Data protection
Version 1.0, in force since 21.10.2026.
This page explains what personal data SPTS processes, why, with whom it shares it, how long it keeps it and what your rights are. It is organised by audience: look for the section that applies to you. The French version of this page prevails.
The essentials in five points
- The controller is SPTS - Swiss Payroll & Tax Services Sàrl, which operates the SPTS Portage name. For any question: portage@spts.ch.
- We do not sell any data. We process only what is needed to answer your request, perform a contract or meet our obligations as employer.
- Our tools are named, with their country: Switzerland, the European Union and, for some of them, the United States, with the safeguards described in section 13.
- No decision is taken automatically. When we use an artificial intelligence tool, a person at SPTS reads the result and decides.
- At any time, you can ask for access to your data, its correction or deletion, withdraw your consent, and contact the Federal Data Protection and Information Commissioner (FDPIC).
1. Controller
SPTS - Swiss Payroll & Tax Services Sàrl ("SPTS"), Chemin de la Chesnaie 8, 1219 Châtelaine, Geneva, Switzerland, IDE CHE-272.150.214, which operates the SPTS Portage name.
Data protection contact: the Director of SPTS, at portage@spts.ch, or by post to the address above.
SPTS has not appointed a data protection advisor; this appointment is optional for a private company.
This processing is based on the Federal Act on Data Protection (LPD) and its ordinance (OPDo) and, for the workers we employ, on art. 328b of the Swiss Code of Obligations (CO), the Federal Act on Recruitment and the Hiring of Services (LSE) and its ordinance (OSE).
2. Visitors to the site
| Data | Purpose | Retention period | Recipients and countries |
|---|---|---|---|
| IP address, page requested, browser, date and time | Displaying and protecting the site | 1 day for the host's execution logs | Vercel, in Frankfurt (Germany) |
| Your choice regarding audience measurement | Not asking for your preference again on every page | 12 months, in your browser | None |
| With your consent only: measurement identifier, pages viewed, technical information about your browser and device, approximate location | Measuring the site's traffic | 14 months | Google, collection in the European Union and storage in the United States |
Audience measurement. With your consent, we use Google Analytics 4 to measure the site's traffic and understand which pages and tools visitors consult. Measurement permissions are set to "denied" by default, and declining is as easy as accepting. Before you choose, and if you decline, Google Analytics is not loaded and no data is sent to Google. If you withdraw your consent, measurement stops and the Google Analytics cookies are deleted from your browser; data already sent remains subject to the retention period shown above.
We do not send Google Analytics the content of your messages, your name, your email address or the data entered in the simulation form.
We do not use advertising or retargeting cookies. You can change your preferences at any time from our Cookies page.
3. Simulation and contact requests
| Data | Purpose | Retention period | Recipients and countries |
|---|---|---|---|
| Simulation form: salary and pay frequency, nationality, residence permit, place of work, family circumstances, spouse's income, number of children, date of birth, address, and your contact details (surname, first name, email address, phone), message | Preparing your simulation, contacting you again and, if you wish, preparing your contract | 12 months after the last exchange if no contract is concluded | Vercel, which runs our application in Frankfurt (Germany); Supabase, its database, in Frankfurt (Germany); Resend, which sends its emails, in Ireland; Google Workspace, our email service, in the European Union |
| Contact form and emails: name, contact details, message | Replying to your request | 12 months after the last exchange if no contract is concluded | The same |
Why we ask these questions. Withholding tax depends on the canton, the permit and family circumstances, including the spouse's income; the occupational pension contribution depends on age. Without these items, a simulation would be wrong. Do not attach any document (identity document, permit, salary certificate, IBAN) to your request.
4. Exchanges by WhatsApp
We use WhatsApp for practical exchanges with people who choose this channel: arranging appointments, everyday questions, reminders. Our number: +41 77 904 72 47.
