Data Protection and Privacy Notice

1. Who we are and what this notice covers

ITech Consult AG, Zugerstrasse 76b, 6340 Baar, Switzerland, company identification number CHE-108.439.587 (“we”, “us” or “our”), provides consultancy, talent acquisition and related services.

ITech Consult AG is responsible for the processing of personal data described in this Privacy Notice and acts as the data controller.

Authorised group companies and service providers may support us in providing these services. Where they process personal data on our behalf, they act under our instructions and are subject to appropriate contractual confidentiality, security and data protection obligations.

This notice primarily addresses processing subject to the Swiss Federal Act on Data Protection (FADP/DSG). Where the EU General Data Protection Regulation (GDPR) or other mandatory data protection laws also apply, we comply with those requirements.

This Data Protection and Privacy Notice explains how we collect, use, disclose, store and otherwise process personal data when you visit our website, apply for or are considered for a role, register your professional profile, communicate with us, use our services, or interact with us as a client, supplier or other business contact.

This notice covers processing for which ITech Consult AG is responsible, including processing carried out on its behalf by authorised group companies and service providers. Additional privacy notices may apply to particular vacancies, services, events or website features.

Contact details for privacy questions and requests: dpo@itcag.com or via Phone +41 (0) 41 760 77 01

This policy is intended to cover relevant processing connected with our operations in Switzerland and group companies. The applicable rules depend on the particular entity, activity, location and person concerned. Additional policies may apply to specific vacancies, clients, events, cookies or services.

2. Personal data we may process

The categories of data depend on how you interact with us and the role or service involved. They may include:

• Identity and contact details, such as name, email address, telephone number, location and preferred contact method.
• Professional and application information, such as CV/resume, employment history, qualifications, skills, languages, certifications, portfolio, references, availability, work preferences and salary expectations.
• Recruitment communications, including emails, messages, interview arrangements, recruiter notes, call transcripts, feedback and records of candidate consent or preferences where applicable.
• Information obtained from clients or professional sources, such as role requirements, interview feedback, reference information or publicly available professional profiles.
• Eligibility information, such as work authorisation or right-to-work information, where relevant and lawfully collected.
• Business contact information for clients, suppliers, consultants and other professional contacts.
• Website and technical information, such as IP address, device and browser details, logs, cookie identifiers, pages visited and preferences, subject to applicable cookie rules.
• AI-assisted outputs, where relevant, such as extracted skills, summaries, job-match indicators or recommendations generated from information provided to or collected by a recruitment process.
• Sensitive or special-category data, or criminal-record information, only where genuinely necessary and permitted by applicable law, with any additional conditions and safeguards required by law.

Please do not provide sensitive personal data unless we specifically request it for a lawful and relevant purpose or it is necessary for the recruitment process. We do not ask candidates to provide information unrelated to the role.

3. Where personal data comes from

We may collect personal data directly from you, including when you submit a CV, apply for a vacancy, create a profile, contact us, participate in an interview or update your preferences.

We may use an automated transcription tool to create a written record of recruitment-related telephone or video interviews. Before automated transcription begins, we explain its purpose and ask for your agreement. You may decline automated transcription, in which case the recruiter will take written notes instead.

The transcription tool operates on our server. We do not retain an audio or video recording of the interview. The resulting transcript is stored as part of the recruitment record and is subject to the retention periods described in Section 8.

Where appropriate and lawful, we may also obtain information from clients, referees, recruitment partners, publicly available professional profiles, job boards, professional networking sites, company websites, professional directories and other sources relevant to recruitment. We may receive information from service providers that support our recruitment activities.

When we obtain personal data from a source other than you, we will provide the information required by applicable law, including the categories of data and source, subject to any applicable legal exception.

4. Why we use personal data and our legal bases

We use personal data only for defined purposes and where a lawful basis applies. Depending on the circumstances, our purposes and legal bases may include:

• Recruitment and candidate matching: receiving and reviewing applications, identifying potentially suitable roles, assessing role-related experience, arranging interviews and presenting candidates to clients. The legal basis may be steps requested before a contract, legitimate interests, consent or another basis permitted by the law that applies to the activity.
• Candidate relationship management: maintaining a professional profile, recording role preferences, communicating about relevant opportunities and avoiding duplicate or inappropriate contact. The legal basis will depend on the purpose, expectations, local law and any consent required.
• Client and supplier services: managing business relationships, delivering recruitment services, communicating about assignments, invoicing and meeting contractual obligations.
• Legal and regulatory compliance: meeting applicable employment, tax, accounting, licensing, court-order or other legal requirements.
• Website operation and security: maintaining website functionality, preventing abuse, protecting systems and investigating technical incidents, based on applicable legal obligations or legitimate interests where appropriate.
• Service improvement and analytics: understanding how our services are used and improving them, subject to applicable law and any consent requirements.
• AI-supported activities: assisting with permitted recruitment tasks or administration as described in the AI section below, subject to the relevant legal basis and safeguards.

