Flex Suisse works with people in a variety of ways. Inevitably, data is also processed in the process. In doing so, we pay attention to the protection of your personal rights and fully comply with the legal requirements for data protection. We therefore inform you in detail on this page about the way in which data is processed in this context. In accordance with the General Data Protection Regulation (hereinafter referred to as “GDPR”), we would like to inform you below about what personal data we collect about you, how and why we process it, and what rights you have under the GDPR. The data protection information applies to both active and former employees, to customers and candidates, to applicants and website visitors.
1. Flex Suisse
We may transfer your personal data to companies affiliated with us, insofar as this is permissible within the scope of the purposes set out in section 2 of this data protection information or you have given us your consent to the transfer. In these cases, the transfer includes the following companies of the Flex Suisse Group:
Flex Suisse Holding GmbH, Eschersheimer Landstrasse 14, 60322 Frankfurt a. M.
Michael Buchser IXAR Legal AG Meier-Bosshard-Strasse 5 8048 Zurich
4. Categories of personal data
We process the following of your personal data, depending on the context in which you are in contact with us:
If you are an applicant:
Identification data, in particular name, photograph, gender, date of birth, nationality;
contact data, in particular your home address, private telephone numbers and e-mail addresses;
Your cover letter and resume;
Information on training and qualifications including transcripts and performance records;
Information on professional qualifications, achievements, skills, credentials required in connection with your work, requests and documentation regarding police clearance certificates and/or membership in a professional association;
If you are an employee:
Personal master data (first name, last name, academ. title)
Contact information (address, phone number, e-mail address)
Company-internal assignment data (company position, company, personnel number, supervisor, building and room number)
General identification data (date of birth, gender, marital status, nationality, photograph)
Other data during or in connection with the performance of the employment relationship
Data on the employment relationship (employment contract, job-related qualifications, deputies, project data, reason for leaving, warnings/reprimands (with reasons))
Data on qualifications (curriculum vitae, certificates, data on participation in seminars (seminar name and dates of travel), evaluations, references (incl. employer’s reference))
Data on the use of IT (login data, IT configuration (e.g. software versions / policies / containers)), rights and user management
Content data of the business use of mobile devices
Usage and traffic data of the e-mail account
Wage data (bank details, pay grade, salary, allowances)
Tax data (tax class and tax ID, denomination, SI number)
Employment times (working times, on-call times, on-call times, attendance and absence times, working time share, remaining flextime), logon data for time recording tool
Logging of the annual meetings
Duration of employment (entry date, exit date)
Health data (e.g., sick leave, reintegration, degree of disability).
Information from authorities (e.g. confirmations / certificate of good conduct)
Pension/social security data
Other pension data
Health suitability for certain work activities
Severely disabled status, if applicable
Pregnancy if applicable
If applicable, insurance data (direct insurance)
In addition, we also process other data that is communicated by you in the course of the proper performance of services owed under your employment contract.
Data which we process on the basis of your consent if required
Photograph / photo / passport photos (e.g. for website)
Company pension plan
Health data (unless authorized by law).
Further data which we process for trainees and interns
Private contact details (telephone, mobile, e-mail address) and contact details of parents
Occupation, type of education, school-leaving qualifications (as well as school and examination grades)
If you are a customer or candidate:
Master data (First name, Last name, Acad. title)
Contact information (address, phone number and e-mail address)
Communications and traffic data,
Bank data (esp. account data)
Billing and tax data
Contract and order data
Transaction information (e.g. support requests)
Decisions of authorities or courts, if applicable
When you visit our website:
The use of our website is generally possible without providing personal data.
However, we would like to point out that access data is also collected in this case and stored in the server log files. This is in particular the following data:
Your IP address (anonymized).
We generally evaluate this information in anonymized form to defend against attacks and to improve our offer (processing of personal data in the context of a balancing of interests pursuant to Art. 6 (1) p. 1 lit. f) GDPR / Art. 4 DSG) and subsequently delete it. The data is regularly not traceable to your person and will not be merged with other data.
