Privacy policy

This is a translation. The German version is legally binding. View the German version

TURILLO personal ag, Bachstrasse 8, 8280 Kreuzlingen

As of: 20 October 2026

In this privacy policy, we, TURILLO personal ag, explain which personal data we process in connection with our activities as a recruitment agency and staff leasing agency (placement in temporary and permanent positions, try & hire, payrolling and personnel administration) and with our website www.turillo-personal.ch, for what purposes, how and where we do so, and what rights the data subjects have.

Additional privacy notices, declarations of consent or general terms and conditions may also apply to individual activities.

1. Controller and contact

The controller responsible for the processing of personal data is:

TURILLO personal ag
Bachstrasse 8
8280 Kreuzlingen
Switzerland
Phone: +41 71 672 75 85
E-mail: f.turillo@turillo-personal.ch

Please send any data protection enquiries, including requests to exercise your rights under section 12, to this address.

Representative in the European Union pursuant to Art. 27 GDPR: VGS Datenschutzpartner GmbH, Am Kaiserkai 69, 20457 Hamburg, Germany, info@datenschutzpartner.eu. Persons in the EU or the EEA as well as supervisory authorities may also contact our representative with data protection concerns.

2. Legal bases

We process personal data in accordance with the Federal Act on Data Protection (FADP/DSG) and the Data Protection Ordinance (DPO/DSV). As a licensed private employment agency and staff leasing agency, we also comply with the specific provisions of the Federal Act on Recruitment and the Hiring Out of Staff (Recruitment Act, AVG) and the Recruitment Ordinance (AVV). Accordingly, we process data on jobseekers and vacancies only to the extent and for as long as this is necessary for placement or staff leasing, and in principle only with the consent of the data subjects.

As we specifically target jobseekers in the European Union (EU) or the European Economic Area (EEA), the EU General Data Protection Regulation (GDPR/DSGVO) additionally applies to the processing of their personal data. In this case, we base the processing on the following legal bases:

  • placement and staff leasing, including disclosure to client companies and the talent pool: consent (Art. 6(1)(a) GDPR) and the performance of pre-contractual measures and of the placement or employment contract (Art. 6(1)(b) GDPR);
  • AI-assisted matching (section 5): consent (Art. 6(1)(a) GDPR);
  • performance of employment relationships in temporary work, try & hire and payrolling: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations, for example under social security and tax law (Art. 6(1)(c) GDPR); in this context, we process health data only on the basis of Art. 9(2)(b) GDPR;
  • communication with client companies and business partners, operation and security of the website, and the establishment or defence of legal claims: legitimate interests (Art. 6(1)(f) GDPR);
  • non-essential cookies: consent (Art. 6(1)(a) GDPR).

The provision of application data is neither a statutory nor a contractual requirement. Without this data, however, we cannot place you. Consent to AI-assisted matching is voluntary; without it, your application will be processed manually.

3. Personal data we process

Depending on the situation, we process in particular the following categories of personal data:

  • master and contact data (e.g. name, address, e-mail address, telephone number, date of birth);
  • application and qualification data (e.g. CV, cover letter, employment references, diplomas and certificates, language skills, professional experience, availability, salary expectations, mobility and place of work);
  • characteristics derived from these documents and matching results (see section 5);
  • data from the placement or assignment relationship (e.g. status of the application process, communications, assignments, working hours, salary, social security and withholding tax data, work and residence permits, and absences in temporary work and payrolling);
  • data of contact persons at our client companies and business partners;
  • technical data when visiting our website (e.g. IP address, browser and device information, date and time of access).

We collect this data primarily from the data subjects themselves. We obtain references only with the consent of the data subject. Where permitted, we also use information from publicly accessible sources, such as professional online profiles.

As a rule, we do not need sensitive personal data (e.g. information on health, religion or ethnic origin) for placement purposes. We ask applicants to submit such information and photos only if they expressly wish to do so. If such information is nevertheless provided, for example in employment references, we do not use it for matching. In the context of an employment relationship (temporary work, try & hire, payrolling), we process such data only to the extent necessary for the performance of the employment contract or required by law, for example medical certificates for continued payment of wages or information provided to insurers.

4. Applicants, jobseekers and temporary employees

We process the data of applicants and jobseekers in order to assess their suitability for vacancies, to suggest suitable positions, to place them with or lease them to client companies, and to carry out the placement or assignment relationship.

We obtain consent to the processing upon registration or application. With consent, we pass on application files to client companies that are being considered for a specific position. Without consent, we disclose data only to the extent permitted under Art. 19(2) or Art. 47(2) of the Recruitment Ordinance, for example to a client with a view to an imminent conclusion of a contract, or in anonymised form that does not allow any conclusions to be drawn as to identity.

