Privacy Policy «Graubünden Job Match» – Version dated 22 November 2025
Note: This English translation was created with the assistance of artificial intelligence. In case of discrepancies or interpretation issues, the original German version of this Privacy Policy shall prevail.
In this privacy policy, we explain how we, Graubünden Job Match, collect and otherwise process personal data. Personal data refers to all information relating to an identified or identifiable person.
If you disclose or provide us with data relating to other persons (e.g. family members, representatives, counterparties, other associated persons or work colleagues), we assume that you are authorised to do so and that such data is correct.
This privacy policy is designed to comply with the requirements of the Swiss Data Protection Act (“DSG”). Although we are guided by the principles of the EU General Data Protection Regulation (“GDPR”), our processes are primarily based on Swiss law.
1. Controller / Data Protection Officer / Representative
The party responsible for the data processing described here is Graubünden Job Match c/o GastroGraubünden, Loëstrasse 161, 7000 Chur. Unless otherwise specified in an individual case, you may address data protection concerns to the following contact address: info@graubuenden.jobs.
Our representative in the EEA pursuant to Art. 27 GDPR is: JOBN GmbH, FN 475010 w, Sillgasse 8a, 6020 Innsbruck.
2. Collection and Processing of Personal Data / Purposes of Processing and Legal Bases
We primarily process personal data that we receive from our customers and other business partners, and the persons involved with them, within the scope of our business relationship, or that we collect from users when operating our websites, app and other applications. If you use our services, use our websites https://naturmetropole.ch/graubuenden-job-match, https://graubuenden.jobs and/or our app «Graubuenden Job Match», or otherwise interact with us, we collect and process various categories of your personal data.
Where permitted, we also take certain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, press, Internet) or receive such data from other companies belonging to the associations of the Tourismusallianz Graubünden: GastroGraubünden, HotellerieSuisse Graubünden and Bergbahnen Graubünden.
In addition to the data you provide to us directly (e.g. when creating an account or entering a user profile), the categories of personal data we receive from third parties about you include, in particular, information from public registers, information we learn in connection with administrative and court proceedings, information relating to your professional functions and activities, creditworthiness information (to the extent that we conduct business with you personally), information about you provided by persons in your environment (family, advisors, legal representatives etc.), information from banks, insurers, distribution and other contractual partners relating to your use or receipt of services, information from media and the Internet about your person (to the extent indicated in the specific case, e.g. in connection with an application, press review marketing/sales etc.), your addresses and, if applicable, interests and other sociodemographic data (for marketing), data in connection with use of the website and app (e.g. IP address, MAC address of the smartphone or computer, information about your device and settings, cookies, date and time of the visit, pages and content accessed, functions used, referring website, location information).
Specific categories of personal data that we process include:
- contact data (name, e-mail address, telephone number);
- information contained in a user profile (“About me”, sectors, availability, training, work location, benefits, photo if applicable);
- payment information;
- particularly sensitive personal data (e.g. health data), which we process only if necessary to fulfil our service (e.g. in connection with special requirements for a workplace) and if explicit consent is given or a legal basis permits such processing.
3. Purposes of Data Processing and Legal Bases
We use the personal data we collect primarily to enter into and perform our contracts with our customers and business partners, in particular within the framework of job placement and the provision of a job platform with our customers, and for the procurement of products and services from our suppliers and subcontractors, as well as to comply with our legal obligations in Switzerland and abroad. If you work for such a customer or business partner, your personal data may also be affected in that capacity.
The processing of personal data is carried out lawfully, in good faith and proportionately for a specific purpose that is recognisable to the data subject. Personal data is destroyed or anonymised as soon as it is no longer required for the purpose of processing.
In addition, we process personal data relating to you and other persons, insofar as permitted and where deemed appropriate, for the following purposes, for which we (and sometimes third parties) have a legitimate interest in accordance with the purpose (Art. 31 para. 2 DSG). In principle, we may collect and otherwise process such data in particular for the following purposes:
- Communication: We process personal data so that we can communicate with you and with third parties by e-mail, telephone, letter or otherwise (e.g. to respond to enquiries). For this purpose, we process, in particular, the contents of communication, your contact details and the communication metadata, as well as image and audio recordings of (video) calls. Furthermore, for job placement it is necessary that we also communicate with potential employers and forward the necessary personal data.
- Initiation and conclusion of contracts: With a view to concluding a contract with you or your principal or employer, we may, in particular, collect and process your name, contact details, powers of attorney, consent declarations, information about third parties, contract contents, as well as all other data that you provide to us or that we obtain from public sources or third parties.
- Administration and performance of contracts: We collect and process personal data so that we can fulfil our contractual obligations towards our customers and other contractual partners and provide and enforce contractual services.
- Advertising and marketing (including the organisation of events): We process your personal data insofar as you have not objected to its use (if we send you advertising as an existing customer, you may object at any time; we will then add you to a blocking list for further advertising mailings);
- Operation of our website and other digital offerings: To operate our website securely and stably, we collect technical data such as IP address, information on the operating system and settings of your device, the region, the time and type of use. We also use cookies and similar technologies.
