Privacy Policy
1. Introduction
At Bhaasha Sàrl (we, our or Bhaasha), we recognize the importance of your privacy and of transparency.
This privacy notice (Privacy Notice) describes how we process your personal data when you interact with our digital solutions, including our website accessible at https://www.bhaasha.ch (the Website) and our interpretating platform accessible through the Website or as a mobile app on regular app stores (the Platform, and together with the Website, the Solutions), and the services we provide though the Solutions (together with the provision of the Solutions, our Services).
Unless otherwise specified, the content of this Privacy Notice applies to all our Solutions.
By using our Services, you expressly acknowledge that we may process your personal data in accordance with this Privacy Notice.
2. Short Version
The following is a summary of (but not a replacement for) this Privacy Notice:
➢ Our role. We, Bhaasha Sàrl, are responsible for the processing, as controller, of your personal data (but only for our own activities and not those of third-party providers) (see section 3);
However, if we process your personal data to provide services to an organization, which is our customer for the Platform and to which you are affiliated (our Contractual Partner), for instance a community interpreting association, we will generally act as data processor for that Contractual Partner. You must refer to the privacy policy of the Contractual Partner to which you are affiliated for information about its processing activities (see section 7).
➢ Data we collect. We collect the information, which is provided to us by you or the Contractual Partner to which you are affiliated. We also collect some information automatically when you interact with the Services (see section 4);
➢ How we use it. We process your personal data in compliance with Swiss laws and other data protection laws applicable to us, such as the EU GDPR. This means that we will only process your information where we have a legal basis to do so (see sections 5), and only for certain reasons (mainly for providing our Services, operating our Solutions, and for the other legitimate purposes indicated in this Privacy Notice) (see section 6);
➢ Control and Access. Your personal data is stored in Switzerland. We apply controls and restric how data may be accessed outside of Switzerland (see sections 7 and 9);
➢ Retention. We do not store your personal data for longer than necessary for us to fulfill the purposes set out in this Privacy Notice (see section 10);
➢ Security. We apply security measures and strive to protect your personal data. However, no IT infrastructure is completely secure and we cannot guarantee that ours is (see section 11);
➢ Your rights. You may contact us (data@bhaasha.com) to exercise your rights pertaining to your personal data (see section 13).
3. Who is responsible for the processing of your personal data
Bhaasha Sàrl, Rue Galilée 7, 1400 Yverdon-les-Bains, is responsible for the processing, as controller, of your personal data. You will find our contact details below in section 14.
This Privacy Notice only applies to data processing undertaken by or on behalf of us. Whilst we may provide links to third party websites, contents, or services, we are not responsible for their policies in relation to personal data. In such circumstances, the collection and use of your personal data are governed by the privacy policy of those third-party providers, which you should carefully review to learn more about their personal data processing practices.
As further detailed in this Privacy Notice, we may process your personal data in connection with the Services we provide to the organization (e.g. a community interpreting association) which is our customer for the Platform and to which you are affiliated (our Contractual Partner). This Privacy Notice does not govern how the Contractual Partner to which you are affiliated processes your personal data through the Services. You must refer to the Contractual Partner’s policies. Please see section 7 below for additional information in this respect.
4. How we collect your personal data
We collect the personal data you provide to us.
We collect the personal data that you provide to us when using our Services, for example when you use our Solutions, communicate with us, when you create and/or manage your account, through web forms you fill, or when you subscribe to our newsletter. It is only mandatory that you complete the data fields identified as such. If one or more mandatory data fields are not completed, we will not be able to provide access to our Services. You are not required to complete the optional data fields in order to access our Services.
We also collect personal data from our Contractual Partners.
If you are affiliated to an organization to which we provide the Platform (our Contractual Partner) – for instance as employee or consultants of the Contractual Partner, community interpreters, or intercultural mediator – we will collect the information that is provided by such Contractual Partner.
Additional Information on the categories of personal data we collect this way:
The personal data we collect through our Contractual Partners includes: - surname, first name, birth name - date of birth, gender, ethnicity ; - address, telephone number and email address; - Spoken languages - Banking information - AVS information and residency status - Qualification and level of education - information about medical appointments, when this relates to the context of the interpreting service (e.g. interpreting services provided for a patient hospitalized at our Contractual Partner)
Certain personal data are also collected in an automated manner.
