Privacy

In this privacy policy, we explain how we collect and process personal data. This is not an exhaustive description; other privacy policies may address specific issues. Personal data includes all information relating to an identified or identifiable person.

If you provide us with personal data of other individuals (e.g., family members, colleagues), please ensure that these individuals are aware of this privacy policy and only share their personal data with us if you are authorized to do so and the data is accurate.

This privacy policy is designed to comply with the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Federal Data Protection Act ("FADP"), and the revised Swiss Federal Data Protection Act ("revFADP"). Whether and to what extent these laws apply depends on the specific case.

The controller responsible for the data processing described here is:

If you have data protection concerns, you can contact us at the following address: mario.kaiser@savoirpublic.ch

Currently, there is no data protection officer as per Art. 37 GDPR.

We primarily process the personal data we collect during the use of our platform www.savoirpublic.ch, including:

• Registration data: When creating a profile, we collect personal data such as names, email addresses, and any additional voluntary information.

• Tracking data: Using Google Analytics, we collect information about website usage, such as anonymized IP addresses, pages visited, and usage behavior.

• Transaction data: Through SendGrid, we process your email address for sending transactional emails, such as confirmations or notifications. We use Google Firebase to process the activities of registered users in order to display notifications.

• Technical data: To ensure security and availability, we use Cloudflare, which processes data such as IP addresses and access times.

As part of creating and storing researchers' profiles, we use OpenAI technology to transform text into a vector database. This serves exclusively to make profiles available for the platform's search function and to optimize the assignment of expertise to questions. Processing is based on legitimate interests (Art. 6(1)(f) GDPR), as it is essential for the platform's functionality.

We process personal data for the following purposes:

• Provision of the platform www.savoirpublic.ch and its functions (Legal basis: Contract performance).

• Communication with users, e.g., by sending confirmations and notifications (Legal basis: Contract performance or legitimate interest).

• Improvement and analysis of platform usage, e.g., through Google Analytics (Legal basis: Legitimate interest).

• Ensuring platform availability and security, e.g., through Cloudflare (Legal basis: Legitimate interest).

• Compliance with legal obligations, e.g., retention of invoices (Legal basis: Compliance with legal obligations).

We use cookies and tracking technologies on our website to:

• Analyze your website usage (Google Analytics).

• Ensure website security and availability (Cloudflare).

Google Analytics is configured to anonymize IP addresses. You can disable cookies through your browser settings at any time. Please note that some website functions may be limited if cookies are disabled.

We incorporate visible and invisible image elements into our newsletters, as permitted, to determine whether and when you open the email. This helps us better understand if and how you use our offerings and tailor them to your needs. You can block this in your email program; most programs are set to do this by default.

By using our websites and apps and consenting to receive newsletters and other marketing emails, you agree to the use of these technologies. If you do not wish this, you must adjust your browser or email program settings or uninstall the app if settings cannot be adjusted otherwise.

To process and store researchers' profiles, we use OpenAI technology. The content of the profiles is transferred to and processed in the USA exclusively for generating vector embeddings for use in our vector database.

Processing is carried out in compliance with applicable data protection regulations. OpenAI is a service provider based in the USA. We have implemented contractual safeguards (e.g., standard contractual clauses) to ensure an adequate level of data protection. No sensitive personal data (e.g., health data) or data from users submitting questions is transmitted to OpenAI.

Researchers are requested not to include sensitive personal data in their profiles (e.g., health data, religious beliefs, or political opinions).

Otherwise, we do not share personal data with third parties unless:

• You have explicitly consented to the sharing.

• Sharing is necessary to fulfill our contractual obligations (e.g., when using third-party providers like SendGrid for email delivery).

• There is a legal obligation to share the data (e.g., with authorities).

Data made public by users through registration or activities on the platform (e.g., questions or answers) is visible to the public and may be accessed by third parties. Responsibility for such publications lies with the users themselves.