Where we rely on legitimate interests, those interests may include providing recruitment services, managing candidate and client relationships, improving our services and protecting our systems. We consider the impact on individuals and their rights before relying on this basis. Where consent is the legal basis, you may withdraw it at any time; withdrawal does not affect processing lawfully carried out before withdrawal.

If we need personal data to take steps at your request or meet a legal obligation and you do not provide it, we may be unable to consider you for a particular role or provide the requested service. We will explain this where relevant.

5. Artificial Intelligence (AI), machine learning and automated tools

We limit the personal data used by AI tools to information relevant and proportionate to the recruitment or administrative task. We do not use AI to infer sensitive personal characteristics unrelated to a candidate’s suitability for the role.

5.1 How AI may support recruitment

Depending on the activity and tools actually used, AI-enabled technologies may assist with:

• searching permitted sources for professional profiles that may match a role;
• extracting or organising skills, experience, qualifications and other role-related information from CVs or professional profiles;
• summarising candidate information for recruiter review;
• comparing stated job requirements with a candidate’s stated skills and experience;
• supporting the organisation, prioritisation or presentation of potential matches;
• drafting or translating recruitment communications, job descriptions and administrative content; and
• supporting internal service quality, workflow efficiency or analysis.

This list describes possible uses, not a representation that every use is currently deployed. We will tailor this notice or provide additional information where needed to reflect the processing that actually takes place. We also ensure our recruiters manually verify and quality-check all data before processing it for the next stage.

5.2 Data used by AI tools

Where relevant, AI tools may process information such as CV content, work history, skills, qualifications, job preferences, vacancy requirements, recruiter notes or communications. We only use information that is relevant and proportionate to the task. We do not use AI to infer sensitive characteristics or to assess a person using unrelated personal information.

We use approved AI services under contractual arrangements governing confidentiality, security, retention and permitted use. We do not permit providers to use candidate personal data to train their general-purpose AI models.

We also maintain an AI and LLM governance framework to verify that only approved AI services are used; during this process, we use a redaction layer, fail-closed behaviour, logging, and prevention of personal or confidential information being transmitted externally.

5.3 Human review and recruitment decisions

AI-generated information may be incomplete, inaccurate or misleading. Where AI outputs support our recruitment work, our authorised recruitment personnel always assess relevant outputs in context and may correct, disregard, or supplement them through our rigorous quality check process. AI-generated summaries or match indicators do not replace checking the underlying information and applying relevant job criteria.

AI tools support our recruiters and quality-control staff. Relevant AI outputs are reviewed by authorised staff before they are used to make recruitment decisions. Candidates are not rejected solely on the basis of an automated score or recommendation.

You may request correction of inaccurate information and ask for human review of an assessment concerning you by contacting dpo@itcag.com.

5.4 Fairness, accuracy and limitations

AI tools can reflect errors or bias in source data, model design, or how outputs are used. We always consider AI outputs alongside relevant evidence and job-related criteria. We do not intend to use AI to discriminate unlawfully or to make decisions based on protected characteristics where this is prohibited. We will address relevant requests and concerns in accordance with applicable law.

We do not use AI to infer emotions, personality or sensitive personal characteristics. AI may help identify inconsistencies in professional information for human verification. An inconsistency flag is not treated as proof that information is false, and candidates may clarify or correct the information concerned.

AI tools used in recruitment may be subject to additional requirements under the EU AI Act. Certain systems intended to source, filter, rank, evaluate or select candidates may be classified as high-risk depending on their intended purpose and use. We assess the applicability of the rules to relevant systems and will meet obligations applicable to our role and activities.

5.5 AI providers and third-party tools

AI features may be supplied by recruitment platforms or other technology providers acting as processors, independent controllers or in another legally relevant role. Where applicable, we assess the provider’s role, permitted use of data, security, retention, subprocessors, hosting locations and international transfers, and put required contractual and legal safeguards in place.

The use of an external AI provider does not remove our responsibilities as a controller where we determine the purposes and means of processing. More information about relevant recipients or categories of recipients and international transfers is provided in the sections below or in supplementary notices.