With their consent, we include the details of applicants in our talent pool so that we can consider them for future vacancies and inform them of suitable positions. After a successful placement or after the placement mandate has been revoked, we continue to process the data only with the consent of the data subject, subject to statutory retention obligations.

In temporary work, try & hire and payrolling, we are the employer of the employees concerned. We process their data insofar as it concerns their suitability for the employment relationship or is necessary for the performance of the employment contract (Art. 328b of the Swiss Code of Obligations, CO/OR), in particular for assignment planning, time recording, payroll accounting, social security and withholding tax. We disclose to the hirer the information required for the assignment. In payrolling, we generally receive the information on the person concerned from the client company that selected them.

Where we are subject to a collective labour agreement, we disclose to the competent joint enforcement bodies the data required for inspections and enforcement.

Any consent given may be revoked at any time with effect for the future (see section 12).

5. AI-assisted matching

To support our placement activities, we use a tool that automatically evaluates application documents with the help of artificial intelligence (AI). This constitutes profiling within the meaning of data protection law.

5.1 What is evaluated and for what purpose

The system evaluates the documents submitted, in particular CVs, employment references, diplomas and certificates. From these, it derives characteristics relevant to placement, namely occupation and function, qualifications and education, professional experience and language skills. We use the information provided in the application form (e.g. place of residence, availability, preferred place of work) for the matching on our platform in Switzerland; this information is not transmitted to the AI provider. On this basis, the system matches applicants and vacancies with each other and produces a ranking of the degree of match. Matching may also be used to suggest suitable new assignments to our temporary employees; in doing so, we evaluate only data relating to their professional suitability.

The documents are transmitted to the AI provider in full. However, the system is instructed not to evaluate photos or information on appearance, date of birth and age, gender and nationality, or sensitive personal data (e.g. information on health, religion or ethnic origin). This information is not used for matching. Applications that reach us by e-mail or by any means other than the application form are evaluated with the help of AI only if the data subject has consented to this.

5.2 The decision rests with a human being

Matching serves exclusively for preparation and support. The results are suggestions. Decisions on making contact, presenting a candidate to a client company, a placement or a rejection are always taken by an employee of our company, following their own review of the documents. Applications are not screened out or rejected solely on the basis of the matching result.

5.3 AI provider used

For the evaluation, we use the AI service Claude. Our contractual partner is Anthropic Ireland, Limited, Dublin (Ireland); the processing is carried out by Anthropic, PBC in the USA. YMC AG, Kreuzlingen, which operates our platform, sets up the integration on our behalf. The provider processes the data exclusively for the purpose of providing the evaluation. It is contractually obliged not to use the data to train or improve its own AI models. It stores the transmitted data only for as long as is necessary to provide the evaluation and to prevent misuse, as a rule for no more than 30 days; in the event of suspected violations of its usage policies, it may retain the data for longer. For processing in the USA, see section 9.

5.4 Your rights in relation to matching

You may at any time request information about which characteristics have been derived about you and the criteria according to which matching is carried out. You may also inform us that your documents should not be evaluated with the help of AI. In this case, we will process your application exclusively manually; this will not result in any disadvantage to you. You may comment on matching results at any time.

6. Client companies and business partners

We process the data of contact persons at our client companies and business partners as well as information on vacancies in order to accept orders, propose suitable applicants, conclude and perform contracts and maintain the business relationship. We may publish vacancies on SECO's job-room.ch platform.

7. Use of our website

7.1 Server log files

Each time our website is accessed, technical information is recorded, namely the IP address, date and time, the page accessed, browser and operating system, and the previously visited page. We need this information to provide the website securely and reliably. It is deleted as soon as it is no longer required for these purposes.

7.2 Cookies

We use only technically necessary cookies that are required for the operation and security of the website (e.g. for the session and the cookie notice). We do not use any analytics or marketing tools. Google reCAPTCHA and Google Maps may additionally set cookies from Google (sections 7.3 and 7.4). Cookies can be deleted or deactivated in the browser settings at any time; without cookies, the website may not be fully available.

7.3 Google reCAPTCHA

To protect our forms (application, submission of vacancies, login) against automated abusive entries, we use Google reCAPTCHA provided by Google Ireland Limited or Google LLC (USA). In the process, in particular the IP address and information on the interaction with the website are transmitted to Google. Google processes this data partly under its own responsibility; Google's privacy policy also applies (policies.google.com/privacy).

7.4 Google Maps

On our location page, we embed maps from Google Maps. When the map is loaded, the IP address is transmitted to Google. Google processes this data under its own responsibility; Google's privacy policy also applies (policies.google.com/privacy).

