With the following information, we would like to give you an overview of how we process your personal data, and of your rights under data protection legislation. The details of the specific data processed and the way it is used essentially depend on the services agreed upon in each case.

Data Protection of IAP

Recitals

a) Who Are We?
The IAP Institute of Applied Psychology is an institute of the ZHAW Zurich University of Applied Sciences. 

b) Who Does This Data Protection Statement Apply To?
When we process personal data, this means that we collect, store, use, transmit, or delete it.

The present Data Protection Statement applies to the personal data of the following individuals:

• Interested parties and clients of the IAP who are individuals

• All other individuals who are in contact with the IAP, such as authorized representatives, legal guardians, messengers, as well as representatives or employees of legal entities, but also visitors to our website and persons who register on the website or in our apps

• This information also applies to legal entities until such time as when this Data Protection Statement may be amended.

1. Who Is Responsible for Data Processing, and Whom Can You Contact?

You can reach the responsible authority and our data protection officer at:

ZHAW Zurich University of Applied Sciences
President’s Office
Gertrudstrasse 15
8401 Winterthur  
datenschutz@zhaw.ch

2. What Sources and Data Do We Use?

In particular, we collect your personal data when you contact us, for instance as an interested party, an applicant, or a client. We process the personal data that we receive from our clients as part of our business relationship. We also process – to the extent necessary for the provision of our services – personal data that we lawfully obtain from publicly accessible sources (e.g. purchase of address data/foreign addresses for mailing campaigns, research on the Internet (e.g. for the search for speakers or panel guests for events), etc.).

Relevant personal data are personal details (name, address and other contact data, date and place of birth, and nationality) and identification information (e.g. ID details). This may also include order data, data from the performance of our contractual obligations, marketing and sales data, documentation data, and other kinds of data comparable to the categories mentioned.

3. What Do We Process Your Data for (Purpose of Processing), and on What Legal Basis?

We process personal data in accordance with the provisions of the Information and Data Protection Act (Gesetz über die Information und den Datenschutz – IDG) of the Canton of Zurich, the Swiss Federal Act on Data Protection (FADP), and the EU General Data Protection Regulation (GDPR) – in each case insofar as the relevant regulations are applicable. Because the GDPR requires that each of these legal provisions be listed individually, the legal basis on which we base our processing in each case will be listed below, for cases subject to the GDPR. When processing personal data in accordance with the IDG or FADP, we rely on the comparable legal basis in these laws in each case.

a) Compliance with Contractual Obligations (Article 6(1)(b) GDPR).

The processing of data is carried out to provide the services of IAP as part of the performance of our contracts with our clients (e.g. in the area of further training and services in the fields of human resources, development, sport, leadership, coaching and change management, diagnostics, psychology of traffic and transportation and safety, occupational, study, and career counseling, clinical psychology, and psychotherapy), or to take steps prior to entering into a contract on request. The purposes of data processing mainly depend on the specific service, and may relate to activities such as training, diagnostics, consultation, and therapy. Further details regarding the purposes of data processing can be found in the contract documents and the General Terms and Conditions.

b) For the Purposes of Legitimate Interests (Article 6(1)(f) GDPR)

If necessary, we process your data beyond the actual performance of the contract in order to protect our legitimate interests or those of third parties. Examples:

• Consultation and exchange of data with a view to providing the above services, such as in the case of assessments, where the IAP receives personal data and delivers the report/result to the contracting company, or in the case of an expert opinion about the withdrawal of a driver’s license, where the expert opinion is sent to the Road Traffic Office

• Reviewing and optimizing procedures for needs analyses for direct client contact

• Research

• Advertising or market and opinion research, where you have not objected to the use of your data

• Assertion of legal claims and defense in legal disputes

• Ensuring IT security and IT operations

• Prevention and investigation of criminal offenses

• Measures for building and plant security (e.g. access control)

• Measures to secure the right to enforce house rules

• Measures for business management and further development of services and products

