Confidentialité

This policy explains what personal data Life Science Work (lifesciencework.ch) processes, why, and what rights you have. We process personal data in line with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Morfeo Technologies OÜ
c/o TuneUp OÜ
Pärnu mnt 139b
11317 Tallinn
Estonia
Email: info@lifesciencework.ch

For anything about your data, write to info@lifesciencework.ch.

2. What we do not do

Life Science Work uses no third-party analytics service, no advertising or tracking cookies, no social media plugins, and loads nothing from third-party servers when you browse it. Nothing we run puts a script, a cookie or a tracking pixel in your browser to measure you, and nothing follows you to another website. We do not sell personal data, and we do not make automated decisions about you.

We do count visits, from the server's own request log and never from your browser. How that works, and what is kept, is in the next section.

3. Everyone who visits

• Server logs. Our web server records requests, including your IP address, the page requested, the time and your browser's user agent. We use these logs to run and secure the site, and to count how many people visit it and which pages they read. They are rotated daily and deleted after 14 days.
• Visitor statistics. Once a day we count those log entries into totals: how many pages were read, how many people read them, which pages, which site linked here, and how often the server failed. To count people rather than requests, your address and user agent are combined into a one-way hash under a key that is created for that single count and destroyed with it. Only the totals are stored. Nothing that could identify you is kept, the hash cannot be reversed or matched against any other day's, and the statistics are never shared.
• Abuse protection and view counts. To limit abuse and count how often a job is viewed, we store a keyed one-way hash of your IP address, not the address itself. These records are deleted within two days.
• Cookies. We set only cookies that the site needs: a language cookie that remembers your language choice for up to one year, and, if you sign in as an employer, a session cookie that keeps you signed in for up to 30 days or until you sign out. Both are strictly necessary for what you asked the site to do, so we do not ask for consent to them. You can block or delete cookies in your browser's settings: the site still works without the language cookie, but you cannot stay signed in without the session cookie.

Legal basis: our legitimate interest in operating a secure website (GDPR Art. 6(1)(f)).

4. Candidates who apply through Life Science Work

If a posting lets you apply on Life Science Work, we process what you enter in the form: your name, email address, optional phone number, optional message and optional CV (PDF only). We email this to the employer straight away, with your CV attached to that email, and make it available to them in their dashboard as well. We also email you a confirmation that your application was sent. We keep a keyed hash of your IP address with the application to prevent abuse.

We delete your application and CV from Life Science Work 180 days after you submit it. The employer is responsible for the copy they received, as a controller in their own right, and their own privacy notice applies to it. The email that carries your application to the employer is sent through our email provider (see section 7).

If a posting sends you to the employer's own website instead, we do not receive your application at all: we record only that the button was clicked.

Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in passing your application to the employer you chose (GDPR Art. 6(1)(b) and (f)).

5. Job alert and newsletter subscribers

If you subscribe to job alerts, we store your email address, the search filters you chose, and when you subscribed and last received an alert. Every alert contains a link to unsubscribe, after which we send you no more alerts.

The newsletter is a separate subscription: subscribing to job alerts does not subscribe you to it, and the other way round. You can ask for both at once by ticking the newsletter box on the job alert form, and each then has its own unsubscribe link. If you subscribe to the newsletter, we store your email address, the language of the page you subscribed on, when you subscribed, and which issues we have sent you. We do not track whether you open the newsletter or click its links: it contains no tracking pixels and no redirected links. Every issue contains a link to unsubscribe. As proof of your consent we keep a record of each time you subscribed: when it happened, the page and language you subscribed in, and the wording you agreed to, and later when and how you unsubscribed. The record is deleted with your address.

If you arrived from a link in one of our social media posts, we store that post's code (for example "ig-bio") with your subscription, and we count visits per code only as totals, without cookies.

If you unsubscribe, we keep the record for 30 days, so that an accidental click can be undone from the same link, and then delete it.

Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time by unsubscribing.

6. Employers

If you post a job, we process your email address, name if given, the company details you enter (name, website, logo, description, contact email), your job postings, your sign-in links and sessions, and records of your purchases. Sign-in links are stored only in hashed form and expire after 30 minutes.

Job postings and company profiles are public by design: they appear on the site, in our job feeds and in search engines. A posting that has closed stays visible, marked as closed, unless you ask us to remove it.

Payments are handled by Mollie B.V., Amsterdam, the Netherlands. You enter your payment details on Mollie's page, not ours, and we never see card numbers or bank credentials. We receive the payment status, amount and method, and give Mollie your company name and email address. Mollie processes payment data partly on our behalf and partly as a controller in its own right, for example for fraud prevention and anti-money-laundering checks it is legally required to make. Mollie's own privacy statement applies to that part.

We keep your account data for as long as your account is in use. You can close your account yourself at any time, under your company profile in the dashboard: that deletes your profile, your postings and every application you have received, CVs included. Payment and order records stay, because accounting law requires it, and the invoices we issued you remain what they were; the account they were bought from no longer exists. We keep purchase records and invoices for seven years after the end of the financial year they belong to (Estonian Accounting Act, § 12).

Legal basis: performance of our contract with you, our legal obligations in bookkeeping, and our legitimate interest in running the service (GDPR Art. 6(1)(b), (c) and (f)).

7. Service providers

We use these providers, who process personal data on our behalf and under our instructions:

• Hosting: Hetzner Online GmbH, Gunzenhausen, Germany, on servers in Nuremberg, Germany. The live data described in this policy is stored there.
• Email delivery: Plus Five Five, Inc. ("Resend"), San Francisco, United States, which sends sign-in links, application notifications, job alerts and the newsletter.
• Payments: Mollie B.V., Amsterdam, the Netherlands, as described above.

Resend is in the United States. Transfers to it are safeguarded by the EU Standard Contractual Clauses (module two, controller to processor) in Resend's data processing agreement, which applies them to transfers from Switzerland with the amendments Swiss law requires. Resend is also certified under the EU-U.S. Data Privacy Framework.

Backups. We back up the database, uploaded files and invoices every night. Backups are kept on the server for 14 days and in our own backup storage in Switzerland for up to 30 days, then deleted. Something deleted from the site can therefore survive in a backup for up to 30 days, where it is not used except to restore the site after a failure.

We also share data where the law requires it: our accountant receives invoices and payment records for bookkeeping and tax purposes, and authorities receive data where we are legally obliged to provide it.

8. Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent you have given. Write to info@lifesciencework.ch; we answer within 30 days.

You can also complain to a data protection authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), which supervises us where we are established; in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); or in the EU/EEA, the authority of the country where you live or work.

9. Changes

We update this policy when what we do with data changes. The date at the top shows the current version.