We also automatically collect personal data, including by means of tools, web forms, cookies and other active elements, as further described in this Privacy Notice.
You may define certain authorizations relating to the automatic collection of your personal data when you configure your device or your internet browser according to available functionalities. You may also define certain settings for the automated collection of your personal data through the cookies setting plugin available on the Solutions. For more detailed information, please see section 12 below.
5. How we use your data
We process your personal data in accordance with applicable laws and only if we have a valid legal ground to do so.
We process your personal data in compliance with applicable law, in particular Swiss data protection laws and, to the extent they apply to us, other data protection legislations, such as the EU General Data Protection Regulation (GDPR), manually or automatically using computer tools.
This means that we will only process your information for certain reasons (see Section 7) where we have a legal basis to do so.
Additional Information on the "legal basis"
Here is what each of these legal bases is:
§ Contractual Necessity: the processing is necessary to fulfil our contractual obligations to you or to take pre-contractual steps at your request. This is particularly the case in particular when processing your personal data is strictly required to provide you with the Services. When the GDPR applies, Contractual Necessity is based on Article 6(1)(b) GDPR.
§ Legitimate Interest: the processing is necessary for the fulfilment of our legitimate interests, and only to the extent that your interests or fundamental rights and freedoms do not require us to refrain from processing. When the GDPR applies, Legitimate Interest is based on Article 6(1)(f) GDPR.
§ Consent: we have obtained your prior consent in a clear and unambiguous manner. Consent given can be withdrawn at any time, but this does not affect data processed prior to withdrawal. When the GDPR applies, Consent is based on Article 6(1)(a) GDPR.
§ Legal Obligation: the processing is necessary to comply with our legal or regulatory obligations. When the GDPR applies, Legal Obligation is based on Article 6(1)(c) GDPR.
What about sensitive data?
In addition, we will only process your Sensitive Data if we have obtained your explicit consent for one or more specified purposes, or if we can rely on another lawful justification in accordance with applicable data protection laws.
What about the "processor position"?
When we act as processor for a Contractual Partner you are affiliated to, our processing of your personal data is governed by the agreement between us and the Contractual Partner (see section 7).
If we access your personal data because it was transmitted to us by one of our Contractual Partners (see Section 4 above), it is our Contractual Partner which is responsible for ensuring that your personal data is collected and transferred to us in accordance with all privacy and data protection laws of all relevant jurisdictions, based on an appropriate legal ground. Please refer to the privacy notice of the Contractual Partner to which you are affiliated for information about their processing activities.
Additional Information on profiling and automated decisions
We do not process your personal data to create a profile about you (profiling).
We also do not make decisions exclusively on the basis of an automated processing which have legal effects on the data subjects or affect them significantly (automated individual decision).
6. Why we use your data
We process your personal data for the following reasons:
To provide our Services and operate the Solutions.
We mainly process your personal data to provide the Solutions and the Services, including for creating and maintaining your user account, interacting with you, and other users (including for allowing other users to view your user's public content), processing your orders and payments, and providing you with the requested information and Services.
Legal basis: Contractual Necessity, Legitimate Interests
Additional Information
Videoconferencing system. The Platform offers an encrypted videoconferencing system to facilitate distance interpreting sessions. We do not have access, nor record, the content of the videoconference.
Contacting you and responding to your queries. You have the option of contacting us via the Solutions. In this context, we process the data which you provide to us (including your contact information and the subject-matter of the request). This data is used for the purpose of providing you with the requested information and services.
Processing request for interpreter services and payments. We may enable you to request the services of an interpreter through the Platform. In such case, you must provide the information required from you to carry out the transaction (e.g. contact information, billing and delivery addresses, payment method and related information).
We use third-party services for payments. For example, depending on the payment method selected, you will be redirected to the website of an online payment provider which is responsible for processing the payment. We transmit to these third parties only the data necessary for the operations they perform.
We are required by law to store certain information such as invoices, contracts and other information relevant to accounting for a certain period of time (generally for 10 years).
For our legitimate business interests related to the provision of the Services, including to ensure the security of the Services, improve our Services, as well as for monitoring or statistical purposes.