In the event of concrete indications of illegal use, however, we reserve the right to evaluate the data retrospectively.
5. Special information regarding data processing on our website
Data categories; data sources In principle, we process the personal data that is transmitted by you in connection with the use of our website or which you communicate to us in the context of an inquiry, a pre-contractual legal relationship or a contractual relationship. In individual cases and insofar as this is necessary within the framework of the fulfillment of the contract, we also process personal data that has been permissibly taken from publicly accessible sources (e.g. commercial registers, debtor directories, Internet) or permissibly transmitted to us by third parties (e.g. credit agencies).
This may be technical data relating to you (IP address, browser type), personal data (name, birthday, legal representative), address data (address, e-mail address, contact person), financial data (name of account holder, IBAN, BIC), contract data (contract term, purchased services, cancellations), communication data (correspondence, e-mail traffic), advertising data (advertising letters) and other, comparable categories of personal data.
Processing of personal data after consent (Art. 6 para. 1 p. 1 lit. a) GDPR / Art. 4 para. 5 DSG) We obtain consent from you on a case-by-case basis for specific purposes expressly identified in connection with the collection of data.
In these cases, data processing takes place exclusively on the basis of your consent. It may be that the processing of your request is not possible without your consent and must therefore be made dependent on it. The data will be processed exclusively for the purpose(s) expressly stated.
You can revoke your consent at any time with effect for the future. The revocation has no influence on the lawfulness of the processing until the time of the revocation.
Cross-border data transfer (Art. 49 para. 1 p. 1 lit. a) GDPR / Art. 6 DSG) Insofar as personal data is transferred to a third country, we comply with the data protection requirements for this in that the data transfer is based on standard contractual clauses or we obtain your consent to this in accordance with Art. 49 (1) p. 1 lit. a) GDPR / Art. 6 (2) lit. b DSG.
A data transfer takes place, for example, in particular in connection with the use of Google services. Due to the use of these services, data is transmitted to the United States of America.
The data transfer will only take place if you give us your consent.
The specific details of the recipient, the personal data transferred and the purpose of the data transfer can be found in the notes on the respective processing below.
Due to the data transfer, there is a risk for your personal data. In the United States of America, there is no level of data protection comparable to EU law (GDPR) and / or national regulations (e.g. BDSG) or sufficient guarantees that ensure the maintenance of an adequate level of data protection. Any deficits cannot, moreover, be compensated for by other specific guarantees due to the U.S. legal situation. Nevertheless, depending on the service, standard contractual clauses are used in some cases to achieve the greatest possible protection for your data. You can find out whether standard contractual clauses are used in the explanations for the respective services.
You can revoke your consent at any time with effect for the future. The revocation has no influence on the lawfulness of the processing until the time of the revocation.
Contact If you contact us by e-mail or telephone, we process the personal data you provide in order to respond to your inquiry. The legal basis for this is generally Art. 6 (1) p. 1 lit. b) GDPR / Art. 4 DSG, but exceptionally, if there is no contractual reference, Art. 6 (1) p. 1 lit. f) GDPR / Art. 4 DSG, whereby the legitimate interest lies in the proper response to your inquiry. We delete the data after the final processing of your request, unless there is a contractual or legal obligation to retain the data.
Contact form If you send us an inquiry via our contact form, we process the data you provide based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a) GDPR / Art. 4 para. 5 DSG in order to process your inquiry. In principle, your data will be deleted after processing the request, unless there is a contractual or legal obligation to retain it. If you provide us with contractually relevant information, we will transfer it to our inventory system.
You can revoke your consent at any time with effect for the future using any of the contact details provided.
In some cases, cookies or local storage are necessary to ensure the functionality or IT security of our website. The use of such function cookies is based on a legitimate interest in enabling the use of our website incl. its functions according to Art. 6 para. 1 p. 1 lit. f) GDPR / Art. 4 DSG. Furthermore, the processing in these cases is carried out in accordance with Section 25 (2) No. 2 TTDSG.