8. Service providers and other recipients

We engage service providers that process personal data on our behalf (processors). They are contractually obliged to process the data only in accordance with our instructions and to take appropriate security measures. In particular, we use:

  • YMC AG, Kreuzlingen (Switzerland) – operation, maintenance and further development of the application platform;
  • Infomaniak Network SA (Switzerland) – hosting of the platform;
  • Akenes SA / Exoscale (Switzerland) – data backup;
  • MailPace Ltd. (United Kingdom) – sending of e-mails from the platform;
  • Functional Software, Inc. / Sentry (USA; data storage in the EU) – technical error logging;
  • Anthropic Ireland, Limited (Ireland) or Anthropic, PBC (USA) – AI-assisted matching (see section 5);
  • Google (see sections 7.3 and 7.4);
  • providers of e-mail, office and video conferencing services (e.g. Microsoft, Google);
  • fiduciary, payroll accounting and IT support service providers.

Other recipients are client companies and hirers within the scope of section 4, social security institutions and insurers (e.g. OASI/AHV compensation office, pension fund, accident and daily sickness benefits insurance), tax authorities (withholding tax), joint enforcement bodies of collective labour agreements and other authorities, insofar as we are legally or contractually obliged to disclose data to them, as well as our legal and fiduciary advisers.

9. Disclosure abroad

We generally process personal data in Switzerland. However, certain service providers also process data abroad, namely in the United Kingdom, in the EEA and in the USA (see section 8).

According to the decision of the Federal Council, the United Kingdom and the EEA states provide an adequate level of data protection. For recipients in the USA, this applies only insofar as they are certified under the Swiss-U.S. Data Privacy Framework. For other recipients in the USA, we ensure adequate data protection by means of standard data protection clauses that have been recognised by the FDPIC (EDÖB) and adapted for Switzerland. This concerns in particular the evaluation by Anthropic (section 5), which is based on the standard data protection clauses with adaptations for Switzerland in Anthropic's data processing agreement. You may obtain a copy of these safeguards upon request.

For personal data from the EU or the EEA, the following additionally applies: according to the adequacy decision of the European Commission, Switzerland provides an adequate level of data protection. For transfers to the USA, we rely on the EU-U.S. Data Privacy Framework, insofar as the recipient is certified under it, and otherwise on the standard contractual clauses of the European Commission.

Authorities in the USA may under certain circumstances access data stored there without data subjects having the same legal remedies as in Switzerland.

Data of jobseekers is disclosed across the national border only with their consent (Art. 19(1)(c) or Art. 47(1)(c) of the Recruitment Ordinance).

10. Retention and deletion

We retain personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. In particular:

  • applications, including the talent pool: deletion no later than two years after receipt of the application, or earlier if consent is revoked;
  • abandoned, incomplete applications: deletion after three months;
  • application documents of persons who have taken up a position through us: deletion twelve months after taking up the position;
  • data from placement and assignment relationships as well as business records: in accordance with the statutory retention periods, as a rule ten years;
  • matching results and derived characteristics: together with the underlying application.
  • data backups: deletion after 30 days.

Data that is no longer required is deleted or anonymised.

11. Data security

We and our service providers take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. These include in particular encrypted transmission (TLS/HTTPS), access restrictions based on the principle of least privilege, regular data backups, and the logging of access to the web server and of the processing steps carried out on applications. Absolute security cannot be guaranteed.

12. Rights of data subjects

Within the scope of the applicable data protection law, data subjects have in particular the following rights:

  • information as to whether and which personal data we process about them, including the information pursuant to Art. 25 FADP;
  • rectification of inaccurate data and completion of incomplete data;
  • erasure and objection to the processing, in particular to the AI-assisted evaluation (section 5.4);
  • revocation of any consent given at any time with effect for the future;
  • release or transfer of the data they have provided in a common electronic format.

To exercise these rights, a notification to the address stated in section 1 is sufficient. We must verify the identity of the requesting person. We may restrict the exercise of these rights to the extent permitted by law, for example where statutory retention obligations or overriding interests of third parties so require.

Data subjects may also enforce their claims in court or file a report with the Federal Data Protection and Information Commissioner (FDPIC/EDÖB) (www.edoeb.admin.ch).

Where the GDPR applies, you also have the rights under Art. 15 to 21 GDPR, namely to access, rectification, erasure, restriction of processing and data portability. You may object to processing that we base on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR). We generally respond to requests within one month. You may also lodge a complaint with a data protection supervisory authority in the EU or the EEA, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

13. Automated individual decisions

We do not take any decisions that are based solely on automated processing and that have legal effects on the data subject or significantly affect them (Art. 21 FADP). The AI-assisted matching under section 5 supports our employees; the decision is always taken by a human being. This also applies within the meaning of Art. 22 GDPR.

14. Changes

We may amend this privacy policy at any time. The version published on our website at the relevant time applies.

Kreuzlingen, 20 October 2026

Legal notice • Privacy policy