Privacy Policy “Graubünden Job Match” – Version dated 22 September 2025
Note: This English translation was created with the assistance of artificial intelligence. In case of discrepancies or interpretation issues, the original German version of this Privacy Policy shall prevail.
In this privacy policy, we explain how we, Graubünden Job Match, collect and otherwise process personal data. Personal data means all information relating to an identified or identifiable individual.
If you disclose or provide data to us about other persons (e.g., family members, representatives, counterparties, other related persons or colleagues), we assume that you are authorized to do so and that such data are correct.
This privacy policy is aligned with the requirements of the Swiss Federal Act on Data Protection (“FADP”). Although we follow the principles of the EU General Data Protection Regulation (“GDPR”), our processes are primarily governed by Swiss law.
1. Controller / Data Protection Officer / Representative
The controller responsible for the data processing described here is Graubünden Job Match c/o GastroGraubünden, Loëstrasse 161, 7000 Chur. Unless otherwise indicated in an individual case, you can address data protection matters to the following contact: info@graubuenden.jobs.
Our representative in the EEA pursuant to Art. 27 GDPR is: JOBN GmbH, FN 475010 w, Sillgasse 8a, 6020 Innsbruck.
2. Collection and Processing of Personal Data / Purposes of Processing and Legal Bases
We primarily process the personal data that we receive from our customers and other business partners (and the individualsinvolved) in the context of our business relationships, or that we collect from users when operating our websites, the app and other applications. If you use our services, our websites graubuenden-job-match, graubuenden.jobs and/or the “Graubuenden Job Match” app, or otherwise deal with us, we obtain and process various categories of your personal data.
Where permitted, we also obtain certain data from publicly accessible sources (e.g., debt collection registers, land registers, commercial registers, press, internet) or receive such data from other entities within the Tourism Alliance Graubünden, namely the associations GastroGraubünden, HotellerieSuisse Graubünden and Bergbahnen Graubünden.
In addition to the data you provide directly to us (e.g., when creating an account or entering a user profile), the categories of personal data we receive from third parties about you include in particular: information from public registers; information we learn in connection with administrative and court proceedings; information relating to your professional roles and activities; creditworthiness information (where we transact with you personally); information about you provided by persons in your environment (family, advisers, legal representatives, etc.); information from banks, insurers, distribution and other contracting partners regarding your use or provision of services; information about you from media and the internet (where appropriate in a given case, e.g., in the context of an application, press review, marketing/sales, etc.); your addresses and, where applicable, interests and other sociodemographic data (for marketing); data related to the use of the website and app (e.g., IP address, MAC address of your smartphone or computer, information about your device and settings, cookies, date and time of the visit, pages and content accessed, functions used, referring website, location data).
Specific categories of personal data that we process include:
• Contact details (name, email address, telephone number);
• Information in a user profile (“About me,” industries, availabilities, education, place of work, benefits, if applicable a photo);
• Payment information;
• Particularly sensitive personal data (e.g., health data) are processed only where necessary to fulfill our service (e.g., in connection with special requirements for a workplace) and where explicit consent is given or a legal basis permits such processing.
3. Purposes of Data Processing and Legal Bases
We use the personal data we collect primarily to conclude and fulfill our contracts with our customers and business partners—particularly in the context of employment intermediation and providing a job platform with our customers—and to procure products and services from our suppliers and subcontractors, as well as to comply with our legal obligations in Switzerland and abroad. If you act for such a customer or business partner, your personal data may also be processed in that capacity.
The processing of personal data is lawful, carried out in good faith, and proportionate to a specific purpose that is recognizable to the data subject. Personal data are deleted or anonymized as soon as they are no longer required for the processing purpose.
Beyond this, we process personal data about you and other persons, where permitted and as appears appropriate, for the following purposes, in which we (and sometimes third parties) have a legitimate interest corresponding to the purpose (Art. 31 para. 2 FADP). In particular, we may collect and otherwise process such data for the following purposes:
• Communication: We process personal data so that we can communicate with you and third parties by email, telephone, post, or otherwise (e.g., to respond to inquiries). For this, we process in particular the content of the communication, your contact details and communication metadata, as well as image and audio recordings of (video) calls. For employment intermediation, it is also necessary that we communicate with potential employers and share the necessary personal data.
• Initiation and conclusion of contracts: For entering into a contract with you or with your client or employer, we may collect and process in particular your name, contact details, powers of attorney, declarations of consent, information about third parties, contract content, and any other data that you provide to us or that we obtain from public sources or third parties.
• Administration and performance of contracts: We collect and process personal data so that we can fulfill our contractual obligations towards our customers and other contracting partners and provide and enforce contractual services.