For certain technical and operational purposes, we use trusted third-party providers to process data on our behalf. These include:

• Google Analytics: For analyzing website usage. (Location: EU and USA, with IP anonymization.)

• SendGrid: For sending transactional emails. (Location: USA.)

• Cloudflare: For ensuring the security and performance of our platform. (Location: Global.)

These providers are required to process data in compliance with applicable data protection regulations. Where data is transferred to countries without adequate legal data protection, we ensure an adequate level of data protection through contractual agreements (e.g., standard contractual clauses).

We store personal data only as long as it is necessary to fulfill the respective purposes or as required by law. Retention periods are determined as follows:

• Registration data (researchers and users asking questions): Data collected during registration or use of the platform is retained for the duration of active account use. After 12 months of inactivity or account deletion, the data is deleted or anonymized unless legal retention obligations apply.

• Published content (e.g., questions, answers): Public contributions such as questions and answers remain visible on the platform even after account deletion. If you wish specific content to be removed, please contact us.

• Technical and security-related data: Log data and technical information collected during website usage (e.g., IP addresses or access times) are generally retained for 12 months to ensure platform security and operation.

• Emails and communication: Data sent to us as part of support or other inquiries is archived for the duration of processing and beyond in accordance with legal retention obligations (e.g., 6 or 10 years).

• Data in the vector database: Profiles of researchers stored in the vector database remain there as long as the profile is active. After a profile is deleted, the associated vectors are also deleted.

After the aforementioned periods expire, data is deleted or anonymized unless there are legal retention or documentation obligations.

We implement appropriate technical and organizational security measures to protect your personal data from unauthorized access and misuse.

To use our platform www.savoirpublic.ch, providing certain personal data is required. This includes:

• Registration: To create a profile as a user or researcher, you must provide personal data (e.g., name, email address). Without this information, we cannot enable registration and use of the platform.

• Technical use: To ensure the functionality of the website, it is necessary to collect and process technical data such as IP addresses and access times. Without this data, access to the website and certain features cannot be guaranteed.

You are not obligated to provide additional personal data. However, some functionalities or personalized services may be limited if you choose not to provide certain voluntary information.

We partially process personal data automatically to evaluate certain aspects and make our platform more efficient. This includes:

• Matching expertise with questions: We use a profiling process to match information provided in researchers' profiles with users' inquiries. This involves analysis models such as embedding data in a vector database.

• Platform analysis and improvement: Automated evaluations help us optimize the platform and better understand usage patterns, such as frequently asked questions.

We do not use fully automated decision-making as defined by Art. 22 GDPR that would have legal or similarly significant effects on you. Should such decision-making be used in specific cases, we will inform you in advance and ensure your rights are protected according to legal requirements.

Under applicable data protection laws, you have the following rights regarding your personal data, where provided:

• Right to access: You can request information about whether and which personal data we process about you.

• Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data.

• Right to erasure: You can request the deletion of your personal data unless legal retention obligations or legitimate interests on our part conflict with this.

• Right to restriction of processing: Under certain conditions, you can request the restriction of the processing of your personal data.

• Right to object: You have the right to object to the processing of your personal data at any time, particularly if the processing is based on our legitimate interests.

• Right to data portability: You can request that we provide your personal data in a structured, commonly used, and machine-readable format to you or another controller.

Please note that we reserve the right to enforce statutory limitations, for example, if we are obligated to retain or process certain data or have overriding interests. If costs arise in processing your request, we will inform you in advance.

Exercising your rights: Exercising these rights usually requires you to prove your identity, for example, by providing a copy of your ID if your identity cannot otherwise be verified. To exercise your rights, please contact us at the details provided in Section 2:

Right to lodge a complaint: If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the relevant data protection authority. The responsible data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC):

We may update this privacy policy at any time without prior notice. The current version published on our website applies. If the privacy policy is part of an agreement with you, we will notify you of the update via email or other appropriate means.