• Consultation and exchange of data with a view to providing the above services, such as in the case of assessments, where the IAP receives personal data and delivers the report/result to the contracting company, or in the case of an expert opinion about the withdrawal of a driver’s license, where the expert opinion is sent to the Road Traffic Office

c) Based on Your Consent (Article 6(1)(a) GDPR)

If you have given us your consent to process personal data for certain purposes (e.g. disclosure of data, evaluation of personal data for research and marketing purposes), the lawfulness of such processing is established on the basis of your consent. You have the right to revoke your consent at any time. This also applies to the revocation of declarations of consent that were issued to us before the GDPR came into force, i.e. before May 25, 2018. Revocation of consent does not affect the lawfulness of data processing undertaken before consent was withdrawn.

d) Based on Legal Obligations (Article 6(1)(c) GDPR) or in the Public Interest (Article 6(1)(e) GDPR)

What is more, as an institute of the ZHAW we are subject to the provisions of the law on higher education as well as to the other legal requirements of Swiss law, which means that personal data may also be processed if this is required by law or if the processing is in the public interest. The basis for this is, in particular, Article 6(a) of the Universities of Applied Sciences Act (UASA).

4. Confidentiality and Security

The data that you enter in a form is sent in encrypted form. 

The data transmitted by you will be stored on our servers, kept with all due care, and protected from access by unauthorized third parties. Only those employees have access to your data who require it to perform their tasks. 

5. Newsletters

We would be pleased to inform you about current topics relating to the IAP and our products by means of our newsletters. To send a newsletter, we will need at least your e-mail address, usually your name and gender, and, where necessary, your street address (in order to determine the applicable legal basis). If you would like to subscribe to one or more newsletters, you can enter this information in the fields provided. Once you have submitted this information, you will receive an e-mail from us sent to the e-mail address provided, with a confirmation link that you have to click to verify the e-mail address provided.

You can unsubscribe from our newsletters at any time, and thus revoke your consent to the further use of your data. You can unsubscribe from the mailing list via the link at the end of each IAP newsletter.

6. Who Gets Access to My Data?

Within the IAP and the ZHAW, the offices that need your data to fulfill our contractual and legal obligations are given access to it. Service providers used by us and persons whose services are used to fulfill our obligations may also receive data for these purposes. These include companies in the categories IT services, logistics, printing services, telecommunication, advisory, consulting, sales, and marketing. In such cases, the IAP takes any action necessary in order to ensure compliance with the applicable data protection rules and confidentiality obligations.

Recipients of personal data may be, for example:

• Public authorities and institutions (e.g. criminal prosecution authorities) where there is a legal or government obligation to provide the data

• Companies or other bodies which instruct us to draw up an expert opinion or assessment

• Health insurance funds

• Freelancers working on assignments, such as psychiatrists, coaches, advisors, project leaders, experts, supervisors, appraisers, translators, transcribers, trainees, lawyers, etc.

Other recipients of data may include bodies for which you have voluntarily given us your consent to transmit data to, or for which you have released us from the duty of confidentiality in an agreement or declaration of consent. Any such consent may be withdrawn at any time, although only with future effect. 

7. Is Data Transmitted to a Third Country or to an International Organization?

Data is transmitted to offices in countries outside the EU (third countries) (e.g. as part of a research cooperation with foreign universities/organizations) if

• this is required by law, or

• you have given us your consent, or

• we have put appropriate guarantees in place through appropriate mechanisms (e.g. contracts).

8. For How Long Will My Data Be Stored?

We process and store your personal data for as long as required to fulfill our contractual and legal obligations.

If the data are no longer needed to fulfill our contractual and legal obligations, they are regularly deleted, unless their further processing – for a limited period – is necessary for the following purposes:

• To comply with commercial and tax archiving obligations, for example under the Swiss Code of Obligations (OR) and tax legislation. The time limits specified in these laws for storage and documentation are usually 10 years.

• Retention of evidence within the context of statutory limitation periods. According to Article 127 et seqq. OR, these limitation periods can be up to 10 years. The retention period for degree certificates is even 50 years.