• Advertising and marketing (including holding events): We process your personal data unless you have objected to the use of your data (if we send you advertising as an existing customer, you can object at any time; we will then place you on a blocking list for further marketing communications).
• Operation of our website and other digital offerings: To operate our website securely and stably, we collect technical data such as IP address, details about the operating system and settings of your device, the region, time and type of use. We also use cookies and similar technologies.
• Security purposes and access controls: We collect and process personal data to ensure and continuously improve the appropriate security of our IT and other infrastructure (e.g., buildings). This includes, for example, monitoring and controlling electronic access to our IT systems and physical access to our premises (also using procedures that process biometric data), analyses and tests of our IT infrastructures.
• Compliance with laws, directives and recommendations of authorities, and internal regulations: We collect and process personal data to comply with applicable laws (e.g., anti-money laundering, tax obligations ), self-regulations, certifications, industry standards, our corporate governance, and for internal as well as external investigations.
If you have given us consent to process your personal data for specific purposes (e.g., when you sign up to receive potential newsletters or to transmit your application data to potential employers), we process your personal data based on and within the scope of this consent, to the extent we have no other legal basis and require one. Consent given may be withdrawn at any time; this does not affect data processing that has already taken place (Art. 6 para. 6 FADP).
4. Cookies/Tracking and Other Technologies in Connection with the Use of Our Website and App
We typically use “cookies” and comparable techniques on our websites and apps that can identify your browser or your device. A cookie is a small file that is sent to your computer or is automatically stored by the web browser used on your computer or mobile device when you visit our website or install the app. When you visit this website again or use our app, we can recognize you in this way even if we do not know who you are.
By using our websites and apps and consenting to receive newsletters and other marketing emails, you agree to the use of these techniques. If you do not wish this, you must adjust your browser or email program accordingly, or uninstall the app if it cannot be adjusted via the settings.
Specific services and technologies used:
• Google Analytics 4: We use Google Analytics 4 on our websites. This is a service of Google Ireland (Ireland), relying on Google LLC (USA) as a processor. It allows us to measure and evaluate website usage (not on a personal basis). Persistent cookies set by the provider are also used. We have configured the service so that visitors’ IP addresses are shortened by Google in Europe before being transferred to the USA and can therefore not be traced back. We have disabled the “Data sharing” and “Signals” settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about visitors’ identities, create personal profiles and link these data with the Google accounts of those individuals. If you have registered with the provider, the provider also knows you. The processing of your personal data by the provider is then carried out under the provider’s responsibility in accordance with its privacy policy. The provider only informs us how our website is used in each case (no information about you personally). Google Analytics 4 does not store the IP addresses of visitors to our website, but derives approximate geographic location data. User and event data are stored for 3 months if no new activity takes place within this period.
• Firebase: Firebase is a development platform for collecting, aggregating and evaluating data about the use and technical performance of our offering. In particular, Firebase captures app performance and app functionality.
• Meta Business Tools / Meta Pixel: For our website, we use Meta Business Tools provided by Meta Platforms Ireland Limited (Ireland). Processing takes place exclusively on the basis of your consent. Meta Pixel is a code that loads functions enabling Meta to track user actions on our website. The Meta Pixel can store your actions on our website in one or more cookies. The pixel collects information such as your IP address and user ID and compares it with the data in your Facebook account. Depending on interaction and user behavior, Meta uses different cookies.
• LinkedIn Insight Tag: We use LinkedIn’s Insight Tag on our website. The service provider is LinkedIn Corporation (USA) or, for the EEA and Switzerland, LinkedIn Ireland Unlimited (Ireland). By embedding this tracking tool, data can be sent to LinkedIn, stored and processed there. This helps us tailor our advertising to your interests and needs.
• Sentry: We use Sentry to collect information about the use of our offering. We use this information to improve our offering and to fix technical problems. The provider is Functional Software, Inc. (USA).
• CleverPush: For our app, we use CleverPush, a push notification service. The provider is CleverPush GmbH (Germany). To subscribe to push notifications, you must confirm your device’s query to receive notifications. This process is documented and stored by CleverPush, including the time of registration and the push token/device ID. The legal basis for this processing is your consent. CleverPush also performs statistical evaluations of push notifications, for which our legitimate interest forms the legal basis.
• If social media plugins are used: We also use plugins from social networks such as Facebook, Twitter, YouTube, Pinterest or Instagram on our websites. This is apparent to you (typically through corresponding icons). We have configured these elements so that they are deactivated by default. If you activate them (by clicking), the operators of the respective social networks can register that you are on our website and where, and they can use this information for their own purposes. The processing of your personal data is then the responsibility of that operator in accordance with its privacy policy. We do not receive any information about you from the operator.