6. Who may receive personal data

We may disclose personal data, where necessary and lawful, to:

• Prospective employers or clients, after you have approved the submission of your identifiable profile for the relevant opportunity.
• our relevant group companies and authorised colleagues involved in providing recruitment services;
• recruitment platforms, applicant-tracking systems, hosting providers, communication tools, AI providers and other service providers acting on our instructions where applicable;
• reference providers, qualification-verification providers or other screening providers, where relevant and lawful
• We obtain your permission before contacting current or former employers for references.
• professional advisers, auditors, insurers and financial or legal service providers where necessary;
• courts, regulators, public authorities or law-enforcement bodies where disclosure is required or permitted by law; and
• a buyer, investor or successor in connection with a genuine business reorganisation or transaction, subject to appropriate safeguards and applicable law.

We do not sell candidate personal data in exchange for money. If a particular jurisdiction defines “sale”, “sharing” or targeted advertising more broadly, we will apply any required disclosures and choices under that law.

7. Personal Data and remote access

ITech Consult AG company ensures that all its data always resides in Switzerland and ITech Consult AG (“data controller”) ensures that its other group of companies adhere to Data Privacy policies and that data procession agreement safeguards are in place if and when data are process by group companies.

Authorised personnel of our group companies in Germany, Ireland and India may access personal data where necessary to support recruitment, quality control or technical administration. Access is restricted according to their responsibilities and is subject to confidentiality, security and data protection obligations.

Where personal data is disclosed to a country without a recognized adequate level of protection, we implement the safeguards and access logging required by applicable law, including recognized standard contractual clauses where appropriate and any necessary supplementary measures.

All data at all times is available in Switzerland office and is located within its own Servers located at its office in Switzerland office, Other offices shall access the data only through highly secured VPN with Multifactor Authentication enabled, We have an Industry standard of recruiting products which ensures that employees of the any group company can work on the candidate CV’s and they also use secured calls directly from the application, so recruiters reach candidates only through a secured phone channel, so during the entire recruitment process, company shall ensure that we oblige by all Data Privacy rules. Where Swiss FADP rules apply to an international transfer, we use a legally recognised transfer mechanism or other permitted basis where required. Depending on the transfer, this may include an applicable adequacy decision, recognised standard contractual clauses, binding corporate rules or another mechanism permitted by law. Additional assessments or safeguards may be required in particular circumstances.

Information about relevant destinations, transfer mechanisms and how to obtain a copy of relevant safeguards will be provided where required. The countries involved and the safeguards used depend on the actual data flow and service provider; they should not be inferred solely from the location of our offices.

8. How long we keep personal data

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal obligations and the establishment, exercise or defence of legal claims.

We review candidate profiles regularly and, at the latest, three years after the last substantive recruitment-related interaction with you. At that point, we assess whether continued retention remains necessary and justified. Profiles that are no longer needed are deleted or irreversibly anonymised.

Interview transcripts are retained only for as long as needed for the recruitment and quality-control purposes explained to you. They are deleted when those purposes have been fulfilled, unless continued retention is necessary to meet a legal obligation or establish, exercise or defend legal claims.

Certain records, including personal data associate with contracts or business cases, accounting books, accounting vouchers, annual reports and audit reports, must generally be retained for ten years from the end of the relevant financial year. These requirements do not automatically apply to candidate profiles or interview transcripts.

We maintain this data for the specified period as necessary for the purposes outlined in the Data Protection Policy. This takes into account the nature of the data, the recruitment relationship, applicable limitation periods, legal obligations, client requirements, and the need to resolve any potential disputes.

We always ensure the above-mentioned retention periods for active applications, candidate databases, successful placements, client records, contracts, financial records, communications, website logs, and AI-generated outputs. Where a specific period cannot reasonably be stated, we use criteria such as the end of a recruitment process, the last meaningful contact, the expiry of a candidate’s stated preferences, legal retention requirements or the resolution of a dispute.

When data is no longer required, we delete it, anonymise it, or otherwise handle it in accordance with applicable law. We may delete backups and technical logs on defined cycles, subject to legitimate security and legal needs.

9. Cookies and similar technologies

Our website may use cookies and similar technologies to support its operation, remember your preferences and, where applicable, analyse website usage.

Where optional cookies are used, we provide information about their purposes, providers and duration through our cookie settings or a separate cookie notice. Where consent is required, these cookies are activated only after you agree. You can subsequently change your preferences or withdraw your consent through the website’s cookie settings.

You can also block or delete cookies through your browser settings. Blocking technically necessary cookies may affect the functionality of the website..

10. How we protect personal data

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures are selected according to the nature of the data, the risks and the applicable legal and contractual requirements.

