- 2. Contact details and data protection advisors
- 3. Legal basis
- 4. Collecting and processing personal data
- 5. Purposes of processing and legal basis
- 6. Cookies/tracking and other technologies relating to the use of our online services
- 7. Transmission of personal data
- 8. Duration for which personal data is stored
- 9. Processing of personal data in the context of job application procedures
- 10. Processing of personal data within the framework of accreditation and election procedures
- 11. Data security
- 12. Rights of data subjects
- 13. Changes
2. Contact details and data protection advisors
Innosuisse - Swiss Innovation Agency is responsible for the data processing described here.
Queries relating to data protection or this policy can be directed at any time, electronically or by post, to:
Innosuisse – Swiss Innovation Agency
Data Protection Advisor, Legal and Strategy Team
3. Legal basis
- Personal data is understood to be all information that relates to an identified or identifiable person. In the present context, this refers to data of both natural and legal persons (e.g. companies).
- Processing means any handling of personal data, irrespective of the means and procedures used, in particular the collection, storage, keeping, use, modification, disclosure, archiving, deletion or destruction of data.
- As a rule, Innosuisse processes personal data as a federal body as defined by Art. 4 let. i FADP, which means that the special provisions of Chapter 6 of the Data Protection Act apply.
In certain cases, data protection provisions of other legal sources or international data protection laws such as the European General Data Protection Regulation3 may be applicable.
We process data of legal persons on the basis of Art. 57h bis GAOA4 .
3 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
4 Federal Act on the Organisation of the Government and the Administration (GAOA, SR 172.010).
4. Collecting and processing personal data
We primarily process the personal data that we receive from applicants and customers and from other business partners as well as other persons involved in the course of our funding activities and other legally stipulated tasks of Innosuisse, or that we collect from their users when operating our websites and applications.
Where permitted, we also take certain data from publicly accessible sources (e.g. commercial register, the press and the internet) or receive such data from other authorities or third parties (such as coaches and mentors of Innosuisse).
In addition to the data about you that you give us directly, the categories of personal data that we receive about you from third parties include, in particular:
- Information from public registers and information that we learn in connection with official and judicial proceedings,
- Information related to their professional or academic functions and activities (so that we can, for example, formally verify information provided on this in applications as part of the evaluation),
- Information about you in correspondence and meetings with third parties, and credit reports (where we deal with you personally),
- Information about you given to us by people close to you (business partners, family, advisors, legal representatives, etc.) so that we can conclude or process contracts with you or involving you (e.g. references and powers of attorney),
- Information on compliance with legal requirements such as anti-money laundering and export restrictions,
- Information from the media and the internet about you (if this is appropriate in the specific case, e.g. to check application details or in the context of an application),
- Data related to the use of the website (e.g. IP address, MAC address of the smartphone or computer, details relating to your device and settings, cookies, date and time of visit, pages and content accessed, functions used, referring website, and location details).
5. Purposes of processing and legal basis
We use the data we collect primarily within the scope of our legally stipulated funding mandate (Art. 18 et seqq. RIPA5), in particular
- for the formal review of submitted funding applications;
- as part of the evaluation of funding applications;
- in the event of a positive funding decision, to conclude and process funding contracts and administer the corresponding administrative procedure;
- in the event of a negative funding decision to conclude the administrative procedure (usually by means of an order);
- to review the use of subsidies and in the context of final accounts;
- to review the effectiveness of Innosuisse funding instruments (impact analysis);
- for correspondence in the context of application and funding procedures;
- for coordination with other Innosuisse funding instruments;
- for the purpose of informing the public about the promotional activities of the Federal Administration.
In addition, we process personal data from you and other persons as necessary and within the scope of our legal duties (esp. Art. 3 SIAA6) for the following purposes:
- Concluding (private law) contracts e.g. with external suppliers and correspondence in this context.
