored exclusively on servers in Switzerland. No transfer of personal data abroad takes place in the context of hosting. For more information: hostpoint.ch/datenschutzerklaerung.html

13. Social media presence and online advertising

13.1 General

We maintain a presence on selected social networks (in particular Facebook, Instagram, LinkedIn, and XING). When you visit our profiles or interact with our posts, the respective platform operators process personal data in accordance with their own privacy policies.

13.2 Facebook and Instagram pages (Meta) – joint controllership

We operate a company page on Facebook and a business profile on Instagram (Meta Platforms Ireland Limited). With regard to the processing of page insights data, there is joint controllership between Meta and us pursuant to Art. 26 GDPR. Privacy information: Facebook / Instagram

13.3 Meta Pixel on our website

On our website we use the Meta Pixel (formerly Facebook Pixel). It is used exclusively on the basis of your consent (Art. 6(1)(a) GDPR), which you can give via our cookie banner and revoke at any time.

13.4 Facebook Ads / Instagram Ads (Meta Ads)

We run paid advertisements on Facebook and Instagram. Where the Meta Pixel is used in this context, section 13.3 applies in addition.

13.5 LinkedIn and XING

We use LinkedIn (LinkedIn Ireland Unlimited Company) and XING (New Work SE) for our business presence and as part of our active sourcing activities. Privacy information: LinkedIn / XING

14. Your rights as a data subject

Under applicable data protection law, you have, in particular, the following rights vis-à-vis us:

• Right of access: you may request information as to whether and which personal data we process about you.
• Rectification: you may request the correction of inaccurate or the completion of incomplete personal data.
• Erasure: under certain conditions, you may request the erasure of your personal data («right to be forgotten»).
• Restriction: you may request the restriction of the processing of your personal data.
• Data portability: you may request that we provide your personal data in a structured, machine-readable format.
• Objection: you may object to the processing of your personal data, in particular for direct marketing purposes.
• Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time with effect for the future.

To exercise your rights, you may contact us informally at any time (see section 2).

14.1 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. Where the GDPR applies, you may also contact the competent data protection supervisory authority of your member state.

15. Automated decision-making and profiling

As a rule, we do not take decisions that are based solely on automated processing and that produce legal effects vis-à-vis you. Where we use search, matching, or scoring algorithms, these serve exclusively as decision support. The final assessment is always made by a human.

16. Obligation to provide personal data

In the context of a business relationship, you must provide the personal data necessary to enter into and carry out the business relationship and to fulfil the related obligations. Without this data, we are generally unable to enter into a contract with you or to provide our services either fully or at all.

17. Amendments to this Privacy Policy

We may amend this Privacy Policy at any time, in particular to adapt it to changes in the legal or factual situation. The version published on our website at the relevant time shall be authoritative.

Zurich, May 2026