No website, communication channel or storage system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess it and notify the relevant supervisory authority and affected individuals where required by applicable law.

11. Your privacy rights

Depending on the applicable law and circumstances, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of data where the legal conditions are met;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests or to direct marketing where applicable;
• receive certain data in a portable format where the legal conditions are met;
• withdraw consent where processing is based on consent;
• receive information about relevant profiling or automated decisions and exercise applicable rights to human review or challenge; and
• lodge a complaint with a competent data protection supervisory authority.

These rights are not absolute and may be subject to legal conditions or exceptions. We may need to verify your identity before responding. To exercise a right, contact dpo@itcag.com and describe your request. We will respond within the period required by applicable law.

If you are in the European Economic Area, you may complain to your local data protection supervisory authority or the authority competent under the applicable rules. In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC/EDÖB). Contact details are available on the relevant authority’s official website and in Section 15 Contact us of this document.

12. Children and individuals under 18

Our recruitment services are generally intended for adults and professional candidates. We do not knowingly seek personal data from children in connection with recruitment unless a lawful and necessary reason exists. If you believe a child has provided personal data to us inappropriately, contact us using the details below.

13. Links to other websites

Our website may contain links to websites or services operated by third parties. Their privacy practices are governed by their own notices. We are not responsible for the content or privacy practices of third-party sites.

14. Changes to this Privacy Notice

We may update this notice to reflect changes in our services, technology, legal requirements or data processing practices. The latest version will be published on this page with the updated date. Where applicable law requires additional notice or consent for a material change, we will take the required steps.

15. Transfers of Personal Data

15.1. Sharing Candidate Information with Clients and Referees

We’re excited to help candidates find employment and contract opportunities that align with their unique qualifications. Our process involves evaluating each candidate to support tailored recruitment activities.

When we identify a good match, we share relevant candidate information—such as CVs, qualifications, and work history—with our clients, ensuring transparency about how their data will be used. We always seek candidates’ authorization before sharing identifiable information, as required by law.

To verify provided information, we may contact professional referees for references, informing candidates beforehand and addressing any necessary permissions. We are committed to gathering only what is essential for recruitment.

Our disclosures and reference checks focus on what’s necessary for each recruitment need and comply with all relevant data protection laws. We believe in a respectful approach to recruitment that benefits everyone involved!

15.2. Legal Framework and Processing Purposes

We process personal data in accordance with the data protection laws applicable to the relevant activity and jurisdiction, including the Swiss Federal Act on Data Protection and, where applicable, the GDPR.

For processing subject to the GDPR, we identify and rely on an appropriate legal basis for each processing purpose. Depending on the specific activity, this may include taking steps at the individual’s request before entering into a contract, fulfilling a legal obligation, pursuing legitimate interests where permitted, or obtaining consent where consent is the appropriate basis.

For processing subject to Swiss law, we comply with the applicable principles and requirements governing lawful and proportionate processing, transparency, good faith, data security and the protection of individuals’ personality rights. We do not assume that the GDPR’s legal-basis framework applies identically to all processing under Swiss law.

15.3. Your Data Protection Rights and Requests

Subject to the applicable law and any lawful limitations, you may request access to personal data concerning you, request correction of inaccurate information, request deletion where applicable, object to certain processing, and exercise other rights available under the relevant data protection legislation.

For requests governed by the Swiss FADP, access to personal data is generally provided free of charge and within 30 days, subject to applicable legal exceptions and permitted extensions or limitations.

For requests governed by the GDPR, we respond within the applicable statutory time limits, generally within one month, subject to the conditions for any lawful extension or other applicable exception.

To exercise your rights, please get in touch with us using the privacy contact details provided in this Policy. We may need to verify your identity before responding.

Where appropriate, we will take reasonable steps to ensure that corrections or deletions are reflected not only in the original candidate record but also in relevant extracted keywords, recruiter notes, candidate profiles and AI-generated information under our control, subject to applicable retention obligations, legal restrictions and technical limitations.

16. Contact us

For questions about this notice or to exercise your privacy rights, contact:

ITech Consult AG
Data Protection Officer
Zugerstrasse 76B
CH-6340 Baar

Privacy contact: dpo@itcag.com or via phone +41 (0) 41 760 77 01
Website: www.itcag.com

Office of the Federal Data Protection and Information Commissioner FDPIC
Feldeggweg 1
CH-3003 Bern, Switzerland
Telefon: +41 (0)58 462 43 95 (Hotline available Monday to Friday, 10:00AM – 12:00PM)
Telefax: +41 (0)58 465 99 96

Data Protection Policy | Version 1.0 | 1 July 2026