- Conducting legal proceedings in accordance with the relevant procedural law (in particular appeal proceedings under the APA7) or for asserting legal claims (such as claims for restitution under Art. 40 SuA8).
- If you apply to us as an employee in the context of application procedures and the processing of employment contracts (in accordance with BPG9 and Art. 4 Personnel Ordinance Innosuisse10)
- Within the scope of election procedures (according to Art. 6, 9 and 10 para. 2 SIAA), accreditation procedures for coaches or mentors (according to Art. 21 para. 3 and Art. 21 para. 2 RIPA) and for handling the cooperation with elected or accredited persons;
- Within the scope of electronic document management (in accordance with Article 57h GAOA) and to ensure and check the proper operation of the electronic infrastructure.
We reserve the right to make further amendments in accordance with the relevant legal basis.
If you have given us your consent to process your personal data for certain purposes (for example, when you register to receive newsletters or carry out a background check), we process your personal data within the scope of and based on this consent, insofar as we have no other legal basis and we require such a basis. Consent given can be revoked at any time, but this has no effect on data processing that has already taken place.
5 Federal Act on the Promotion of Research and Innovation (RIPA, SR 420.1).
6 Innosuisse Act (SIAA, SR 420.2).-
7 Administrative Procedure Act (APA, SR 172.021).
8 Federal Act on Financial Assistance and Subsidies (SubA, SR 616.1);
9 Federal Personnel Act (FPA, SR 172.220.1).
10 Innosuisse Personnel Ordinance.
6. Cookies/tracking and other technologies relating to the use of our online services
If you have registered for an Innosuisse newsletter on our website and have agreed to receive it in the confirmation e-mail that is then sent to you (“double opt-in”), we will add your contact details to the relevant distribution list. The data is used exclusively for the dispatch of our newsletter. For the dispatch and management of the newsletter, we use the software Mailweaver12. Among other things, this allows anonymous evaluations to be carried out to measure the success of the mailing. We are able to track how many of our recipients have opened newsletter content, for example. This is necessary in order to better adapt our newsletter content to the needs of our audience and thus to comply with our legal mandate to provide information on existing subsidies in the best possible way. If you would like to prevent this from happening, we ask that you unsubscribe from the newsletter. You can unsubscribe from the newsletter at any time from the settings. A corresponding link can be found in the footer of each newsletter as well as in the confirmation e-mail following initial registration.
12 Further information available at: https://mailweaver.ch/de/.
When you access our website, information of a general nature is automatically recorded. This information is recorded in the server log file and includes the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and the like.
This is in particular for the following reasons:
- Ensuring a website connection is established without any problems
- Ensuring seamless use of our website
- Evaluating system security and stability
The data is erased as soon as it is no longer required for the purpose of collection. For the data used to deliver our website, this is generally the case once the respective session has ended or once the data has reached a certain size (by default: 200MB).
In order to provide you with an optimal tool through our website and continuously adapt our funding opportunities to the needs of our stakeholders, we analyse the user behaviour of visitors to our website. To do so, we use the web analysis service Matomo13.
Matomo cookies remain on your device until you erase them. The information generated by the cookie about how this website is used is not passed on to third parties. You may stop cookies from being stored by selecting the appropriate settings on your browser; however, please note that by doing so you may not be able to make full use of all the functions on this website.
13 Available at: www.matomo.org.
Social media plugins allow content from social media to be integrated, e.g. on a website. We use the social plugins below on our website to make our agency and the programmes and subsidies we offer better known and thus fulfil our legal mandate to provide information about existing subsidies in the best possible way. Responsibility for operation being compliant with data protection must be ensured by their respective providers. Data processing in connection with these plugins is carried out with your consent when you use these plugins (e.g. by clicking on them). If you use the services of these social networks, either independently or in connection with our website, the social networks will evaluate your use of the plugin. In this case, information about the plugin is passed on to the social networks.