We may use other – unnecessary – cookies or local storage techniques on the basis of Art. 6 (1) p. 1 lit. a) GDPR / Art. 4 DSG and thus on the basis of your consent. The purposes of the cookies used in each case may include:
Enabling the use of special functions,
the (pseudonymized) analysis of user behavior in order to optimize our website,
Increasing the attractiveness as well as the user comfort of our website,
Improvement and demand-oriented design of our offer.
Most of the cookies we use are deleted from your computer after you close the browser (session cookies). Other types of cookies may remain on your computer and allow us to recognize your computer by means of the created usage profile the next time you visit our site (persistent cookies).
You can declare your consent by confirming our cookie banner when you call up our website. Once you have given your consent, you can revoke it at any time with effect for the future.
We use the following cookies:
This cookie is set by the provider Lead-feeder to identify the IP address of devices visiting the website, so that multiple users coming from the same IP address can be retargeted.
This cookie is used by the WPForms WordPress plugin. The cookie is used to allow the paid version of the plugin to connect entries of the same user, and is used for some additional features like the Form Abandonment addon.
This cookie is used by the WordPress theme of the website. It allows the website owner to implement or modify the website content in real time.
Borlabs cookie This website uses Borlabs Cookie, which sets a technically necessary cookie (borlabs-cookie) to store your cookie consents. The provider of this service is Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany.
The cookie borlabs-cookie stores your consents that you have given when entering the website. If you wish to revoke these consents, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked again for your cookie consent.
Web analytics and marketing We use the following service for the purpose of web analysis.
Within the scope of web analysis, cookies may be used on various pages. These are text files that are placed on your computer and, among other things, also enable a smooth visit to our website.
If you consent to the processing of your data in the opt-in procedure (confirmation of the cookie banner), the lawfulness of the processing of your data is based on consent pursuant to Art. 6 (1) p. 1 lit. a) GDPR / Art. 4 (5) DSG, so that we use your data to the extent of the consent you have given for the purposes of marketing and evaluating your usage behavior.
The information generated by the cookie about your use of this website is usually transmitted to a Google LLC server in the USA and stored there. If applicable, information about the use of this website and your IP address will be transmitted to a Google server in the USA and also stored on this server. The data transfer is permissible based on your consent according to Art. 49 para. 1 p. 1 lit. a) GDPR / Art. 6 para. 2 lit. b DSG. In case of activation of IP anonymization on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.
On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google, unless you have configured the web and app activity settings in the settings of a Google account to allow Google to merge.
On our website, Google Analytics has been extended by the code “anonymizeIp” in order to be able to record IP addresses anonymously (so-called IP masking).
Please note that if you delete your cookies, the opt-out cookie will also be deleted and may need to be reactivated by you.
Google reCAPTCHA In order to be able to determine whether improper automated entries are being made in our internet forms, we use the Google reCAPTCHA service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This is used to protect legitimate interests pursuant to Art. 6 (1) p. 1 lit. f) GDPR / Art. 4 DSG. In this context, your referrer URL, your IP address, your behavior in relation to the input mask and, if applicable, further data required for the service are transferred to Google.
SalesViewer® This website uses SalesViewer® technology from SalesViewer® GmbH on the basis of the website operator’s legitimate interests (Section 6 paragraph 1 lit.f GDPR) in order to collect and save data on marketing, market research and optimisation purposes.
The data stored by Salesviewer will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them.
The data recording and storage can be repealed at any time with immediate effect for the future, by clicking on https://www.salesviewer.com/opt-out in order to prevent SalesViewer® from recording your data. In this case, an opt-out cookie for this website is saved on your device. If you delete the cookies in the browser, you will need to click on this link again.
Links to other websites Our website contains links to other external websites (Facebook, Twitter, Instagram, LinkedIn). These links are not so-called social plugins. If you click on a link, you will call up the corresponding website and will be redirected to it.
Insofar as we process your data on these external websites (e.g. by you contacting us via these websites), our data protection provisions apply.
