Privacy Policy
Personal data stays personal.
Last updated: 12 October 2026
1. Data controller
The data controller under the revised Swiss Federal Act on Data Protection (revDPA) and — where applicable — the EU General Data Protection Regulation (GDPR) is:
Xeloba GmbH Belpstrasse 39, 3007 Bern, Switzerland +41 31 839 04 04 info@xeloba.ch
For privacy enquiries and to exercise your rights, please write to info@xeloba.ch.
2. Principles
We process personal data only in good faith, in a proportionate and transparent manner, and for the specific purpose stated in advance. Processing complies with revDPA and GDPR. We do not share your data with third parties without a corresponding legal basis, and we do not transfer it to countries without an adequate level of protection unless suitable safeguards are in place.
3. Categories of data we process
| Category | Examples | Source |
|---|---|---|
| Server logs | IP address, user agent, URL, timestamp | automatic on visit |
| Analytics | Pseudonymised usage data (see §6) | only with your consent |
| Application data | Name, contact details, CV, certificates, LinkedIn profile data | application form |
| Jobmail | Email address, selected categories | jobmail form |
| Communications | Content of your emails and calls | correspondence |
4. Purposes of processing and legal bases
| Purpose | Legal basis |
|---|---|
| Operation and security of the website (server logs, max. 14 days) | legitimate interest (Art. 6(1)(f) GDPR) / Art. 31 revDPA |
| Handling your application and any disclosure to the client | pre-contractual measure (Art. 6(1)(b) GDPR) |
| Sending the Jobmail newsletter | consent (Art. 6(1)(a) GDPR) — revocable at any time via “Unsubscribe” |
| Audience analytics and remarketing (Google Analytics 4, LinkedIn) | only with separate consent (Art. 6(1)(a) GDPR) — revocable at any time via the Cookie Settings below |
| Retention of application documents after a placement (five years, see §8) | legitimate interest (Art. 6(1)(f) GDPR) / Art. 31 revDPA |
| Compliance with statutory retention obligations | legal obligation (Art. 6(1)(c) GDPR) |
5. Hosting and processors
The website and the applicant-tracking system are operated on infrastructure provided by Hetzner Online GmbH (Industriestrasse 25, 91710 Gunzenhausen, Germany) in the EU data centres at Falkenstein and Nuremberg. Application documents (CVs, certificates) are held on Hetzner Object Storage in Falkenstein and Helsinki, likewise within the EU; no transfer to a third country takes place for hosting and storage.
For audience analytics and remarketing audiences we work with Google LLC (Google Analytics 4, Google Ads) and with LinkedIn Corporation (LinkedIn sign-in, remarketing audiences). Both providers are based in the United States. These services are only activated once you have given us your consent (see §6).
For sending confirmation and Jobmail emails we use Mailgun Technologies Inc. (United States; an EU region is available).
Where data is transferred to the United States in connection with these services, the transfer is based on the EU Standard Contractual Clauses and — where the provider is certified there — on the EU-U.S. and Swiss-U.S. Data Privacy Framework. We will provide a copy of the Standard Contractual Clauses on request to info@xeloba.ch.
6. Cookies and local storage
We do not set technically unnecessary cookies before you consent. The following storage mechanisms are used:
| Key | Purpose | Storage | Lifetime |
|---|---|---|---|
xeloba.cookieConsent | Stores your cookie decision (“accepted” / “declined”) | localStorage | until you delete or change it |
_ga, _ga_* | Pseudonymous visitor identification for Google Analytics 4 | cookie | up to 24 months — only after consent |
LinkedIn Insight Tag (li_*) | Conversion measurement and remarketing audiences | cookie | up to 24 months — only after consent |
You may withdraw or change your consent at any time via the Cookie Settings panel at the bottom of this page. Withdrawal applies prospectively.
Reach measurement in our own system. If you have consented, we additionally count how often our job pages are viewed, within our own applicant tracking system. No cookie and no local-storage entry is created. From your IP address, your browser identifier and the date we derive an irreversible check value that only tells us whether two views on the same day came from the same device. On the next day the same device produces a different value, so recognition across days is impossible. After 90 days we delete these check values; only the plain count remains. Without your consent this counting does not take place.
