Privacy Policy

1. What is this Privacy Notice about?

The ROSE Technologies AG (also «we», «us») collects and processes personal data that concern you but also other individuals («third parties»). We use the word «data» here interchangeably with «personal data». «Personal data» means data relating to identified or identifiable individuals, which means that the relevant data, in combination with additional data, make it possible to draw conclusions about the identity of these individuals. «Sensitive personal data» is a subset of personal data that is specially protected under applicable data protection law. This includes, for example, data revealing racial or ethnic origin, health data, religious or philosophical beliefs, biometric data for identification purposes, and information relating to trade union membership. In Section 3, you will find information about the data we process in accordance with this Privacy Notice. «Processing» means any operation that is performed on personal data, such as collection, storage, use, alteration, disclosure and erasure.

In this Privacy Notice, we describe what we do with your data when you use www.roseframework.io, app.roseframework.io, our other websites or our apps (collectively «website»), obtain services or products from us, interact with us in relation to a contract, communicate with us or otherwise deal with us. When appropriate we will provide a just-in-time notice to cover any additional processing activities not mentioned in this Privacy Notice. In addition, we may inform you about the processing of your data separately, for example in consent forms, terms and conditions, additional privacy notices, forms and other notices.

If you disclose data to us or share data with us about other individuals, such as co-workers, we assume that you are authorized to do so and that the relevant data is accurate. When you share data about others with us, you confirm that. Please make sure that these individuals have been informed about this Privacy Notice.

This Privacy Notice is aligned with the EU General Data Protection Regulation («GDPR»), the Swiss Data Protection Act («DPA») and the revised Swiss Data Protection («revDPA». However, the application of these laws depends on each individual case.

2. Who is the controller for processing your data?

ROSE Technologies AG, c/o Impact Hub Zürich AG, Sihlquai 131, 8005, Zürich, Switzerland, («ROSE Technologies AG») is the controller for the ROSE Technologies AG's processing under this Privacy Notice, unless we tell you otherwise in an individual case.

For each processing activity there are one or several parties that are responsible for ensuring that the processing complies with data protection law. This party is called the controller. It is responsible, for example, for responding to access requests (Section 11) or for ensuring that personal data is processed securely and not used in an unlawful manner.

Additional parties may be joint controllers for the processing set out in this Privacy Notice if they participate in determining the purpose or means of the processing. If you wish to receive information about the controllers for a specific processing activity, you are welcome to ask us as part of your access right (Section 11). The ROSE Technologies AG remains your primary contact, even if there are other joint controllers.

In Section 3, Section 7 and Section 12, you will find additional information about third parties with whom we work together and who are controllers for their processing. If you have any questions for these third parties or if you wish to exercise your rights, please contact them directly.

You may contact us for data protection concerns and to exercise your rights under Section 11 as follows:
ROSE Technologies AG, c/o Impact Hub Zürich AG, Sihlquai 131, 8005, Zürich, Switzerland, info@roseframework.io

7. With whom do we share your data?

In relation to our contracts, the website, our services and products, our legal obligations or otherwise with protecting our legitimate interests and the other purposes set out in Section 4, we may disclose your personal data to third parties, in particular to the following categories of recipients:

- Service providers: We work with service providers in Switzerland and abroad who process your data on our behalf or as joint controllers with us or who receive data about you from us as separate controllers (for example IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurance companies, debt collection companies, credit information agencies, or address verification providers). For the service providers used for the website, see Section 12. Key service providers in the IT area are Amazon Web Services, Inc., Fly.io, Inc., Supabase, Inc., Hound Technology, Inc., Vercel Inc., Mistral AI, Google LLC/Google Ireland Limited, and Braintrust Data, Inc.

To be able to deliver our products and services efficiently and focus on our core competencies, we procure services from third parties in various areas. These include, for example, IT services, information transmission, marketing, sales, communication or printing services, facility management, security and cleaning, organizing and holding events and receptions, debt collection, credit agencies, address verification provider (for example to update address lists in case of relocations), fraud prevention measures and services from consulting companies, lawyers, banks, insurers and telecommunication companies. In each case, we disclose to these providers the data they require for their services, which may also concern you. These providers may also use such data for their own purposes, for example information about overdue claims and your payment history in case of credit information agencies or anonymized data to improve their services. In addition, we enter into contracts with these providers that include provisions to protect data, where such protection does not follow from the law. In some cases, our service providers may also process data on how their services are used and other data that is generated in the course of using their services as independent data controllers for their own legitimate interests (e.g., for statistical analysis or billing purposes). Service providers inform about their independent data processing activities in their own privacy statements.

12. Do we use online tracking and online advertising techniques?

We currently use offers from the following service providers and advertising partners (where they use data from you or cookies set on your computer for advertising purposes):