- The provider. WhatsApp is a service of the Meta group, which processes your data under its own terms. The content of messages is end-to-end encrypted; Meta nevertheless processes your number, your profile and metadata, for example the date and time of exchanges and the device used.
- Transfers. Meta may process this data outside Switzerland, in particular in the United States (section 13).
- Contact synchronisation. The address book of the business phone we use for WhatsApp is synchronised with the application: if your number is stored there, it is disclosed to Meta simply because it is stored there.
- Backups. Conversations are backed up on Google Drive, a Google service, which may process them outside Switzerland, in particular in the United States (section 13).
- Internal access. Exchanges go through a dedicated business smartphone, used only by the SPTS Portage team.
- Retention. Conversations are kept for 12 months after the last exchange, then deleted.
Sensitive documents do not go through WhatsApp. Do not send an identity document, a permit, a medical certificate, a salary certificate or bank details by WhatsApp: these documents are uploaded to your consultant portal. If you send us one by WhatsApp, we will ask you to upload it to the portal.
Choosing WhatsApp does not deprive you of any right and does not release SPTS from its obligations. You can always write to us by email or use your portal instead.
5. Consultants employed by SPTS
In staff leasing and payrolling, SPTS is your employer. It processes only data that concerns your suitability for the job or that is needed to perform your employment contract (art. 328b CO), and only for as long as necessary.
| Data | Purpose | Retention period | Recipients and countries |
|---|---|---|---|
| Identity, nationality, permit, marital status, address, AHV number, bank details (IBAN), salary | Concluding and performing your employment contract, paying your salary, meeting our obligations towards social insurance bodies and the authorities | 10 years after the end of the calendar year for salaries and accounting records (art. 958f CO); other documents: see the last row | Authorities and institutions (list below); bank, for salary payments; Winbiz (Switzerland), for payroll; application providers (section 12) |
| Contracts, amendments, signatures and their proof (frozen document, fingerprint, log) | Establishing and proving your contracts | 10 years after the end of the calendar year | Hiring company, for the staff leasing contract that concerns it; application providers |
| Timesheets, absences, holidays | Calculating your salary and invoicing the assignment | 10 years after the end of the calendar year | Hiring company, which approves your hours |
| Medical certificates, accident reports, daily allowance statements, maternity leave | Paying your salary and allowances, reporting the case to the insurer | Those that justify a payment: 10 years; others: until the case is closed, then 30 days | The accident or daily sickness benefits insurer concerned; never the hiring company |
| Profile photo, uploaded by an administrator or found on a public page and approved by an administrator (section 12) | Identifying your file in our application | Until the end of the 2nd tax year following your last assignment | None: the photo does not appear in the portals, on any document or in any email |
| Results of the checks (section 8) | Establishing and administering your contracts | Until the end of the 2nd tax year following your last assignment; 12 months if there was no assignment | No one outside SPTS |
| Access to the consultant portal, documents you upload there | Giving you access to your file | Depending on the nature of the document, as above | Application providers |
| Other documents: CV, copy of identity document | Building your file | Until the end of the 2nd tax year following your last assignment (for example: last assignment in 2026, deletion on 31.12.2028); 12 months after the last exchange if there was no assignment | Migration authorities when a permit is applied for |
What the hiring company receives: your identity, your qualifications and your timesheets, to the extent necessary for the assignment. It receives neither your health data, nor your family data, nor your payroll file.
Authorities and institutions to which the law or the CCT Location de services requires us to disclose data: AHV compensation funds, the tax administration for withholding tax, occupational pension institutions, accident and daily sickness benefits insurers, family allowance funds, the joint bodies of the collective employment agreement for staff leasing, migration and labour market authorities (in Geneva in particular the OCPM, the OCE and the OCIRT; SECO), in particular during an inspection.