5. Data Disclosure and Data Transfer Abroad
We only disclose data if you have given your consent, if we are contractually or legally obliged to do so, or if this is necessary to enforce our rights. If we engage third parties, we take appropriate contractual measures and implement suitable technical and organizational safeguards to ensure that your data remain protected.
In the course of our business activities and for the purposes mentioned, we also disclose data to third parties, either because they process them on our behalf or because they need them for their own purposes. These third parties include in particular:
• Our service providers (JOBN GmbH, Graubünden Job Match, and external providers such as banks, insurers), including processors (e.g., IT providers, hosting services, email services, payment service providers, push notification services, etc.);
• Lawyers and authorities;
• Subcontractors, where services are (or may be) not provided by us;
• Potential employers and candidates for the purpose of initiating employment contracts, if you consent;
• Competitors, industry organizations, associations, organizations and other bodies;
• Other affiliated companies of Graubünden Job Match.
Some of these recipients are located in Switzerland; others may be abroad. In particular, you must expect your data to be transferred to other European countries and possibly to the USA, where the service providers we use are located (e.g., Google LLC for Google Analytics and Firebase, Functional Software, Inc. for Sentry, LinkedIn Corporation for LinkedIn Insight Tag, Meta Platforms Ireland Limited for Meta Pixel). If a recipient is located in a country without an adequate level of data protection (e.g., the USA, which has not been explicitly recognized as adequate by the Swiss Federal Council), we contractually oblige the recipient to comply with applicable data protection. For this purpose, we generally use the revised Standard Contractual Clauses of the European Commission, which are recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC) as an appropriate safeguard under Art. 16 para. 2 FADP, unless the recipient is already subject to a legally recognized data protection framework and we cannot rely on an exception. An exception may apply in particular in foreign legal proceedings, but also in cases of overriding public interests, where contract performance requires such disclosure, where you have consented, or where the data were generally made publicly accessible by you and you have not objected to their processing (Art. 17 FADP).
6. Retention Period for Personal Data
We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations or otherwise for the purposes pursued with the processing; for example, for the duration of the entire business relationship (from initiation and execution to termination of a contract) and beyond in accordance with statutory retention and documentation obligations. It is possible that personal data will be retained for the period during which claims can be asserted against our company and as long as we are otherwise legally obliged to do so or legitimate business interests require this (e.g., for evidence and documentation purposes). As soon as your personal data are no longer required for the above purposes, they will, in principle and wherever possible, be deleted or anonymized. Shorter retention periods of twelve months or less generally apply to operational data (e.g., system logs).
7. Data Security
We take appropriate security measures to preserve the confidentiality, integrity and availability of your personal data, to protect them against unauthorized or unlawful processing, and to counter the risks of loss, accidental alteration, unwanted disclosure, or unauthorized access.
8. Obligation to Provide Personal Data
Within the context of our business relationship, you must provide the personal data necessary for initiating and conducting the business relationship and fulfilling the associated contractual obligations (you are generally not legally obliged to provide us with data). Without these data, we will generally not be able to conclude a contract with you (or the entity or person you represent) or to process it. The website also cannot be used if certain information necessary to ensure data traffic (such as the IP address) is not disclosed. Specifically, contact details are necessary for voluntarily creating an account. Information in a user profile (where fields are mandatory) is required for initiating and fulfilling a contract, and payment information is necessary to perform payments on our website/app.
9. Your Rights
Within the scope of the data protection law applicable to you and as provided therein (in particular under the Swiss FADP), you have the right to:
• Information/access (Art. 25 FADP) regarding the processing of your personal data;
• Rectification (Art. 32 FADP): to have inaccurate personal data corrected;
• Erasure or destruction (Art. 32 FADP) of personal data;
• Objection (Art. 37 FADP) to data processing, in particular to processing for direct marketing purposes, profiling carried out for direct marketing, and other legitimate interests in processing;
• Data portability (Art. 28 FADP): to obtain certain personal data in a commonly used electronic format or to have them transferred to another controller;
• Withdrawal of consent (Art. 6 para. 6 FADP).
Please note that prerequisites, exceptions or limitations apply to these rights (e.g., to protect third parties or trade secrets or due to a possible professional duty of confidentiality).
If you wish to exercise your rights, please contact us; our contact details can be found in Section 1.
Every data subject also has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC) (edoeb.admin.ch).
10. Final Provisions
This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this page: graubuenden-job-match/dataprotection is the current version. If the privacy policy forms part of an agreement with you, we will inform you of any updates by email or in another appropriate manner.