In addition, the linked websites process your personal data for their own purposes. We cannot make any statement about the manner of processing, the purposes or the storage period of your personal data by these providers. Please refer to the data protection provisions of the respective provider to obtain further information about the processing of your personal data by them. You can find these under:
a) Employment relationship We process your personal data primarily for the proper implementation of the employment relationship and for compliance with the employment contract and legal obligations. As well as in the context of an application for the purpose of initiating an employment relationship. The legal basis for processing in this respect is Section 26 (1) BDSG as well as Article 6 (1) sentence 1 lit. c) GDPR / Article 4 DSG in conjunction with the relevant legal obligation in each case.
b) Sensitive data Insofar as we process sensitive data within the meaning of Art. 9 (1) GDPR / Art. 3 lit. c DSG from you, this is generally based on your consent (see point c)). In some cases, processing is necessary in order to exercise the rights accruing to us or to you under labor law and social security and social protection law or to comply with the obligations arising therefrom, Art. 9 (2) (b) GDPR / Art. 4 DSG.
c) Consent If you give us express consent to process your personal data for certain purposes (e.g. publication of your photograph), the respective processing is lawful on the basis of Art. 6 para. 1 sentence 1 lit. a) (if applicable, as well as Art. 9 para. 2 lit. a)) GDPR / Art. 4 DSG. Consent is given voluntarily and can be revoked at any time with effect for the future; refusal to grant consent is not associated with any disadvantages for the employment relationship. You can revoke a granted consent at any time without giving reasons with effect for the future (see section 9 below).
Consent to inclusion in the applicant pool
You have the option of consenting to inclusion in our general applicant pool. You can declare your consent, for example, as part of your (online) application or by e-mail to the e-mail address stored in the job posting.
If you consent, your personal data will be collected as already explained above and also stored beyond the specific application process for which you have submitted an application. In particular, you consent to us using this data to contact you at a later date and to continue or reopen the application process if you are considered for another position.
This consent is voluntary and can be refused without giving reasons, without you having to fear any disadvantages in the specific application process. A declared consent can be revoked at any time with effect for the future; in this case, your data will be deleted immediately after completion of the application process or until receipt of your revocation.
Irrespective of any revocation, your data will be deleted after one year at the latest, provided that no further job opportunities have arisen in the meantime.
Legal bases of the processing are in this respect § 26 BDSG in conjunction with. Art. 6 para. 1 p. 1 lit. a) and lit. b) GDPR / Art. 4 DSG.
d) Execution and initiation of contracts We process your personal data primarily in the context of the initiation of a contractual relationship with you to answer your inquiries, to process your orders and to make certain information about our offers accessible. Furthermore, the processing of your personal data is necessary in order to properly provide and invoice our services. Insofar as the processing of your personal data is necessary for the initiation or implementation of a contractual relationship with us or in the context of the implementation of pre-contractual measures, the processing is lawful on the basis of Art. 6 para 1 p. 1 lit. b) GDPR / Art. 4 DSG.
e) Legal obligation In some cases, we are subject to legal obligations that make it necessary for us to process your personal data. If we process your data on the basis of such an obligation, this is done on the basis of Art. 6 para. 1 p. 1 lit. c) GDPR / Art. 4 DSG.
f) Legitimate interest We also process your personal data insofar as this is necessary to protect the legitimate interests of us or third parties and it does not represent an unjustified interference with your rights and interests. The legal basis for such processing is Art. 6 para. 1 p. 1 lit. f) GDPR / Art. 4 DSG. Legitimate interests on the basis of which we process your data are in particular:
the organization and optimization of projects and workflows,
increasing efficiency in the areas of IT security / management, accounting, customer service or for financial planning,
the dutiful fulfillment of obligations to third parties,
increasing the attractiveness of our company (e.g. by naming a contact person),
Preventive random checks and repressive prosecution of possible violations of legal obligations and / or internal policies,
the prevention and detection of criminal acts,
the recovery of receivables,
the assertion of and defense against legal claims,
the effective implementation of the deletion of your data,
the implementation of events.