Assignment with a client established abroad. We send a client established outside Switzerland only what the assignment requires, normally your identity, your qualifications and your timesheets. We never send it your full payroll file, your family data or your health data by default. Two separate conditions apply before any transfer:
- your written consent, as required by the OSE, obtained before the transfer, stating the country concerned;
- appropriate safeguards, normally contractual and agreed with the client, where the country does not ensure an adequate level of protection according to the Swiss Federal Council (section 13). Your consent does not replace these safeguards.
What is mandatory. The data needed for the employment contract and social insurance is mandatory: without it, we cannot employ you.
6. Your family members
This section is addressed to the family members of a consultant employed by SPTS: their spouse or registered partner, their children and, for a minor child, the child's legal representative, as well as the person they designate as emergency contact. It tells you why we process your data, to whom we disclose it and how long we keep it.
Where your data comes from. The consultant provides it to us, because certain employer obligations require it. We ask the consultant to point you to this page; it is published here so that you can read it directly.
| Person | Data | Purpose | Recipients | Retention period |
|---|---|---|---|---|
| Spouse or registered partner | First name, last name, date of birth, residence permit, gainful activity | Determining the consultant's withholding tax tariff | Tax administration responsible for withholding tax | Like the consultant's salary records: 10 years after the end of the calendar year |
| Children | Name, date of birth, education | Family allowances, withholding tax tariff | Family allowance fund; tax administration responsible for withholding tax | 10 years after the end of the calendar year |
| Emergency contact | Name, relationship to the consultant, phone | Informing someone in the event of an accident or emergency | None | Until the end of the consultant's last assignment |
This data is stored in our application, with the providers described in section 12, with the same protections as the consultant's file. It is never disclosed to the hiring company.
You have the rights described in section 15, which you can exercise yourself or, for a minor child, through the child's legal representative.
7. Sensitive data
The law gives certain data special protection. We process two categories:
- Health data: medical certificates, accident reports, daily allowance statements, maternity leave. It is used only to pay the salary and allowances and to report the case to the insurer.
- Criminal or administrative proceedings: these may appear in the result of a check (section 8), where they have been published.
Restricted access. This data is accessible only to SPTS administrators who need it for your file. It is stored in our application's database, in Germany. Check reports and photos are not visible in the consultant and client portals; every consultation of a report is recorded in a log, and a report cannot be deleted or altered directly. Do not send us health data by email or WhatsApp: use your portal.
8. Background checks
Before establishing the contracts, and while they are performed, we carry out the customary checks required on consultants and client companies, using publicly available information and official sources.
- Your written consent, first. We carry out no check, and send no data for that purpose, before obtaining your written consent, as required by the OSE. The text you accepted, its date and its language are recorded. This consent takes the form of a box you tick in your assignment onboarding form, through your personal link. If your file is set up outside our portal, we obtain this consent by other means, always before the check.
- Only what is relevant to the job. The checks cover what is necessary and relevant for the intended job and assignment (art. 328b CO).
- A documented search. Only your first name, surname, town, year of birth, position and the company of the assignment are used. Never your AHV number, IBAN, address, phone number, email address, marital status, nationality or permit. Each item in the report shows its source, its address and the date it was consulted.
- What is not searched for. Neither your personality, nor your lifestyle, nor your personal relationships. No inference is drawn from your name, origin, or any assumed religion or appearance. Closed social media profiles stay closed, and no non-public database is consulted.
- Human review. The report is prepared with the help of an artificial intelligence tool (section 12). An SPTS administrator reads it, with its sources, before any decision. The report flags what needs checking; it decides nothing.
- No automated decision. No decision based solely on automated processing is taken about you.
- The right to explain yourself. If an item could count against you, we ask you about it before deciding. A namesake or outdated information is corrected this way.
- Retention: until the end of the 2nd tax year following your last assignment; 12 months if there was no assignment.
Client companies. The check concerns the company: its legal name, address, IDE and commercial register entry, compared with what we know about it. We do not send Anthropic the names of its contact persons where they are not needed for this check. We disclose it only to check the signing authority of the person who signs the contract.