The following “social plugins” are used on our website:
Our website uses plugins from social network Facebook, which is provided by Facebook Inc. The Facebook plugins are marked with a Facebook logo or the “Like” or “Share” buttons. If you call up a page on our website that contains such a plugin and you select it, your browser establishes a direct connection to the Facebook servers. The content of the plugin is transmitted by Facebook directly to your browser and integrated into the page.
Through this integration, Facebook is informed about your browser having called up the corresponding page of our website, even if you do not have a Facebook profile or are not currently logged in to Facebook. This information (including your IP address) is transmitted by your browser directly to a Facebook server in the USA and stored there. If you are logged in to Facebook, Facebook can directly assign your visit to our website to your Facebook profile. When you interact with the plugins, for example by clicking on the “Like” button, this information is likewise transmitted directly to a Facebook server and stored there. The information is also published on your Facebook profile and displayed to your Facebook friends. For the purpose and scope of data collection and the further processing and use of this data by Facebook, as well as your rights in this regard and settings options for protecting your privacy, please refer to Facebook's Data Policy14.
14 Available at: https://de-de.facebook.com/about/privacy.
15 Available at: https://www.linkedin.com/legal/privacy-policy.
16 Available at: http://twitter.com/privacy.
7. Transmission of personal data
We also disclose personal data to third parties within the scope of our funding activities and the purposes set out in section 3, insofar as we have a legal basis or a justification (e.g. consent) for doing so and it appears appropriate to us, either because they process it for us or because they want to use it for their own purposes. This involves the following posts in particular:
- Research institutions (e.g. grant offices of universities), organisations (e.g. implementation partners) and natural persons (e.g. researchers) involved in the respective funding measure;
- Partners and organisations that cooperate with us on certain funding opportunities (such as BRIDGE, internationalisation camps, trade fairs and start-up training);
- Coaches and mentors who support and work with you as part of an Innosuisse funding;
- Federal bodies, namely for archiving purposes, within the framework of legal proceedings or for coordination purposes;
- Our service providers and contract processors such as cloud providers and developers of our Innolink platform or service providers who, for example, carry out statistical evaluations for us or make in-depth clarifications as part of the review and evaluation of applications;
- Third parties who have applied for access to official files on the basis of the Federal Act on Freedom of Information in the Administration17, provided that we have granted them full access in our opinion; in principle, however, official documents are blacked out (i.e. anonymised and no personal data is disclosed) prior to inspection on the basis of Art. 9 para. 2 FoIA;
- Applicants who have applied to inspect the documents relating to the application procedure concerning them on the basis of the right to inspect files under the Administrative Procedure Act (APA) and who have no grounds under Art. 27 APA for not doing so;
- The public in the context of the publication of funded applications on the federal research database www.aramis.admin.ch in accordance with the ARAMIS Ordinance18 or in the publication of awards on www.simap.ch in the context of public procurement procedures in accordance with PPA19.
These recipients are predominantly in Switzerland and we attach great importance to the fact that the storage locations used are in Switzerland. However, this is not possible in all cases. In particular, you must expect your data to be transferred to all countries worldwide in which Innosuisse offers or supports funding opportunities, as well as to other countries in which the service providers we use are located. The storage locations of the cloud solutions used are generally in Switzerland or the EU.
If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection law insofar as it is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have consented or if it concerns data that you have made generally accessible and you have not objected to its processing.
8. Duration for which personal data is stored
We erase or anonymise the personal data we have collected from you as soon as it is no longer needed to fulfil the purpose for which it was originally collected, and beyond that in accordance with the statutory retention and documentation obligations. In this context, it is possible that personal data will be retained for a period during which claims can be asserted against Innosuisse and to the extent that we are otherwise legally obliged to do so insofar as no other storage and documentation obligations exist. As soon as your personal data is no longer required for the above-mentioned purposes, it will be erased or made anonymous as far as possible. For operational data (e.g. system protocols and logs), shorter retention periods of twelve months apply.
