Notice for professionals identified from public sources

Why you are receiving this notice

We process data about you that we did not collect from you: it comes from public pages and registers where your professional activity appears. This page tells you what data we hold, which source it came from, what we do with it and how you can have it deleted.

It concerns our search for independent IT professionals active in Switzerland. If you registered on the platform or sent us a CV, the candidate notice applies instead.

Who processes your data

What data we process

Only data you have made public yourself in a professional context, or that a register publishes as required by law:

• your name and surname, the sole-proprietorship name you are registered under, or the pseudonym under which you appear on the source;
• the address of the public page the data comes from;
• skills, technologies and certifications exactly as you stated them;
• municipality or location, as stated by the source or the register;
• how you work — independently or as an employee — where the source states it or where it follows from a register entry;
• stated availability, where the source reports it;
• professional contact details, only if published by the source.

We do not process, in any form, not even encrypted or reduced to a hash:

• photographs or images of your face. This is a project rule, not a preference: where a source publishes a dedicated path for photographs, that path is excluded at the root;
• health data, or data on ethnic origin, religious, political or trade-union beliefs, sex life or sexual orientation;
• criminal-offence data or data on criminal or administrative proceedings;
• date of birth, age, gender, marital status;
• nationality and residence permit: we never infer them, and we record them only if you state them to us in direct contact.

Where your data comes from

This is the complete list of sources your data may have come from. The list is versioned: if we add one, this page's version goes up before collection begins.

"In use" means the source is active today. "Planned" means it is permitted but collection has not started: by the time it does, this page will already be updated.

In the first message we send you we always tell you which specific source your data comes from, and we include the link to this page.

Sources we assessed and do not use

We list them for completeness, so that you also know where your data does not come from. We collect nothing from any of them.

Why we process it, and on what basis

Purpose. To identify professionals potentially interested in IT consulting assignments in Switzerland, and to contact them to propose working together. If you are interested and the profile matches, we present your application to the client only after your explicit consent and using the data you give us, never the data gathered from public sources.

Legal basis. Legitimate interest: Art. 6(1)(f) GDPR and Art. 31 FADP. The interest is to connect professionals with assignments in a market where demand is stated and supply is hard to reach.

In the balancing test we considered that the data comes from pages published in order to be found professionally, or from registers that are public by law; that it is limited to professional information; and that you can object at any time, with immediate effect and without having to give a reason.

No score, no ranking

This section describes a design decision, and we set it out in full because it bears directly on how your profile is handled.

The system does not assign scores to people. It calculates no compatibility index, does not order profiles by relevance to an assignment, produces neither rankings nor shortlists, and employs no semantic-representation technique to compare people against requirements.

The software searches for terms and displays what the sources state. Comparing a profile against an assignment's requirements is done by a person, reading.

This is not a promise taken on trust: the prohibition is written into an automated code check that blocks release of the system if anyone introduces a score, a relevance ordering, or a semantic-representation library.

It follows that we do not profile you and take no automated decisions about you within the meaning of Art. 22 GDPR and Art. 21 FADP. If you ask us what score you were given, the answer is that none exists.

Who we share your data with

• No one, until you have replied and given consent.
• After your consent, and limited to the data you give us: with GHR Group AG and, through them, the client company for the assignment you are applying for. We tell you who they are beforehand.
• With technical providers processing data on our behalf as processors under Art. 28 GDPR: the current list can be requested at any time from info@did.srl.

Data collected from public sources does not leave our organisation without your consent.

How long we keep it

If we do not contact you within 30 days of collection, your record is deleted. We do not keep silent archives of people who were never informed.

If we do contact you within that period, the message contains the link to this page and tells you where the data came from. From then on:

• you do not reply, or you decline → we delete within 30 days, keeping only the minimum needed not to contact you again: a cryptographic hash of your contact detail, which serves to exclude you from future searches and from which the contact detail cannot be reconstructed;
• you are interested → we keep the data for the duration of the working relationship and for 24 months afterwards, unless the law requires longer.

Transfers

Data is processed in Italy and may be transferred to Switzerland. The European Commission has recognised Switzerland as providing an adequate level of protection, so the transfer requires no further safeguards.

Where a technical provider processes data outside the European Economic Area, the transfer is based on an adequacy decision or on the standard contractual clauses adopted by the European Commission. You may request a copy from info@did.srl.

Your rights

At any time you can:

• object to the processing — simply say so, no reason required: we stop and delete;
• request access to the data about you and a copy of it;
• request rectification of inaccurate data;
• request erasure;
• request restriction of processing;
• request portability of the data you provided to us.

Write to info@did.srl. We reply within 30 days. Deletion is free, needs no justification and carries no conditions.

You may also lodge a complaint with a supervisory authority:

• in Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch
• in Italy: Garante per la protezione dei dati personali — garanteprivacy.it
• in other EU Member States: the authority of your country of residence.

Changes

If the sources we collect from, the purposes or the providers change, we update this page and raise its version before the change takes effect. The version in force and its date are at the top of the document.