Privacy Policy
Last updated 28 June 2026 · Swiss data residency · Swiss DSG / EU GDPR aligned.
1. Controller
The data controller is Flexhand AG, Switzerland (contact: legal@flexhand.ch). We process personal data in accordance with the Swiss Federal Act on Data Protection (revDSG/nDSG, in force 1 September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR). Swiss residents may rely on DSG rights; EU residents may rely on GDPR rights — the higher standard applies in each case.
2. What we collect
Operators: account data (name, email, phone), profile data (role, years of experience, languages, canton, work authorisation, availability), certificates (type, category, expiry date, uploaded file names), uploaded documents (CV, ID, permit), work records you log (batch counts, production runs, in-spec rates), improvement ideas and estimated savings, earnings records, and XP/level data.
Employers: company name, contact name, email, registered address, shift postings, application decisions and ratings submitted for operators.
All users: authentication tokens, session data, email addresses used for verification and password reset, and server logs (IP address, browser, timestamp) retained for security and debugging.
3. Legal basis
We process data on the basis of: (a) contract performance — to operate the platform and provide matching services; (b) legitimate interest — to maintain platform security, prevent fraud, and improve the service; (c) consent — for marketing emails (you may withdraw at any time); (d) legal obligation — where Swiss employment or financial regulations require retention.
4. How we use your data
To create and manage your account, to verify certificates and publish your operator profile, to match operators to employer shift postings, to send transactional emails (application status, shift updates, password reset), to calculate XP and rank, and to generate anonymised aggregate statistics for internal reporting. We do not use your data for automated individual decision-making that produces legal or similarly significant effects without human review.
5. Who sees your data
Your operator profile is visible to verified employers and site visitors (name, role, certificates, availability, XP level). Detailed documents (CV, ID, permit) are visible to Flexhand staff only. Employer shift data and applicant details are visible to the relevant employer and Flexhand staff. We do not sell personal data. We may share data with sub-processors (database hosting, email delivery) under contracts that ensure an equivalent level of protection.
6. International transfers
Our database is hosted on Neon (PostgreSQL), with servers in the EU (eu-central-1). Email delivery uses GoDaddy SMTP infrastructure. Where data is transferred outside Switzerland or the EU/EEA, we rely on Standard Contractual Clauses or an adequacy decision.
7. Retention
We retain your data for as long as your account is active. You may request deletion at any time (see §8). On deletion, personal data is removed within 30 days, except where retention is required by law (e.g. accounting records under OR Art. 958f). Work records are anonymised rather than deleted where they form part of an employer's documented production history.
8. Your rights
Under the DSG and GDPR you have the right to: access the personal data we hold about you; rectify inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; receive your data in a portable format (JSON/CSV on request); withdraw consent at any time without affecting prior processing. To exercise any right write to legal@flexhand.ch. We respond within 30 days. If you believe we are processing your data unlawfully you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.
9. Cookies and tracking
We use a single session cookie required for authentication. We do not use third-party advertising cookies or fingerprinting. No personal data is sent to analytics services. Server logs are the only telemetry we retain.
10. Security
Passwords are hashed using bcrypt before storage. All data in transit is encrypted with TLS. Database access is restricted to application servers and Flexhand staff on authorised devices. We conduct periodic security reviews.
11. Changes
We will notify you by email or in-app notice at least 14 days before material changes to this policy. The date at the top of this page indicates the last revision.
Questions about your data? Contact legal@flexhand.ch