Déclaration de protection des données

1. Introduction

This Privacy Policy details how we, the Novelia AG (henceforth Novelia, we or us), obtain and process
personal information. This is not a comprehensive description; in relevant situations, other privacy
policies or general terms and conditions, participation conditions or similar document-specific
facts may apply. Under the term personal data we define all information which pertains to a specific
or specifiable person.
With the usage of our services (e.g. Assessment, Coaching) you agree to our Privacy Policy. When
providing us with the data of other person(s) (e.g. family members, colleagues, etc.), please ensure
that they are aware of this Privacy Policy and only share their Personal information if you have the
right to do so and the information is valid.
This Privacy Policy is designed with the General Data Protection Regulation (GDPR) of the EU, the
Swiss Data Protection Law (Datenschutzgesetz; “DSG”), and the revised Swiss data Protection Law
(revidierte Datenschutzgesetz; “revDSG”) in mind. If and in what ways these laws are applicable,
however, is to be determined on a case-by-case basis.

2. Basis and important terms

Novelia is a consulting firm domiciled in Lausanne with branch offices in Berne, Geneva and Zurich
(Switzerland). Novelia provides its clients with consulting services in the field of human resources,
in particular the evaluation and coaching of candidates.
• “Customer” or “Client” means all our customers and their employees who wish to evaluate
or develop candidates through Novelia and to whom we offer our services.
• “Candidate” means any candidate, applicant, prospect or client employee who is evaluated
or developed by Novelia in connection with our services.
• “Reference” describes any person(s), who provides personal references or employment for
a specific candidate.
• “Provider” describes every legal entity other than Novelia, who provides products or
services for Novelia according to a contract with Novelia.

3. Responsibility / privacy officer / representative

Unless defined differently in individual cases, Novelia is responsible for the processing of the data
described in this document. For concerns regarding data protection and related legalities, please
inform us using the following contact data (if possible, please let us know what data this pertains
to) : Novelia SA, Rue Beau-Séjour 15, 1003 Lausanne, info@novelia.ch

4. Collection and processing of personal data

We primarily obtain, collect and process the personal data that we, in context of our business
connection with our clients, candidates, and their other business partners, obtain from them and
other participating parties, or those that we collect through our website and other applications from
the users.

4.1 Candidate data

4.1.1. Personal data provided from the candidates

In sending us your CV per email, or by communicating with Novelia in connection to our services
through our partners or other means of communications, we obtain personal data.
You are not obligated to provide information to Novelia or to make use of the services offered by us.
Therefore, we see all information that we collect from you as information provided freely and
knowingly.
Regarding the information that we receive (and/or collect) from candidates, they usually are:
• Contact data, such as name, E-Mail addresses, postal address, and telephone number.
• Information from the CV: e.g. your career history, your educational history, your professional
qualifications as well as your language skills and other activities and competences.

Under specific circumstances we also obtain resp. collect the following additional information about
the applicant:
• Identification data: e.g. marital status, photo, birthdate, gender, nationality, corporate
identity, national identification (i.e. social security number or equivalent identification
number of your nation, driving license, personal identification, or passport number).
Lifestyle preferences and personality profile: e.g. engagement and membership in the
community, hobbies, social activities and/or individual preferences, intellectual abilities,
personality, behaviour, leadership competencies and/or character attributes.
• Information regarding health, diversity, and criminal convictions: If applicable, and only in
accordance with the local laws, we can obtain information regarding your health, your
diversity (including ethnic background, religious or similar beliefs, physical or mental health,
including disability-related information) and/or details regarding criminal convictions.
• Financial information: for the reimbursement of costs that occur in connection to the
services rendered (e.g. costs related to travel, accommodation, or catering when
participating in an introductory interview with a customer), we can obtain certain financial
information that are necessary for the documentation of the costs and the reimbursement
to you (e.g. bank account number and/or credit card number).
• Other information: e.g. previous military service record, details regarding salary and social
services (in accordance with local law), performance data, details regarding associated
individuals, migration status and all other relevant information, that you want to share with
us. We also save your marketing preferences and our contact history with you.

4.1.2 Information about candidates from third party sources

We can obtain all of the personal data regarding you mentioned above from publicly available
sources or from third parties, for example (i) sources and reference persons can relay personal
information about you; (ii) our customers can provide us with your personal information; (iii) we can
obtain personal information about you from publicly available third-party sources (e.g. LinkedIn,
news articles, press releases).

4.1.3 Information made available to us by the clients

Our customers can, in connection to the usage of our services, provide us with the personal data of
the candidates (e.g. they can provide us with a list of candidates that they want to evaluate in the
context of an assessment). Generally, we process this data in the name of our clients. We use this
information to provide our services to our clients and as our clients request. Under these
circumstances, our clients control what personal information we collect about you and how we use
said information, as the party responsible for the processing. If you have questions regarding data
protection or concerns about the data privacy practices of a client resp. customer or to the
decisions the client resp. customer has made to share your data with us or other third parties, you
should turn to the client resp. customer or check their data privacy guidelines. We are not
responsible for the data privacy or security practices of our clients resp. customers.

