Privacy policy

Controller (Art. 19 revFADP):
Your employer (the organisation you work for).

Processing on behalf:
Your employer (the organisation you work for) is the controller within the meaning of data protection law. R.O.S.I.E. processes your data as a processor under a data processing agreement (DPA) concluded with your employer.

Infrastructure:
Rosie is a Swiss offering by Digital Passion GmbH (registered in Olten SO). Customer data stored in the protected app is stored and processed exclusively on servers located in Switzerland (Infomaniak, data centres in Switzerland). Transmission is encrypted (TLS 1.3), as is storage (AES-256). The public website uses an upstream protection service and name resolution; technical connection data such as IP addresses may be processed in doing so. Details are set out in the data processing agreement (DPA).

Categories of data processed:
Master data (name, email address, role, workload), rosters, absence data (sensitive personal data, Art. 5 lit. c revFADP), messages, consent history.

Technical measures:
Sensitive free-text fields (e.g. reasons for absence) are encrypted with AES-GCM and automatically scrubbed after one year. No third-party tracking, no advertising cookies.

Your rights:
Access, rectification, erasure, release and portability of your data. Please address requests to your employer or to support@rosie-app.ch.

Purpose and retention per processing: My profile → Data protection (after login).