- Security purposes and access controls: We collect and process personal data to ensure and continuously improve the appropriate security of our IT and other infrastructure (e.g. buildings). This includes monitoring and controlling electronic access to our IT systems and physical access to our premises (including by means of procedures that involve the processing of biometric data), analyses and tests of our IT infrastructures.
- Compliance with laws, directives and recommendations of authorities and internal regulations («compliance»): We collect and process personal data to comply with applicable laws (e.g. anti-money laundering, tax obligations), self-regulatory standards, certifications, industry standards, our corporate governance, as well as for internal and external investigations.
- Where you have provided us with explicit consent to process your personal data for specific purposes (e.g. when signing up to receive potential newsletters or for transmitting your application data to potential employers), we process your personal data on the basis of that consent, insofar as we do not have another legal basis and require one. Consent can be withdrawn at any time, although this has no effect on data processing undertaken prior to withdrawal (Art. 6 para. 6 DSG).
4. Cookies/Tracking and Other Technologies in Connection with the Use of Our Website and App
We typically use «cookies» and comparable technologies on our websites and apps to identify your browser or device. A cookie is a small file sent to your computer or automatically stored by the web browser you use on your computer or mobile device when you visit our website or install our app. When you revisit this website or use our app, we can recognise you in this way, even if we do not know who you are.
By using our websites, apps and consenting to receive newsletters and other marketing emails, you agree to the use of these technologies. If you do not wish this, you must adjust your browser or e-mail program settings accordingly, or uninstall the app if these settings cannot be adjusted otherwise.
Specific services and technologies used:
- Google Analytics 4: We use Google Analytics 4 on our websites. This is a service of Google Ireland (located in Ireland), which relies on Google LLC (located in the USA) as processor. This allows us to measure and evaluate (non-personalised) website use. Permanent cookies are also used for this purpose, which are set by the service provider. We have configured the service so that IP addresses of visitors are truncated by Google in Europe before being transferred to the USA and can therefore no longer be traced. We have disabled the “data sharing” and “signals” settings. Although we may assume that the information shared with Google is not personal data for Google, it is possible that Google may draw conclusions about the identity of visitors from these data for its own purposes, create personal profiles and link these to the Google accounts of these persons. If you have registered with the service provider, the provider knows you. The processing of your personal data by the provider is therefore carried out under the provider’s responsibility in accordance with its privacy terms. We only receive information on how our website is used (no information about you personally). Google Analytics 4 does not store IP addresses of website visitors, but derives coarse geographic location data. User and event data are stored for 3 months if no new activity takes place within this period.
- Firebase: Firebase is a development platform used to collect, aggregate and evaluate data about the use and technical performance of our offering. In particular, Firebase is used to record app performance and app functionality.
- Meta Business Tools / Meta Pixel / Facebook SDK: We use Meta Business Tools for our website, which are operated and provided by Meta Platforms Ireland Limited (Ireland). Processing is carried out solely on the basis of your explicit consent.
o Meta Pixel is a code that loads functions enabling Meta to track user actions on our website. Meta Pixel can store user actions on our website in one or more cookies. The pixel collects information such as your IP address and user ID and compares this with the data in your Facebook account. Depending on interaction and user behaviour, Meta uses different cookies.
o For our app, we additionally use Facebook SDK. Processing of your data is carried out to measure the effectiveness of our advertising campaigns, optimise our marketing measures, assign app installations and user actions to advertisements and create anonymised statistics. As Meta is a US-based company, the data collected may be transferred to the USA and other countries outside the EU/EEA. The transfer is based on the EU Standard Contractual Clauses, which the Swiss FDPIC has recognised as an adequate safeguard under Art. 16 para. 2 DSG, as well as the EU-US Data Privacy Framework. Further information on Facebook SDK can be found in Meta’s privacy policy: [https://www.facebook.com/privacy/policy/](https://www.facebook.com/privacy/policy/).
Facebook SDK collects and transfers the following data to Meta:
-
- device information (device type, operating system, device ID);
- information about app installation and app openings;
- advertising ID of your device (if not deactivated);
- IP address, timestamp of installation and use.
You may object to the processing of your data for advertising purposes as follows:
-
- iOS devices: Settings > Privacy & Security > Tracking > deactivate “Allow apps to request to track”.
- Android devices: Settings > Google > Ads > activate “Opt out of personalised ads”.
- Uninstall the app.
- LinkedIn Insight Tag: We use the LinkedIn Insight Tag on our website. Service provider is LinkedIn Corporation (USA) and for the EEA and Switzerland LinkedIn Ireland Unlimited (Ireland). Embedding this tracking tool allows data to be sent to LinkedIn, stored and processed there. This feature helps us tailor our advertising offering more effectively to your interests and needs.
- Sentry: We use Sentry to collect information about the use of our offering. We use this information to improve our offering and resolve technical problems. Service provider is Functional Software, Inc. (USA).
- CleverPush: For our app, we use CleverPush, a push notification service. Provider is CleverPush GmbH (Germany). To register for push notifications, you must confirm your device’s prompt to receive notifications. This process is documented and stored by CleverPush, including registration time and push token/device ID. The legal basis for this processing is your consent. In addition, CleverPush performs statistical evaluations of push notifications, whose legal basis is our legitimate interest.