9. Contacts at client companies and partner agencies
| Data | Purpose | Retention period | Recipients and countries |
|---|---|---|---|
| Name, position, email address, phone of contact persons and signatories; access to the client portal | Concluding and performing staff leasing contracts and partnership agreements, invoicing, approving timesheets | Contracts and invoices: 10 years after the end of the calendar year; other contact details: 2 years after the end of the business relationship | No one outside the company itself; application providers (section 12) |
| Company data for its check (section 8); a contact person's name only where it is needed | Checking the company before and during the relationship | Same as the check report | Anthropic (United States), for the search; the report remains internal |
10. Employees of client companies under payroll services
Where a company remains the employer of its employees and entrusts us with preparing their payroll, that company is the controller. SPTS processes the data on its instructions, including to prepare the employer's declarations, as processor (art. 9 LPD).
A data processing agreement, concluded with the engagement, covers at least the employer's instructions, confidentiality, security measures, sub-processors, transfers abroad, the notification of incidents, the assistance SPTS provides to the employer, and the return or deletion of the data at the end of the engagement. SPTS keeps a record of the processing activities it carries out on behalf of its clients.
| Data | Purpose | Retention period | Recipients and countries |
|---|---|---|---|
| The data the employer sends us: identity, AHV number, marital status, children, permit, salary, absences, bank details and, where necessary, medical certificates | Preparing payslips, social insurance declarations, withholding tax and salary certificates, on the employer's behalf | Set by the employer and the data processing agreement; at the end of the engagement, return or deletion, and retention by SPTS only of the copies it is required by law to keep | Institutions designated by the employer (funds, insurers, tax administration); the providers of our application (section 12) |
If you are an employee of a client company, send your requests about your data to your employer. If you write to us, we forward your request to them.
11. Who does what: controller or processor
| Situation | SPTS | Other party |
|---|---|---|
| Visitors, people requesting a simulation, people who write to us by WhatsApp, candidates | Controller | Technical providers: SPTS's processors; Meta, for WhatsApp, under its own terms |
| Consultants in staff leasing and payrolling, and their family members | Controller, as employer | Hiring company: controller for the data it receives to direct the assignment. Authorities, funds and insurers: controllers of their own processing |
| Consultants introduced by a partner agency | Controller from the moment the consultant is introduced | Agency: controller of its own processing, before and during the collaboration |
| Contacts at client companies and agencies | Controller | |
| Clients' employees under payroll services: processing on the employer's instructions, including its declarations | Processor (art. 9 LPD) | Client employer: controller |
| Payroll services: invoicing of the engagement and the employer's contacts | Controller |
12. Our service providers and artificial intelligence
Our providers are bound by a data processing agreement (art. 9 LPD) and may use the data only for the service they provide to us.
| Provider | Role | Data concerned | Country |
|---|---|---|---|
| Winbiz | Payroll and accounting | Consultants' payroll data | Switzerland |
| Google Workspace | Email and document storage | Correspondence and documents | European Union |
| Vercel | Hosting the site and running our application | All data passing through the application; its logs are redacted of personal data | Germany (Frankfurt) |
| Supabase | Database, authentication and file storage for our application | All application data, including uploaded documents, contracts, photos, health data and check reports, kept for the periods stated on this page | Germany (Frankfurt) |
| Resend | Sending and receiving our application's emails, in particular to consultants and clients | Content and attachments of these emails | Ireland |
| Anthropic | Assistance with checks and photo search (artificial intelligence) | For a consultant: first name, surname, town, year of birth, position, company of the assignment. For a company: legal name, address, IDE; a contact person's name only where it is needed | United States |
| WhatsApp (Meta) | Practical exchanges with people who choose this channel (section 4) | Number, profile, messages and metadata | Outside Switzerland, in particular United States |
| Google Drive | Backing up WhatsApp conversations | Messages and files exchanged by WhatsApp | Outside Switzerland, in particular the United States |
| Google Analytics | Audience measurement, only with your consent | Measurement identifier and browsing data | Collection in the European Union, storage in the United States |
Artificial intelligence. We use Anthropic's Claude API for two purposes only: preparing the check report (section 8) and suggesting a profile photo found on a public page. In both cases, a person at SPTS checks the result: they read the report and its sources before any decision, and no photo is recorded unless an administrator has approved it, with the address of its source. Our staff are not allowed to upload your documents to a consumer artificial intelligence assistant or to an online converter.