7. Server logs
When you visit our website, the web server automatically records your IP address, user agent, date and time, and the URL requested. This data is used solely for the operation and security of the website (detecting and blocking abuse) and is deleted or anonymised after 14 days at most. The data is not combined with other sources.
8. Application process
When you apply to us via the online application form, we collect and process the data and documents you submit (name, contact details, CV, certificates, LinkedIn profile data where provided) for the purpose of handling your application. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) and Art. 31 revDPA respectively.
Mandatory information. To handle your application we need your first and last name, an email address and your CV; these fields are marked as mandatory in the form. Without them we cannot process your application. All other information is voluntary.
Where the data comes from. We collect your data from you alone. We do not obtain candidate data from other sources, and we do not approach people whose data was not submitted to us by themselves.
Disclosure to the client. Within the mandate you are applying for, we may pass your application documents to the client; that client is contractually bound to use them for this purpose only. We do not publish your documents and do not disclose them to any other third party unless we are legally obliged to do so or you have expressly agreed. Our clients are based exclusively in Switzerland and the EU; this disclosure therefore involves no transfer to a country without an adequate level of data protection.
Retention. If you are not hired, we keep your application documents until the mandate is completed and destroy them thereafter; digital documents are deleted. Where a placement is made, we keep the documents of the person hired for five years — to administer and to evidence the mandate (legitimate interest, Art. 6(1)(f) GDPR / Art. 31 revDPA). You may request deletion of your data at any time — an email to info@xeloba.ch is sufficient.
No talent pool. We do not maintain a talent pool. Your documents are not used for other positions and — apart from the five-year period stated above where a placement is made — are not retained beyond the mandate for which you submitted them.
No automated individual decisions. We do not take decisions about your application based solely on automated processing. Your application is not scored, ranked or pre-selected automatically; every assessment is made by a person (Art. 21 revDPA, Art. 13(2)(f) and Art. 22 GDPR).
Optional remarketing consent. In the application form we ask you separately, and on a voluntary basis, whether your email address may be transmitted in pseudonymised form (as a hash value) to Google and LinkedIn so that more relevant content and pointers to further positions can be shown to you during your job search. Without your consent, no such transmission takes place. The consent is voluntary, has no impact on your application, and may be withdrawn at any time (an email to info@xeloba.ch is sufficient).
9. Jobmail
When you subscribe to Jobmail, we store your email address and the categories you selected so we can send you matching new positions. After signing up you receive an email with a confirmation link; the subscription becomes active only once you have confirmed it. The subscription is based on your consent and can be ended at any time via the “Unsubscribe” button or the unsubscribe link in every email.
Retention. Your sign-up is stored in our system as a record containing your email address. If you unsubscribe, we stop the mailing: the record is marked as unsubscribed, but it is not deleted. Your email address therefore remains stored with us. The same applies if you never confirm the sign-up — the record then remains stored as unconfirmed. There is no automatic deletion after a fixed period. You may request deletion at any time — an email to info@xeloba.ch is sufficient; we then delete the record.
Here too the remarketing consent is separate and voluntary.
10. Your rights
You have the following rights at any time:
- Access to the data we process about you (Art. 25 revDPA / Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data, subject to any statutory retention obligations (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability in a structured, machine-readable format (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR / Art. 6(6) revDPA)
- Complaint to the competent supervisory authority — in Switzerland: Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch
Please send requests to info@xeloba.ch. We respond within 30 days.
11. Data security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss and manipulation. In particular, we use TLS encryption on all public endpoints, encryption-at-rest for stored application documents, and role-based access controls in the internal applicant-tracking system.
12. Minors
Our website is aimed at adults. We do not knowingly process data of persons under 16. If such data is transmitted to us inadvertently, we delete it without delay.
13. Changes to this policy
We reserve the right to adapt this privacy policy to reflect changes in law or in our services. The version published on this page at the time of your visit applies.