Contents 

I. General provisions 

II. Processing of personal data 

III. Storage and security of personal data 

IV. Supply of personal data 

V. Rights of individuals concerned  

VI. Protection of rights 

VII. Final provisions 

 

I. General provisions 

 

Article 1. Definitions 

 

In these regulations, pursuant and supplemental to the Personal Data Protection Act, (Bulletin of Acts and Decrees 2000, 302), the following terms have the following definitions:  

 The act: the Personal Data Protection Act;  

 The regulations: these regulation, including the schedules;  

 Personal data: any fact concerning an identifiable natural person (the individual); 

 Processing of personal data: any act or combination of acts relating to personal data, including the collating, recording, organising, storing, processing, changing, calling up, examining, using and supplying through forwarding, distributing or any other form of provision, gathering, linking, and the screening, erasing or destroying of data; 

 File: any cohesive whole of personal data that is accessible subject to certain criteria and that relates to various persons; 

 Responsible party: the Managing Director of ResQCon GmbH; 

 Processor: the person who processes personal data on behalf of the responsible party, without being subject to its direct authority; 

 Individual: a person whose personal data is at issue; 

 Manager: a person who is responsible for the day-to-day task of processing, storing, removing and supplying personal data, and for the accuracy of the data input, under the responsibility, and for the benefit, of the responsible party; 

 Consent of the individual: the free consent, based specifically on the information before him/her, by which an individual accepts the processing of personal data relating to him/her; 

 Supply of personal data: the disclosure or supply of personal data.  

 

Article 2. Scope  

 

These regulations apply within ResQCon GmbH to the fully or partially computerised processing of personal data performed under the responsibility of ResQCon GmbH, as well as to the documents on which this is based, as included in a file. The regulations also govern the non-computerised processing of personal data included in a file or that are intended to be included in a file. The separate processes or combination of processes are described in the schedules. These schedules form part of these regulations. 

 

II. Processing of personal data 

 

Article 3.  

 

Various different processes of personal data are carried out at ResQCon GmbH. For each separate process, the schedules to these regulations specify: - who is the responsible party, the manager and the processor; - what the purposes of the processing are; - what categories of personal data are processed; - what sorts of personal data at most are processed and how this data is obtained; - to which persons within or outside the organisation what kind of personal data can be supplied, given the purpose and basis of the processing. 

 

Article 4.  

 

4.1 Personal data must be processed with the proper degree of skill and care and in accordance with the law.  

 

4.2 Personal data will be collated for properly defined, clearly described and justified purposes.  

 

4.3 Personal data will only be processed insofar as it is sufficient, relevant and not excessive having regard to the purposes of the processing.  

 

4.4 The responsible party will adopt measures to guarantee as far as possible that the personal data to be processed is true and accurate. 

 

Article 5.  

 

Personal data may only be processed if one of the following principles applies: 

a. the individual has given his/her unequivocal consent to the processing;  

b. the processing of the data is necessary for drawing up and entering into a contract with the individual; 

c. the processing of the data is necessary for compliance with a statutory obligation upon the responsible party; 

d. the processing of the data is necessary to protect a vital interest of the individual; 

e. the processing of the data is necessary for the proper performance of a public-law duty on the part of ResQCon GmbH or the management body to which the data is supplied;  

f. the processing of the data is necessary for protecting the justified interests of the responsible party or a third party to whom the data is supplied, and no conflict arises with the interests or fundamental rights and liberties of the individual.  

Article 6. 

6.1 Personal data may not be processed in a way that is incompatible with the purposes for which it was obtained. In determining whether any processing is incompatible in this way, the following matters, amongst others, will be taken into account: 

a. The relationship between the purpose of the intended processing and the purpose for which the data was obtained;
b. The nature of the relevant data;
c. The consequences for the individual of the intended processing;

d. The manner in which the data is obtained;
e. The degree to which the individual is protected by appropriate guarantees. 

6.2 Additional processing of the data for historic, statistical or academic purposes is not deemed to be incompatible if the necessary measures have been taken to guarantee that the additional processing will only be used for these specific purposes. 

III. Storage and security of personal data 

Article 7. 

7.1 The responsible party must take appropriate technical and organisational measures to secure the personal data against loss or any form of unlawful processing, including measures against unnecessary further processing of personal data. 

7.2 Persons who within ResQCon GmbH or who on the instructions of ResQCon GmbH are responsible for the processing of personal data must preserve the confidentiality of the personal data that comes to their knowledge, except where any statutory regulation requires them to disclose it. The responsible party will take the necessary measures to guarantee compliance with this duty of confidentiality. 