We may also process your personal data for our legitimate business operations related to providing our Services, which include (i) ensuring that our Services are provided in an efficient and secure way (e.g. through internal analysis of the Services’ stability and security, updates and troubleshooting); (ii) protecting the security of our IT systems, architecture and networks; (iii) benefiting from cost-effective services (e.g. we may opt to use certain services offered by suppliers rather than undertaking the activity ourselves); and (iv) improving and developing the Services (including monitoring the use of our Services, and for statistical purposes)).
Legal basis: Legitimate Interests, Consent
Additional Information
Additional information on the processing of your personal data for our legitimate business operations:
Ensuring that our Solutions are provided in an efficient and secure way. In addition to the personal data which you or a Contractual Partner provide when logging-in to your account or interacting with the Solutions (e.g. when you fill in forms ), we automatically collect technical information about your interactions with the Solutions, such as IP address, the content that was accessed, date and time of access, information about your web browser, your preferences, or other information related to your interaction with the Solutions, including your navigation details on the Solutions.
We process this data to establish a connection with your device over the internet, to identify you when you use the Solutions, control the use of the Solutions and for security purposes.
Protecting the security of our IT systems, architecture and networks. We use data to protect the security of our IT systems, architecture and networks, for instance to detect and disrupt the operation of malicious software by systematically scanning contents in an automated manner.
Improving our Services. We may process your personal data, in particular data relating to your use of our Services and your habits and preferences (e.g. the content you accessed, date and time of access and your preferences), for internal analysis and statistical purposes, in order to better understand the needs of our users, and in general to improve the ergonomics and functionality of our Services. You may object to such processing activities at any time (see section 13 below for additional information on your rights).
We do not link this information to you or your account.
You will find additional information in section 12 in relation to the use of cookies for this purpose, including on the duration for which data collected this way are stored.
Data anonymization. We may combine your personal data with other information (aggregate) or erase any information that allows us to identify you (anonymize), so that it is no longer considered personal data under applicable data protection law, in which case this Privacy Notice will no longer apply and we may use such data for purposes not contemplated by this Privacy Notice (e.g. for benchmarking or analytics purposes, or to develop and market new services). You may object to the anonymization or aggregation of your personal data for this purpose at any time (see section 13 below for additional information on your rights).
To send you our newsletter and other information.
If you subscribe to our newsletter, we will collect your contact details (name and email address) and use it to provide you with our newsletter. You may unsubscribe from the newsletter service at any time, in which case your contact details will be deleted.
Legal basis: Consent
We also process the time of registration and your opt-in confirmation to demonstrate compliance. We also analyze your use of our newsletter, e.g. whether you have opened it or clicked on certain links, and process this data to optimize and improve our newsletter.
Legal basis: Legal Obligation; Legitimate Interests
We use the third-party services of Squarespace to provide our newsletter service, which will have access to your login data in order to provide you with the service. The privacy policy of Squarespace is applicable in connection with this, which you will find here.
Independently from your subscription to our newsletter, we may contact you by email to inform you about our activities if you have previously subscribed for the use of our Services, if you have not objected to the corresponding use of your email address. You can object to the use of your email address for this purpose at any time by contacting us (see contact detail in section 14).
Legal basis: Legitimate Interest
To comply with our other legal obligations or for other legitimate interests.
We may further process your personal data if we have a legal obligation to do so or for other legitimate interests. This will for instance be the case if we need to disclose certain information to public authorities or retain such information for tax or accounting purposes, or for the establishment, exercise or defense of legal claims.
The personal data that we process for this purpose are those that we collected for one of the purposes indicated elsewhere in this section 6. We retain the personal data for the duration of the legal obligation imposed on us.
Legal basis: Legal Obligations, Legitimate Interests
7. Our Operations with our Contractual Partners
If you are associated with a Contractual Partners to whom we provide our Platform (for instance a community interpreting association to which you are affiliated, which hired us to use our Platform), or if we process for any other reason your personal data on behalf of such Contractual Partner (e.g. if your personal data is provided to us by our Contractual Partner), please read the following:
In the situations described above, our processing of your personal data is governed by a contract between us and our Contractual Partner. We will process your personal data as data processor for the provision of our Services to our Contractual Partner, or in some cases, as a controller for our legitimate business operations related to providing those Services, as detailed in this Privacy Notice.