With customers and candidates
the improvement of our services and services
the creation of customized offers and products
the prevention of credit risks
the prevention and investigation of criminal offenses
the recovery of receivables
the assertion of and defense against legal claims
the effective implementation of the deletion of their data
compliance with legal requirements
If you send us photographs or other information that is not required for the application process, this data will be stored on the basis of Art. 6 (1) p. 1 lit. f) GDPR / Art. 4 DSG. The exclusive purpose of the processing here is to properly record your application and to be able to process it without falsification. In accordance with the legal requirements of the AGG, the photograph will not be taken into account in the selection decision on filling the position.
7. Origin of the personal data
We usually collect this data directly from you.
If we have not received your contact information from you personally (e.g.: handing you a business card or sending you a cover letter via email), we receive your information from the company you work for because we have a business relationship with them and you have been identified as our contact person, or we access publicly available information from public sources (such as company websites).
In some cases, we collect data about third parties.
8. Storage period and deletion periods
We process your data only as long as it is necessary for the purpose for which it was collected. In the case of customers and candidates, this is generally for the duration of our business relationship. This includes in particular the initiation and execution of contracts.
We generally store our employees’ data for as long as is necessary for the performance of the employment relationship; initially, this is generally the entire duration of your employment with us.
For the purpose of asserting and settling mutual claims arising from the employment relationship, data may be stored either until the expiry of a contractually agreed forfeiture clause or until the statute of limitations has run (generally three years beginning with the end of the year in which the claim arose and the respective claim became known). In this case, the earlier point in time is always decisive.
In addition, we are subject to various statutory retention and documentation obligations, such as those arising from the German Commercial Code (HGB) or the German Fiscal Code (AO). These can range from two to ten years. In particular, we keep accounting documents (invoices, contract documents, account statements, etc.) for ten years and commercial letters and other business documents relevant under tax law for six years (§§ 147 AO, 257 HGB).
Finally, the storage period is also governed by the statutory limitation periods, which according to Sections 195 et seq. of the German Civil Code (BGB) are generally three years, in
However, in certain cases, this can also be up to thirty years.
Lastly, we store your data for a short period of time to ensure effective data erasure. Our systems process a large amount of data every day. Unfortunately, it is not possible to reliably delete individual data to the exact day. For this reason, data is deleted on a rotational basis as part of a special deletion concept, taking into account the above-mentioned deadlines. In the process, your data may be stored by us for a short time beyond the above-mentioned periods. This storage is based on our legitimate interest in the effective and efficient execution of a data deletion.
If your application does not result in an employment relationship and you have not given your consent to be included in the applicant pool, we will delete your data within six months of receiving our rejection at the latest. If you have consented to be included in the applicant pool, we will store your data for a maximum of 36 months after our last contact (telephone, e-mail, personal meeting, etc.).
In the event of a successful application and subsequent employment with our company, your data required for the implementation and organization of the employment relationship will be stored for the duration of the employment relationship.
9. Data transfer and recipients of your personal data
We disclose your personal data within our company exclusively to those areas and persons who need this data to fulfill contractual and legal obligations or to protect our legitimate interests. In some cases, your personal data may also be processed by service providers employed by us. In these cases, data is usually transferred by us on the basis of order processing contracts in accordance with Art. 28 GDPR / Art. 10a DSG. In this way, we ensure that the processing of personal data by our service providers is always in accordance with the provisions of the GDPR / DSG. The categories of recipients in this case are tax advisors, lawyers, IT service providers, operators of social media channels, external company doctors, auditors, banking institutions and providers of customer management systems and software, as well as other recipients to whom the transfer is directly necessary for the establishment or fulfillment of the contract.
Otherwise, your data will only be transferred to other recipients outside our company if this is permitted or required by law, the transfer is necessary for the performance or execution of the contract or, at your request, for the implementation of pre-contractual measures, we have your consent or we are authorized to provide information. Under these conditions, we may transfer your data in particular to the following recipients:
Bexio AG, Alte Jonastrasse 24, 8640 Rapperswil-Jona, Switzerland
Clockodo GmbH, Viktoriastraße 25 A, 59425 Unna, Germany
Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company located in the U.S.)