9. What Data Protection Rights Do I Have?

You have different rights depending on the applicable legal basis. Where the IDG or FADP apply, your rights are governed by those provisions.

Where actions are initiated that fall under the scope of the GDPR, every data subject has the right of access in accordance with Article 15 GDPR, the right to rectification in accordance with Article 16 GDPR, the right to erasure in accordance with Article 17 GDPR, the right to restriction of processing in accordance with Article 18 GDPR, the right to object in accordance with Article 21 GDPR, and the right to data portability in accordance with Article 20 GDPR. In addition, data subjects have the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR).

You have the right to revoke your consent to the processing of personal data by us at any time. This also applies to the revocation of declarations of consent that were issued to us before the GDPR came into force, i.e. before May 25, 2018. Please note that consent may only be revoked with effect for the future. Processing of data that took place before the revocation will not be affected by this revocation.

10. Am I Obliged to Provide Data?

As part of our business relationship, you must provide the personal data required to establish and implement such a relationship and to fulfill the contractual obligations that it entails, as well as any personal data that we are required to collect by law. Without this information, we will generally not be able to conclude or execute the contract with you.

11. To What Extent Is There an Automated Decision-Making?

Generally, we do not use any fully automated decision-making to establish and implement the business relationship in accordance with Article 22 GDPR. Should such a procedure be applied in individual cases, we will inform you of this separately if the law so requires.

12. Is Profiling Carried Out?

We do partly process your data automatically in order to evaluate certain personal aspects (profiling). We use profiling in the following cases, for example:

• Test procedures, for example for assessments relating to security-relevant occupations 

• We use evaluation tools to provide you with targeted information and advice on products. These allow us to provide needs-based communication and advertising, including market and opinion research.

13. Tracking cookies

The IAP uses tracking cookies. These register your IP address, the website from which you access our website, the type of browser software used, and the pages of the IAP website that you visit, including date and duration. Such tracking data do not allow conclusions to be drawn about individual users, so no individuals can be identified on the basis of this data.

Cookies are files that are stored on a computer system via an Internet browser. The data subject can at any time prevent the storage of cookies by our website by making an appropriate adjustment to the settings in the Internet browser used, thus permanently blocking cookies from being set. Furthermore, cookies that have already been set can be deleted at any time via the Internet browser or other software programs.

14. Plug-Ins on Social-Media Platforms

Plug-ins of various third-party social-media platforms (Facebook, Instagram, etc.) are integrated within the IAP website. When you access a website that contains plug-ins from such third-party providers, these plug-ins can automatically transmit data to these third-party providers. If the visitor to the website is logged onto the network of the respective third-party provider at the same time, their visit to the website can be assigned to that person’s user account, depending on the provider. The IAP has no control on the way in which such data is transmitted.

15. Information about the "Like” Button

On our website, use is made of the “Like” button or forwarding function of Facebook, Instagram, and LinkedIn. If you are a member of Facebook, LinkedIn, or Instagram, you can add a note in your profile on those sites to the effect that you like our website or share it.

Facebook and Instagram are operated by Meta Platforms, Inc., a company based in the USA. LinkedIn is also operated by a company based in the USA. When visiting websites with a “Like” button or the aforesaid forwarding function, your browser establishes a direct connection with the servers of Meta Platforms, Inc. and LinkedIn. This means that Meta Platforms, Inc. and LinkedIn are able to obtain user data about you, and specifically to store such data. If you are logged in to the respective platform while accessing the website, it can also assign your user data to your profile.

As soon as you press the “Like” button or initiate the aforesaid forwarding function, we no longer have any influence on the user data that Facebook, Instagram, and LinkedIn may collect about you. For more information about the purpose, scope, and method of processing of the data collected, please refer to the respective data use guidelines of the above-mentioned platforms.

16. Amendments to the Data Protection Statement

We reserve the right to amend this Data Protection Statement at any time. The date of the last update can be found at the end of this Data Protection Statement.

As at: September 2024