This Privacy Notice does not address how the Contractual Partner collects and uses your personal data or how we process your data when we act as processor for our Contractual Partner. Please refer to the privacy policy of the Contractual Partner to which you are affiliated for information about its processing activities.
Some information about you may be provided to us directly by our Contractual Partner. If this is the case, it is such Contractual Partner which is responsible for ensuring that your personal data is collected and transferred to us in accordance with all privacy and data protection laws of all relevant jurisdictions, based on an appropriate legal ground. In particular, the information which is provided to us
If you would like to make any requests or queries regarding our processing of your personal data on behalf of our Contractual Partner, please contact the Contractual Partner directly. For example, if you wish to request to access, correct, amend, or delete inaccurate personal data that was originally transmitted by the Contractual Partner, please direct your query to the Contractual Partner. If we are requested by the Contractual Partner to remove your personal data, we will respond to such request in a timely manner upon verification and in accordance with applicable law (for example, 30 days under Swiss law or the GDPR).
If you have questions about our legitimate business operations in connection with providing Services to our Contractual Partners, please contact us as described in section 14.
8. The circumstances in which we share your personal data with third parties
We will only share your personal data with third parties if this is necessary for the operation of our Services, if there is a legal obligation or permission to do so, or if there is another valid reason to do so.
Additional Information
Our service providers. We may share your personal data with third parties in connection with the operation of the Services and with subcontractors such as cloud or IT service providers, and consultants.
Public information. Your personal data may also be made available to other users of the Services or to third parties to the extent necessary for the proper operation and provision of the Services, for example for the purpose of enabling users to interact. In particular, the Solutions allows users to share information publicly (e.g., via their public profile). We may either publish this information directly on the Solutions, or communicate it by any other means, in particular by email.
Legal Obligation. We may also disclose your personal data where we have a legitimate interest in doing so, for example (i) to respond to a request from a judicial authority or in accordance with a legal obligation; (ii) to bring or defend against a claim or lawsuit; or (iii) in the context of restructuring, in particular if we transfer our assets to another company.
9. International Transfers
We store your personal data on servers located in Switzerland.
In limited circumstances, our service provider may access personal data from aboard. This is for instance the case when you visit our Website and cookies are placed by U.S. service providers (see section 12 below for additional information on cookies). In such cases, we will ensure that suitable safeguards are in place, in accordance with applicable data protection laws, for instance by relying on standard contractual clauses adopted by the European Commission.
Moreover, the information accessible to the public or to other users on the Solutions may be accessed worldwide where users connect from.
If you transmit information and data to us, you are expressly deemed to consent to such data transfers. You may request additional information in this regard and obtain a copy of the relevant safeguards upon request by sending a request to the contact address indicated in section 0 below.
10. How long we store your personal data
Your personal data will not be stored longer than necessary. We will erase or anonymize your personal data as soon as it is no longer necessary for us to fulfil the purposes set out in section 6 of this Privacy Notice. This period varies, depending on the type of data concerned and the applicable legal requirements. More information on each type of processing can be found in section 6 above.
Your account information is retained for as long as your account is active. If you suppress your user account, your account information will be deleted or anonymized within 30 days after such event, unless data must be retained for a valid reason (such as evidentiary or tax purposes). Please note that some information about you may have to be retained for the duration of our contractual relationship with the Contractual Partner to which you are affiliated, even if your account is terminated (see section 7).
In view of the legal obligations incumbent upon us, certain information relating in particular to the contractual relationship must be retained for at least 10 years.
11. Security
We are committed to the security of your personal data, and have in place physical, administrative and technical measures designed to keep secure your personal data and to prevent unauthorized access to it. We restrict access to your personal data to those persons who need to know it for the purpose described in this Privacy Notice. In addition, we use end-to-end encryption on video platform channel (this means that we cannot access the content of the conversations) with no recordings, and full encryption to all sensitive data related for instance to patients.
Although we take appropriate steps to protect your personal data, no IT infrastructure is completely secure. Therefore, we cannot guarantee that data you provide to us is safe and protected from all unauthorized third-party access and theft. We waive any liability in this respect.
