PostFinance Ltd
Mingerstrasse 20
3030 Bern, Switzerland

Scope

This Privacy Policy applies to all users of e-invoicing services who have been added to the directory according to the requirements of their provider, and to all users of the website.

Who is responsible for processing your data?

PostFinance Ltd is responsible for processing data within the scope of this Privacy Policy, which means that it bears primary responsibility for this data processing under data protection law, unless otherwise specified in individual cases. If you have any concerns about data protection, you can contact us as follows:

PostFinance Ltd
Data Protection Officer, Legal
Mingerstrasse 20, CH-3030 Bern
mydata@postfinance.ch

Who processes your data?

xeFex Ltd (Höhenweg 10, CH-9100 Herisau), which is responsible for the technical operation of eDirectory.ch on behalf of PostFinance Ltd, has access to the data collected. It does not process the data for its own purposes, other than those specified below, and does not disclose it to third parties.

The relevant e-invoicing service provider is responsible for the data contained in the B2B e-invoicing directory eDirectory.ch (data concerning companies and organizations that cooperate with a service provider for e-invoicing). If you have any concerns relating to data protection law in connection with e-invoicing data, please contact your e-invoicing service provider.

What data do we process?

Whenever you choose to use eDirectory.ch, we process different categories of data about you depending on the situation and purpose.

The following data is processed depending on whether you are a website user or a company that has been added to the directory:

Technical data

When visiting our website (www.edirectory.ch), the web server automatically collects certain technical data about your visit, which is recorded in logs, for example the date and time of accessing our website, the type and version of the browser, the set language and country from which the website was accessed, the Internet protocol address (IP address) of the accessing computer, device information and data concerning your interactions with the website, etc. It is not usually possible to deduce anything about your identity based solely on this technical data.

Master data

Provided that you have allowed your service provider to record master data, for example name, address or contact person of the company listed in the directory.

Why do we process your data?

We collect and process the data specified above to facilitate the use of our website and the completeness of the directory (website operation).

Data is also processed for the purpose of guaranteeing the functionality, stability and security of the website and our technical systems.

Profiling and automated decision-making

Cookies and online tracking or analytical techniques are not used on eDirectory.ch.

Who do we disclose your data to?

The master data that you provide is publicly accessible on the website. Website users’ technical data is only processed by xeFex Ltd.

Do we disclose personal data abroad?

As a rule, we do not disclose personal data abroad. Please bear in mind, however, that the website is also accessible from abroad.

For how long do we store your data?

The technical data collected is deleted after 30 days. The master data is deleted after 30 days as soon as you notify us of a change.

How do we protect your data?

We take appropriate HR-, technical- and organizational-based security measures to maintain the security of your personal data, safeguard it against unauthorized or unlawful processing and protect it against the risk of loss, accidental modification or unauthorized access.

What are your rights?

Under specified preconditions, you have the right to information about your personal data and its processing by us, to rectify incorrect or incomplete data and to object to our processing of your data. In certain cases, you also have the right to receive certain data in a structured, established and machine-readable format. If the processing of personal data requires your consent, you may withdraw this at any time by contacting your service provider. Such a withdrawal applies only with regard to future processing.

Should you wish to exercise your rights concerning us, please send us a signed letter (see “Who is responsible for processing your data?” section) and a clearly legible copy of your identity document to allow us to identify you and to prevent misuse.