Our application uses no other service: no tracking tool, fonts served by the application, electronic signature developed by SPTS.
13. Transfers abroad
| Country | Safeguard |
|---|---|
| Germany, Ireland and other European Union states | Countries whose legislation ensures an adequate level of protection according to the Swiss Federal Council (annex 1 OPDo) |
| United States, Google (audience measurement, WhatsApp backups) | Google LLC is certified under the Swiss-U.S. Data Privacy Framework, which the Swiss Federal Council recognises as ensuring an adequate level of protection for certified companies |
| United States, Anthropic | We have not found any certification of Anthropic under this framework. The transfer is based on the contract concluded with Anthropic Ireland, which includes standard contractual clauses and an addendum for Switzerland |
| Resend, a company established in the United States | The data is processed in Ireland; Resend's data processing agreement includes standard contractual clauses for Switzerland |
| WhatsApp (Meta) | The service is provided in Switzerland by WhatsApp Ireland Limited. Transfers to the United States rely on Meta Platforms, Inc.'s certification under the Swiss-U.S. Data Privacy Framework, which the Federal Council recognises as ensuring an adequate level of protection for certified companies |
| Country of a client established abroad | Your written consent, obtained before the transfer (section 5). Where the country does not ensure an adequate level of protection, appropriate safeguards agreed with the client, normally contractual. General consent is not used as an ordinary transfer mechanism |
You can ask us for a copy of the safeguards applicable to a transfer, at portage@spts.ch.
14. Security
We protect data with appropriate technical and organisational measures, in particular:
- personal accounts, and access limited to what each person needs;
- separate consultant and client portals: each user sees only their own documents;
- two-factor authentication on our email service;
- encrypted connections, and data encrypted at rest with our providers;
- a log of actions in our application, and an access log for check reports;
- daily backups of our application's database;
- the duty of confidentiality of all our staff, during and after their contract.
If a data security breach is likely to result in a high risk to your rights, we report it to the FDPIC as soon as possible and inform you where this is necessary for your protection or the FDPIC requires it.
15. Your rights
You can:
- find out whether we process data about you, which data, and obtain a copy (right of access), including the check report that concerns you;
- obtain your data in a common electronic format, where the law provides for it;
- have it corrected if it is inaccurate;
- request its deletion, unless the law requires us to keep it (for example salary records, for 10 years);
- object to processing;
- withdraw consent you have given, for example to audience measurement, without affecting what was done before;
- and, if you are affected by a decision based solely on automated processing, put forward your point of view. We do not take any such decisions.
How. Write to portage@spts.ch, or by post to the address in section 1. We may ask you for the information needed to verify your identity; in principle, a request sent from the email address we know is enough, and we do not require a copy of an identity document by default. We reply free of charge, normally within 30 days; if that is not possible, we tell you when you will receive our reply.
These rights apply within the limits set by law, in particular where a legal obligation requires us to retain certain data, or where the reply would reveal a third party's data.
You may also contact the Federal Data Protection and Information Commissioner (FDPIC) (opens in a new tab).
16. Status of this page and changes
This policy provides information about our processing of data; it does not form part of any contract. The processing needed to perform a contract is described here and, where applicable, specified in that contract.
Data may be kept beyond the periods stated if it is needed to defend our rights in ongoing proceedings.
We update this page when our processing or the law changes. The date of the last update and the version are shown below. This page is published in French and English; in the event of any discrepancy, the French version prevails.
Last updated: 21.10.2026 · Version 1.0
Previous versions: none.