7.3 Personal data will not be kept in a form that enables the individual to be identified for any longer than is necessary for the purposes for which it was processed. 

7.4 Personal data may be kept longer than referred to in section 3 insofar as this is done for historic, statistical or academic purposes and the necessary measures have been taken to guarantee that the data will only be used for these specific purposes. 

7.5 The manager must ensure that the personal data is destroyed if and insofar as it cannot any longer be stored in the manner described in the previous sections of this article. 

IV. Supply of personal data 

Article 8. 

The responsible party will not forward any personal data to a company or branch located in a non-EU Member State without the appropriate levels of protection of privacy, unless the conditions set out in Article 77 of the Act are satisfied. 

V. Rights of individuals concerned 

Article 9. 

9.1 Every individual is entitled to examine (Article 10) or correct, add to, remove or screen (Article 11) such of his/her personal data as is involved in the different data processes, and is entitled to object (Article 12), as set out in these regulations. 

9.2 In exercising his/her rights, an individual should ensure that the responsible party is able to establish the identity of the individual and must produce a current proof of identity or send a copy of the same as an attachment to any application/objection/complaint, which copy he/she must sign/co-sign. 

Article 10. Right of examination 

1. Any individual may submit a written application to examine his/her own personal data, subject to a reasonable length of time between applications, to the responsible party. 

10.2 The addressee of the said application must supply the requested information in writing within four weeks of receipt of the application. 

10.3 An individual has the right to obtain on request – subject to paying an administrative charge in advance of €5 – a copy of the personal data on his/her file. 

Article 11. Right to correct, add to, remove or screen personal data 

11.1 At the request of an individual, the responsible party will ensure that this individual’s personal date is corrected, added to, removed or screened if and insofar as it is factually incorrect, incomplete for the purposes of processing, not relevant or excessive, or otherwise processed in breach of any statutory regulation. 

11.2 An individual may send a written request as referred to in section 1, above, to the responsible party. The individual must indicate in his/her request what specific changes he/she requires. 

11.3 The addressee of the said request must notify the individual in writing within four weeks of receipt of the request the extent to which and manner in which the request will be met. Reasons must be given for any refusal. 

12.4 The addressee of the said request must ensure that any decision to change the personal data is implemented as soon as possible. Where possible, and provided that it does not involve a disproportionate amount of effort, the addressee will notify third parties to whom incorrect data had been previously supplied of these changes as soon as possible. The individual will be notified of these steps. 

Article 12. Right to object 

12.1 If data is processed pursuant to Article 5 (e) and (f) of these regulations (Article 8 (e) and (f) of the Act), the individual may file an objection with the responsible party based on special personal circumstances. 

1. The individual may file a written objection with the responsible party.

12.3 Within four weeks of receipt of the objection, the responsible party will decide whether the objection is justified. An objection to processing for commercial or charitable purposes will always be held to be justified. If the responsible party finds the objection to be justified, he/she will immediately take steps to terminate the processing which was objected to and to eradicate the consequences thereof as far as possible.
The responsible party will notify the individual submitting the objection in writing of his/her decision and of any steps taken. Reasons must always be given for any rejection of an objection. 

Article 13. 

13.1 If an individual is unable to exercise the rights set out in this section himself/herself, he/she may give a written authority to someone else to act on his/her behalf. 

13.2 If any compelling interest of an individual so demands, a request as referred to in Articles 10 or 11 may be dealt with in confidence and orally as referred to in Article 37 of the Act. 

VI. Protection of rights 

Article 14. 

14.1 An individual may submit a written complaint to the responsible party if or when he/she believes that the responsible party is failing to comply with the statutory provisions regarding protection of privacy, or with the terms of these regulations. The responsible party must respond within four weeks of receipt of the complaint and resolve the complaint in the best way possible. 

14.2 A decision taken in respect of an application referred to in section V of these regulations or in response to a signed objection, is deemed to be a decision by ResQCon GmbH. 

If such a decision is taken by ResQCon GmbH, the interested parties may file an appeal with the court in Switzerland within six weeks of receipt of the disputed decision in accordance with Article 46 of the Act. 

14.3 Notwithstanding the provisions of section 2 of this article, the person concerned may appeal to the Swiss Data Protection Authority for its mediation or advice within six weeks of receipt of the disputed decision. 

VII. Final provisions 

Article 15. 

In circumstances not covered by these regulations, any decision will lie with the responsible party. 

Article 16. 

These regulations can be cited as the Personal Data Protection Regulations of ResQCon GmbH.

The responsible party has the authority to amend or supplement these regulations. Changes come into force as soon as they have been published.

The responsible party will notify individuals of the existence of these regulations and of any changes hereto.