4.1.4 Data in connection with the use of our website

We can collect and process data such as e.g. the IP address and/or MAC address of the smartphone
or computer, details regarding your device and settings, cookies, the date and time of your visit,
pages and contents opened, functions utilized, forwarded websites, and location data.

4.2. Client data

Information that customers provide us with: In the context of performing our services we obtain and
use information pertaining to you or at most persons in your organisation. Generally, we only require
your contact data or the data of singular contact persons in your company (such as e.g. name,
phone number, e-mail address and position) to ensure a frictionless procedure or to ensure that the design of our services is as close to reality as possible (e.g. the description of a realistic situation for a conversation simulation). We can also save additional information about you provided to us from someone in your organisation. Further customer data pertains information that we obtain in
briefings from the clients themselves, or data that is included in business documents or in strategy
papers or concepts that were made available to us.

4.3. Reference data (data provided by reference persons)

Information, that were provided to us from reference persons: when we receive a reference from
you for one of our candidates, we can process your contact data (such as name, e-mail, address
and phone number). We can also process certain professional information (e.g. your professional
title, your profession, your academic- as well as professional qualifications and your professional
history) and your connection to the candidate (e.g. your relationship with the candidate, your
experiences with them and your opinions regarding them). Generally, we ask that the candidates
provide us with most of this information, but we can substantiate this further with information that
we obtain through publicly available sources (such as LinkedIn) or through direct queries to you.

5. Reasons for data processing and legal basis

We can use the personal data, which we collect during the process of performing our services, in
different ways in context of the management consulting for the evaluation and development of
high-level leaders as well as to comply with our legal duties within and outside of the country. If you
are employed by one of our customers of business partners, you and your personal data may of
course also be affected by this.
We may share reports with individually identified persons of the mandated executive search
company linked to a specific mandate. A specific data protection and conservation statement is
applicable.
Furthermore, we process your and the personal data of further persons, if it is allowed and we deem
it beneficial for the following reasons, for which we (and sometimes also third parties) have a
purposeful, justified interest:

5.1. Candidate data

We process candidate data for consulting services for our customers, including the evaluation and
development of candidates according to expert assessments by Novelia using psychometric
evaluations or through requesting information from third parties (e.g. reference persons). We can
use your personal data also for other business purposes, for example for data analysis, the
investigation of usage trends, the creation of anonymised data sets for the purposes of research,
statistics, and analysis, the creation of knowledge documents (e.g. White Papers), the evaluation of
the effectivity of our services, to share marketing and promotional materials, to the adjustment and
improvement of our functions, products and services.
If you provide us with the consent to process your personal information for specific purposes, we
will process your data in context of and based on this consent, if we do not have any other legal
bases to do so and do not require such a basis. Your consent can at any time be revoked, which
however will have no effect on the data processed up until that point.

5.2. Client data

We generally use customer data for the following purposes:
to provide the consulting service for your organisation; to manage our business relationship
between you and your organisation; and/or for our other business purposes, for example data analysis, creation of anonymous data sets for the sake of research, statistics and analyses, the
creation of knowledge contributions (such as White Papers), the assessment of the effectivity of
our services and/or for the expansion, adjustment and improvement of our functions, products and
services.

5.3. Reference data

We use reference data to bring in an additional data point about candidates in the context of
fulfilling our services for our clients.

6. Cookies / tracking and other technologies in connection with the use of our website

We typically use “cookies” and comparable technologies on our websites, with which your browser
or your device can be identified. A cookie is a small piece of data which is sent automatically to
your computer or resp. saved on your device by your web browser when you visit our website. On
re-visiting the website, we can recognize you, even if we do not know who you are. Next to cookies,
which are only used during a session and are deleted at the end of your website visit (“session
cookies”), cookies can also be used to save user settings and other information over a specific time
(“permanent cookies”). You can, however, set up your browser in such a way that it rejects cookies,

only saves them for a single session, or otherwise deletes them prematurely. Most browsers are pre-
configured in such a way that they accept cookies.

Both the technical data collected by us as well as the cookies generally do not contain any personal
data. However, personal data, which we or by us commissioned third parties save regarding you (e.g.
if you have a user account with us or one of these third parties) can relate to the technical data
collected from you resp. the data saved in the cookies, and therefore can be possibly attached to
your person.
We can also partially use social media plug-ins, that is to say small software building blocks, which
creates a connection between your visit to our website and a third party. The social media plug-in
informs the third party that you have visited our website and can then transfer cookies over to the
third party that they placed in your web browser beforehand. Further information regarding how
these third parties use the data gathered from you through their social media plug ins can be
ascertained from their privacy policies.
Furthermore, we use the services of third parties (who may implement cookies of their own) on our
website, especially to improve the functionality or content of our website (e.g. the integration of
maps) or to generate statistics.
On our website and in the digital area we make use of the services of the following service providers
and advertisement partners. Their contact data as well as the information regarding their own data
processing is available in their specific privacy policies.