9. Processing of personal data in the context of job application procedures
We process personal data in job application procedures on the basis of Art. 4 of the Innosuisse Personnel Ordinance in accordance with the provisions of the Federal Personnel Act20 and the implementing legislation specifying this (in particular the BPDV21).
If you apply for a job at Innosuisse via the Innosuisse job portal, we will ask you to provide certain information about yourself and you will be given the opportunity to upload further application documents such as your CV, letter of motivation, references, etc. This information and documents will be treated confidentially. We treat these details and documents confidentially. They are only available to the persons responsible for the relevant application procedure at Innosuisse in the recruitment process.
If you subsequently take up employment with Innosuisse, your application documents, or an extract thereof, will be added to your personnel file. The remaining personal data and documents will be deleted no later than three months after the job has been filled.
If you have applied for a position but received a negative decision, your data and documents will be deleted no later than three months after the position has been filled (there will be no notification of the deletion of the data). This does not apply to cases where we would like to keep your file for possible future application procedures and you have given us your consent to do so.
You can withdraw your application and have the data deleted at any time.
10. Processing of personal data within the framework of accreditation and election procedures
From time to time, Innosuisse conducts expert and innovation council elections as well as accreditation procedures of coaches and mentors. They are advertised on the Innosuisse homepage. If you apply for an election or accreditation within the framework of these procedures, we process the personal data provided as well as the documents submitted based on the Innosuisse Act22 and the FIFG23.
We treat the submitted documents confidentially. They are available exclusively to the persons responsible at Innosuisse for the relevant election or accreditation procedure in the selection process.
In the event of a successful election or if you are accredited, your application documents, or at most an extract thereof, will be stored for the purpose of carrying out the cooperation.
Otherwise, your data and documents will be deleted no later than three months after completion of the election or accreditation procedure (no notification of the deletion of the data will be made). This is without prejudice to cases in which we would like to retain your file for possible future election or accreditation procedures and you have given us your consent to do so.
You can withdraw your application and have the data deleted at any time.
11. Data security
We apply appropriate technical and organisational security measures in data processing and employ IT security and data protection specialists to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties. Innosuisse’s security measures correspond to the current state of the art.
For security reasons and to protect the transmission of confidential content such as funding applications, our website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the padlock icon in your browser line. If the SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.
We communicate with secure UCC solutions approved by Innosuisse24 (e.g. Skype for Business, Webex and Microsoft Teams). We exchange documents and larger data sets with you via secure platforms (e.g. Innolink and Microsoft Sharepoint). We transmit confidential data or documents with sensitive content in encrypted form using IncaMail or the Federal Administration’s File Transfer Service.
24 Unified Communications Collaboration (UCC) describes the integration of different forms and channels of communication with tools for collaboration.
12. Rights of data subjects
As a data subject, you have certain rights with regard to the personal data we process about you:
You have the right to know what data we process about you. Please address your written request to the address specified in section 2 (Innosuisse Legal Services). Please enclose a copy of a valid identification document together with your request.
You also have the right to rectify data, supplement incomplete data or erase it. Furthermore, you have the right to object and can demand restrictions in the processing and transmission of data.
In cases pursuant to Art. 41 para. 3 FADP, Innosuisse may also restrict individual processing operations instead of erasing or destroying personal data.
The Federal Data Protection and Information Commissioner acts as the supervisory authority in Switzerland. As a citizen of the Union, you may also apply to the supervisory authority of your member state.
Your rights may be restricted where this is provided for by law or necessary due to overriding public or private interests.25 In particular, data that we are required to store due to legal retention obligations will be blocked, rather than erased, to prevent use for other purposes.
25 See Art. 41 para. 3 FADP.
From time to time, it may become necessary to make changes to the Data Protection Policy. The current version published on our website applies in each case.
Last updated: 01.09.2023
Last modification 05.09.2023