- If social media plug-ins are used: On our websites we also use so-called plug-ins of social networks such as Facebook, Twitter, YouTube, Pinterest or Instagram. This is evident to you (typically via corresponding symbols). We have configured these elements so that they are deactivated by default. If you activate them (by clicking), the operators of the respective social networks may register that you are on our website and where, and can use this information for their own purposes. The processing of your personal data then takes place under the responsibility of this operator according to its privacy terms. We do not receive any information about you from them.
5. Data Disclosure and Data Transfer Abroad
Data is disclosed by us only if you have given your consent, if we are contractually or legally obliged to do so, or if it is necessary to enforce our rights. Where we engage third parties, we of course implement appropriate contractual arrangements and take suitable technical and organisational measures to ensure that your data remains protected.
We also disclose data to third parties within the scope of our business activities and for the purposes mentioned, either because they process it for us or because they must use it for their own purposes. These third parties include in particular:
- our service providers (JOBN GmbH, Graubünden Job Match, as well as external providers such as banks, insurers), including processors (e.g. IT providers, hosting services, email services, payment service providers, push notification services etc.);
- lawyers and authorities;
- subcontractors, insofar as services are not (or cannot be) provided by us;
- potential employers and candidates for the purpose of initiating employment contracts, provided you agree;
- competitors, industry organisations, associations, organisations and other bodies;
- other affiliated companies of Graubünden Job Match.
These recipients are partly located in Switzerland, but may also be abroad. In particular, you must anticipate your data being transferred to other European countries and possibly to the USA, where the service providers we use are located (e.g. Google LLC for Google Analytics and Firebase, Functional Software, Inc. for Sentry, LinkedIn Corporation for LinkedIn Insight Tag, Meta Platforms Ireland Limited for Meta Pixel). If a recipient is located in a country without an adequate level of data protection (e.g. the USA, which has not been explicitly recognised as adequate by the Federal Council), we contractually require the recipient to comply with applicable data protection rules. For this purpose, we generally use the revised Standard Contractual Clauses of the European Commission, which the Swiss FDPIC has recognised as an adequate safeguard under Art. 16 para. 2 DSG, insofar as the recipient is not already subject to a legally recognised data protection framework and we cannot rely on an exception. An exception may apply in particular in the case of foreign legal proceedings, but also in cases of overriding public interest or where contractual performance requires such disclosure, where you have consented, or where the data is generally accessible and you have not objected to its processing (Art. 17 DSG).
6. Duration of retention of personal data
We process and retain your personal data for as long as necessary to fulfil our contractual and legal obligations or for the purposes of processing, i.e. for the duration of the entire business relationship (from initiation, through performance, to termination of a contract) and beyond, in accordance with statutory retention and documentation obligations. It is possible that personal data may be retained for the period during which claims may be asserted against our company and insofar as we are otherwise legally obliged or legitimate business interests require this (e.g. for evidentiary and documentation purposes). As soon as your personal data is no longer required for the above purposes, it is generally deleted or anonymised where possible. Shorter retention periods of twelve months or less generally apply to operational data (e.g. system logs).
7. Data Security
We take appropriate security measures to preserve the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and against the risks of loss, accidental alteration, unintended disclosure or unauthorised access.
8. Obligation to provide personal data
Within the scope of our business relationship, you must provide the personal data necessary for the establishment and performance of a business relationship and the fulfilment of associated contractual obligations (you usually have no legal obligation to provide data). Without such data, we will generally not be able to enter into or perform a contract with you (or with the entity or person you represent). The website cannot be used if certain data necessary to ensure data traffic (such as the IP address) is not disclosed. Specifically, contact data is required for the voluntary creation of an account. Information in a user profile (where mandatory fields exist) is necessary for contract initiation and performance, and payment information is required to carry out payments on our website/app.
9. Your Rights
Under the applicable data protection law and insofar as provided therein (in particular the Swiss Data Protection Act), you have the right to:
- access (Art. 25 DSG) with respect to the processing of your personal data;
- rectification (Art. 32 DSG): have inaccurate personal data corrected;
- deletion or destruction (Art. 32 DSG) of personal data;
- objection (Art. 37 DSG) to data processing, in particular for direct marketing purposes, profiling for direct advertising and other legitimate interests in processing;
- receive certain personal data (Art. 28 DSG) in a commonly used electronic format or request its transfer to another controller (so-called data portability);
- withdraw consent (Art. 6 para. 6 DSG).
However, please note that these rights may be subject to conditions, exceptions or restrictions (e.g. to protect third parties or business secrets, or due to a possible professional duty of confidentiality).
If you wish to exercise your rights against us, please contact us; our contact details can be found in section 1.
Every data subject also has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC) (edoeb.admin.ch).
10. Final Provisions
This privacy policy is not part of a contract with you. We may amend this privacy policy at any time. The version published on this page: https://naturmetropole.ch/graubuenden-job-match/datenschutz is the current version. If the privacy policy is part of an agreement with you, we will inform you of the update by e-mail or in another appropriate manner.