From a legal perspective in the context of data protection, these third parties are partially
contractors of ours (e.g. Google Analytics) and partially the parties responsible. Further information
regarding this can be obtained from their privacy statements.
With the usage of our website, you agree to the employment of these techniques. If you would like
to avoid this, you must set your browser resp. your e-mail software up in accordance with your
wishes.

7. The sharing of your data and the transfer of the data abroad

We give data to third parties in accordance to point 5 as far as permitted and in our view fitting, be
it for the processing of the data for us in accordance with a contract, or for their own purposes. This
is generally regarding the following parties:
• Service providers (e.g. banks or insurance companies), including order processors (such as
an IT-provider);
• Merchants, suppliers, subcontractors and other business partners;
• Customers;

These recipients are partially domestic but can be in rare cases in any location on the planet. You
must, in particular, expect the transmittance of your data to other countries in Europe and the USA,
where the by us employed services providers are located (such as Microsoft).
If a recipient finds themselves in a country without a fitting lawfully mandated data protection
policy, we contractually require the recipient to keep the applicable data protection rules (for this,
we use the revised standard contractual clauses of the European commission, which can be found
here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), as long as this person is not already
subject to a lawfully recognized framework for the upholding of the relevant data protection clauses
or is given an exception. An exception can be made during foreign legal proceedings, but also in
cases of exceptional public interest or if the completion of a contract requires such information to
be publicized, the publishing or such information has been authorized by you or if it regards your
private data which is publicly available, the processing of which has not been vetoed by you.

8. Storage duration of your private information

We process and save your personal data as long as it is necessary for the fulfilment for our
contractual and legal commitments or for the processing of pursued goals, that is to say for example
for the duration of the entire business relations (from the initiation, handling, and the completion of
a contract) as well as the legally mandated storage and documentation obligations. As such it is
possible that personal data may be stored for a time in which claims may be substantiated against
our company and as far as we otherwise are legally obligated to do so or authorized business
interested require this (for example, for the sake of evidence and documentation). As soon as your
personal data is not necessary for the abovementioned uses, they will be generally and as far as possible deleted or anonymized. For operational data (e.g. system protocols, logs) generally shorter
storage times of twelve months or less apply.

9. Data security

We take appropriate technical and organisational security measures for the protection of your
personal data from unauthorized access and misuse, such as through issuing instructions,
schoolings, IT- and network solutions, access control and -restrictions.

10. Obligatory providing of personal data

In the context of our business relationship, you must provide the personal data which for the
initiation and execution of a business relationship and the fulfilment of the with this relationship
bound legal obligations is necessary (however, generally there is no legal duty to provide us with
data). The use of our website can also be restricted if certain disclosures necessary for the
safeguarding of the data transfer (for example, the IP-address) are not provided.

11. The rights of the affected party

You have, in accordance with the data protection laws applicable to you and in the extent provided
therein (such as in the case of the DSGVO), the right to the disclosure, correction, deletion, the right
to the restriction of the processing of the data and also the opposition against our data processing as well as the giving out of certain personal information for the transference to another location (so-called data portability). Please note however, that that we reserve the right to follow legally mandated restrictions, for example when we are obligated to keep or process certain data, in which we have a predominant interest (as long as we are allowed to call upon it) or data which is necessary for the assertion of certain claims. If costs are incurred on your behalf, we will inform you beforehand.
Regarding your right to rescind your consent, we have already informed you under figure 4. Please
note, that claiming these rights may stand in conflict to contractual agreements and can have
consequences such as the premature annulment of the contract or they may have financial
consequences. We will inform you of this beforehand unless it is already defined contractually.
Exercising such rights does require that you can with absolutely certainty prove your identity (e.g.
for example through a copy of an identity document, if your identity is not otherwise clear or cannot
be verified). To exercise your rights in this way, please contact the address given in point 2.
Every person affected also has the right to enforce their entitlements or to file a complaint with the
responsible data protection agency. The relevant data protection agency of Switzerland is the
Eidgenössische Datenschutz- und Öffentlichkeitsbeauftragte (http://www.edoeb.admin.ch).

12. Changes

We can change and adjust this privacy policy without any prior announcements. The current version
published on our website is always considered to be applicable. If the privacy policy is a part of a
contractual agreement with you, we will inform you of any updates per e-mail or any other fitting
method of communication.