1. Legal bases

• REGLEMENT (EU) 2016/679 OF EUROPEAN PARLEMENT AND TIP of 27 April 2016 relating to the protection of individuals about the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
• Federal Data Protection Act (LPD).
• Federal Council On Data Protection (OLPD) Order.
• Bond Code (s. 328 Al.2 CO).
• The Federal Postal and Telecommunications Correspondence Surveillance Act (LSCPT).
• Any equivalent data protection standard in the national rights of our operations abroad.

2. Purpose

The purpose of this regulation is to protect the personality and fundamental rights of people defined in art. 3 below that are being processed.

It governs the security requirements for the collection, retention, operation, modification, communication and archiving of the personal data of REGDATA SA employees and customers, the following “REGDATA”.  

3. Scope

This regulation applies to all personal data:

• regarding employees regardless of the nature of the contract deploying or having deployed an activity for REGDATA;
• inherent in customer management.

This regulation does not apply to:

• personal data of candidates whose record has not resulted in a commitment.

4. Definitions

Means:

Access to data: ability to access personal data, in accordance with a specific access profile or permission granted by the file master.

Archive: the time at which files containing employees’ personal data are no longer exploited, but simply kept in order to meet legal requirements.

Entitled: anyone entitled to a profile of access to personal data or authorized by the master of the file.

Data category: grouping of personal data of employees or clients, depending on their nature (identity, individual, family-related, contractual, position-related, competency-related, administrative, financial, evaluation-related, complementary, historical).

Collaborator: any person employed by any of the entities of the REGDATA group (employment contract), including trainees (internship contract), apprentices (apprenticeship contract) and Matupro students (MPC contract).

Data Protection Advisor: Person acting on behalf of REGDATA, which controls the processing of personal data, makes any necessary corrections and maintains an inventory of files managed by the file master.

Data disclosure: making personal data accessible, for example by authorizing its consultation, transmitting it or disseminating it.

Personaldata: information about an identified or identifiable person.

Physical record: personal data of the client, in the form of documents,  including the resume, the contract of engagement or any internal questionnaire.

File: any set of personal data, the structure of which allows the search for data by the person concerned, in particular the physical record of a person or all the information contained in the information system specific to Human Resources.

HRD: REGDATA Human Resources Directorate.

GRH: human resources manager, in charge of employees in an industry, who can be delegated HRD functions.

Filemaster: person acting on behalf of REGDATA, validating the purpose and content of the file, as well as the rights to access the so-called file, in accordance with the LPD or equivalent laws.

Levels of data protection: categorization of personal data, based on its degree of confidentiality, i.e.:

• Information of “public” level, non-sensitive, accessible to all REGDATA employees and externally.
• “Internal” level information, either non-sensitive, accessible to all REGDATA employees, or insensitive, accessible to a predefined circle of REGDATA employees as needed, transmitted by them exclusively to the holder of an identical access profile to their own or benefiting from more extensive access than their own.
• Sensitive “Confidential” level information, accessible to a small circle of REGDATA employees, transmitted by them to a third party exclusively with the express consent of their owner or file master.

Access profile: a profile determined in relation to the function and professional responsibilities, granting the beneficiary access to certain categories of personal data.

Data processing: any transaction related to personal data, regardless of the means and processes used, including data collection, retention, operation, modification, communication and archiving.

5. General provisions

5.1 Processing personal data

5.1.1 Collect

REGDATA collects personal information about its customers, in order to provide business line managers with the personal and statistical data of their  customers, necessary to carry out their business.

The content of the information collected is limited to the customer data necessary to execute a commercial contract. Customers are required to provide all the data required for this purpose.

The data collected may take physical or electronic form. 

5.1.2. Conservation

5.1.2.1. Physical records

5.2. Access to personal data

5.2.1. Physical records

The contents of physical files can only be accessed by the Directorate and the authorized Human Resources staff.

Each employee has access to his physical file, at the request addressed to the HRM in charge of his line of activity.

Data protection laws, applicable in Switzerland and abroad, allowing third parties to access the data are reserved.

5.2.2. Computerized data

5.2.2.1.  Customers’ access to their own data

Each client has access to their personal data processed by Finance, in accordance with their access profile on the commercial platforms (RegData Protection Suite and REGDATA SaaS) of REGDATA.

5.2.2.2. Access to “Public” and “Internal” personal data

Each REGDATA employee and client has access to the personal data of the “Public” and “Internal” levels of all REGDATA employees.

5.2.2.3. Access to “Confidential” Personal Data

Access to other personal data of employees and clients, i.e. those at “Confidential” levels, is governed by predetermined access profiles according to the needs and responsibilities specific to the professional function of their beneficiary (including the functions Direction, Finance, HR, Security, and hierarchical or functional responsibilities).

The different access profiles are subject to change, at any time, by the file master.

Each access profile gives its recipient, for each specific personal data category, one of three options:

• “Y” type of access: access is automatic and unrestricted for the profile recipient.
• “D” type of access: access is subject to permission from the file master.
• “N” type of access: Access is not granted to the profile recipient.

5.2.2.4. Access to permission from the file master

Any “D” access request must be motivated and addressed to the file master, using the form made available by REGDATA.

The file master is entitled to grant or not access to the data required by the recipient of the access profile. If so, he or she has the applicant sign a confidentiality agreement. It takes all necessary and useful measures to ensure the confidentiality of the data concerned.

6. Special arrangements

6.1 External employee data

When REGDATA employs the services of external collaborators it complies with the provisions of this Regulation. In particular, it will make sure to limit access to the data of these employees to only those authorized.

7. Organzation and responsibilities

7.1.  Having rights

Any employee for the benefit of an access profile or permission granted by the file master is required to ensure the protection of the data to which he accesses.

It is required to use the data strictly for the purpose assigned to it.

It is only permitted to disclose such data to third parties in accordance with the rules set out in Chapter 5.1.6. Above.

Any violation of data protection rules will involve blocking the access profile. In addition, any violator will be subject to appropriate internal sanctions, ranging from warning to dismissal. Possible criminal sanctions remain reserved.

7.2.  Client

The Customer is responsible for providing all the personal data required by REGDATA and ensuring its veracity. He is required to announce without delay any changes to his personal data.

The Customer is duly informed in the General Terms that any misrepresentation or concealment of useful data is personally responsible.

7.3.  File Master

The master of the file is designated by Human Resources. In case of absence, the file master can only be validly replaced by one of the data protection advisors.

The file master’s mission is to determine the purpose, content and access to the personal data of employees processed by Human Resources.

To this end, the master of the file is entitled to:

• Whether or not to grant access to “D” data;
• Save declarations signed by recipients of an access profile when granting permission;
• Take all necessary and useful measures to ensure the confidentiality and accuracy of the data involved;
• amend these regulations.

7.4.  Data Protection Advisor

The data protection advisor is appointed by the file master. This may be a member of its staff or a third party, with the necessary professional knowledge and not engaged in any activity incompatible with his or her advisory duties. The data protection advisor performs his function independently, without receiving instructions from the file master.

The data protection advisor’s mission is to monitor the processing of personal data carried out and, if necessary, to propose the necessary corrections.

To this end, it is entitled to:

• Make an inventory of files managed by the file master, for the Federal Commissioner or the persons concerned who request it;
• Make recommendations to the file master;
• to take over the master of the file, in case the latter is absent.

8. Comes into force and amended

This regulation comes into force with immediate effect. It has no retroactive effect.

It can only be changed by the file master or data protection advisor.