The internet is a global environment. As a result, by sending information to us electronically, such data may be transferred internationally over the internet depending upon your location. Internet is not a secure environment and this Privacy Notice applies to our use of your personal data once it is under our control only. Given the inherent nature of the internet, all internet transmissions are done at your own risk.
If we have reasonable reasons to believe that your personal data have been acquired by an unauthorized person, and applicable law requires notification, we will promptly notify you of the breach by email (if we have it) and/or by any other channel of communication (including by posting a notice on the Solutions).
12. How we use cookies or other analytical tools
We and our third-party service providers use cookies and other similar technologies (Cookies) in connection with our Solutions in order for us to provide our Services and ensure that it performs properly, to analyze our performance and to personalize your experience, some of which are capable of automatically processing data on your electronic device and/or of transferring personal data about you to us or third parties.
You can learn more about how we use Cookies and similar technologies and how you can exercise control over them in our Platform Cookie Policy and Website Cooke Policy.
13. Your rights with regard to the processing of your personal data
You have the right to access your personal data we process and may request that they be removed, updated, or rectified.
If you are using a Service provided by a Contractual Partner to which you are affiliated, you should direct your privacy inquiries relating to our use of your personal data on behalf of our Contractual Partner, including any requests to exercise your data protection rights, directly to the Contractual Partner’s contact person.
In other cases, you may contact us directly to exercise your rights. Unless otherwise provided by law, you have the right to know whether we are processing your personal data, to know the content of such personal data, to verify its accuracy, and to the extent permitted by law, to request that it be supplemented, updated, rectified or erased. You also have the right to ask us to cease any specific processing of personal data that may have been obtained or processed in breach of applicable law, and you have the right to object to any processing of personal data for legitimate reasons.
By accessing your user account (if you have one), you can review, update, correct or delete the personal data available within your user account.
If you request us to delete your personal data from our systems, we will do so unless we need to retain your data for legal or other legitimate reasons. Please note that any information that we have copied may remain in back-up storage for some period of time after your deletion request.
Where we rely on your consent to process your personal data, we will seek your freely given and specific consent by providing you with informed and unambiguous indications relating to your personal data. You may revoke at any time such consent (without such withdrawal affecting the lawfulness of processing made prior to).
The above does not restrict any other rights you might have pursuant to applicable data protection legislation under certain circumstances.
Additional Information
In particular, if the GDPR applies to the processing of your personal data you have the following rights under the GDPR if the respective requirements are met:
Right of access (Art. 15 GDPR) - you have the right to access and ask us for copies of your personal data.
Right to rectification (Art. 16 GDPR) - you have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Right to erasure (Art. 17 GDPR) - you have the right to ask us to erase your personal data in certain circumstances.
Right to restriction of processing (Art. 18 GDPR) - you have the right to ask us to restrict the processing of your personal data in certain circumstances.
Right to data portability (Art. 20 GDPR) - you have the right to ask that we transfer in a structured, commonly used and machine-readable format the personal data you gave us to another organization, or to you, in certain circumstances.
Right to object to processing (Art. 21 GDPR) - you have the right to object to the processing of your personal data which is based on our legitimate interests, in certain circumstances. In such case, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms or where the processing is necessary for the establishment, exercise or defense of legal claims.
As a rule, you are not required to pay any charge for exercising your rights and we will respond to your request within one month.
You will find further details of your rights in sections 5 and 6 of this Privacy Notice in connection with each processing activity we perform. If you want to exercise any of your rights, or want additional information about them, please contact us using the contact details listed below (see section 14).
You have the right to lodge a complaint with the competent authority.
If you are not satisfied with the way in which we process your personal data, you may lodge a complaint with the competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, in addition to the rights described above.
Although this is not required, we recommend that you contact us first, as we might be able to respond to your request directly.
14. Contact Us
If you believe your personal data has been used in a way that is not consistent with this Privacy Notice, or if you have any questions or queries regarding the collection or processing of your personal data, please contact us at data@bhaasha.com.
15. Updates to this Privacy Notice
This Privacy Notice may be subject to amendments. Any changes or additions to the processing of personal data as described in this Privacy Notice affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you (including by email and/or via the Solutions, e.g. banners, pop-ups or other notification mechanisms). If you do not agree to the changes made, you must stop accessing and/or using the impacted Services.
____________________________________________
Last updated: [28.02.2023]