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (parent company located in the U.S.)
Bullhorn International Limited, 155 Bishopgate, 8th Floor, London, United Kingdom (parent company located in the USA)
If data is transferred to a third country on the basis of consent without an adequacy decision or other suitable guarantees being in place at the same time, the associated increased risk of data processing in the context of the transfer must be pointed out on the basis of Art. 49 (1) p. 1 lit. a) GDPR / Art. 6 DSG. However, we would like to assure you that thanks to careful selection and constant review of the standards of our contractual partners, potential risks are successfully minimized.
11. Cross-border data processing due to the use of social media/website
If your applicant data is processed via the social media presence of the Flex Suisse Group, this data may be transferred to a third country. This transfer takes place on the basis of your consent and, in part, on the basis of standard contractual clauses within the meaning of Art. 46 (2) c) GDPR / Art. 6 DSG. If data is transferred to a third country on the basis of consent without an adequacy decision or other suitable guarantees being in place at the same time, reference must be made to the associated increased risk of data processing in the context of the transfer on the basis of Art. 49 (1) sentence 1 lit. a) GDPR / Art. 6 DSG (cf. Section 2.4). However, we would like to assure you that thanks to careful selection and constant review of the standards of our contractual partners, potential risks are successfully minimized.
The categories of recipients in these cases are operators of social media platforms such as
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Meta Platform Inc, 1 Hacker Way, Menlo Park, CA 94025, USA
LinkedIn Inc, 1000 W Maude, Sunnyvale, CA 94085, USA
12. Your data subject rights
You have the right to information about the processing of your personal data carried out by us according to Art. 15 GDPR / Art. 8 DSG, the right to correction or deletion of your data according to Art. 17 GDPR / Art. 5 & 12 DSG, the right to restriction of processing, according to Art. 18 GDPR / Art. 4 DSG, the right to notification according to Art. 19 GDPR / Art. 8 DSG and the right to data portability according to Art. 20 GDPR / Art. 8 DSG.
If we process your personal data on the basis of your consent in accordance with Art. 6 para. 1 p. 1 lit. a) GDPR / Art. 4 DSG, you have the right to revoke this at any time in accordance with Art. 7 GDPR. We would like to point out that a revocation is only effective for the future. Processing that took place before your revocation is not affected by your revocation and remains lawful. Please note that despite your revocation, we are legally obligated to retain and document certain data (see section 6 of this privacy information).
Right of objection Insofar as the processing of your personal data is carried out for the protection of legitimate interests pursuant to Art. 6 (1) p. 1 lit. e) or lit. f) GDPR, you have the right pursuant to Art. 21 GDPR to object to the processing of this data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing. These must override your interests, rights and freedoms, or the processing must serve the assertion, exercise or defense of legal claims.
To exercise your above-mentioned rights, it is sufficient to send a letter in text form to the above address or by email to firstname.lastname@example.org
13. Right of appeal
You have the right to complain to the competent data supervisory authority.
In Hesse, the responsible supervisory authority is: The Hessian Commissioner for Data Protection and Freedom of InformationPO Box 3163 65021 Wiesbaden Phone: +49 611 1408 – 0 Mail: email@example.com
As a rule, the provision of personal data for the purpose of establishing, implementing or fulfilling a contract or for the performance of pre-contractual measures is not required by law or contract. You are therefore not obliged to provide personal data. However, please note that these are usually required for the decision on the conclusion of a contract, the fulfillment of the contract or for pre-contractual measures.
If you do not provide us with personal data, we may not be able to make a decision within the scope of contractual measures. We recommend that you only provide personal data that is required for the conclusion of the contract, the fulfillment of the contract or pre-contractual measures.
15. Automated decision making
As a matter of principle, we do not use any processes that involve fully automated decision-making in accordance with Art. 22 GDPR. If we do use such procedures in individual cases, we will inform you separately and obtain your consent if this is required by law.
16. Up-to-dateness and amendment of this privacy information
This privacy information is currently valid and has the status January 2023.