Privacy Policy

1. Controller and scope

The controller responsible for processing personal data is CV-EXPRESS, operated by Samuel Bebi, Schwarzhaar 39, 4665 Oftringen, Switzerland. Contact for privacy matters: support@cv-express.ch.

This policy applies to https://cv-express.ch. It is based on the Swiss Federal Act on Data Protection (FADP) and its ordinance (FADO). To the extent the GDPR applies, in particular when offering services to persons in the EEA, its provisions apply in addition.

2. Data processed

Depending on use, we process: contact and identity data (name, email, phone, address), CV content (work experience, education, language skills, competencies, free text), optional photo and signature files, chosen languages and design options, technical log data (IP address, timestamp, browser/device information, security and error messages), and payment and transaction data.

CV content may allow inferences about career history and other personal circumstances. Please do not enter particularly sensitive data unless strictly necessary.

3. Purposes and legal bases

We process data to create the CV, translate it, generate a PDF, optionally send it by email, process payments, and prevent misuse and technical errors. Under the GDPR, depending on the case, we base processing on contract performance or pre-contractual measures, legitimate interests in secure operation and abuse prevention, consent, or legal obligations.

4. Local drafts, PDF and email

The draft is stored in the browser and can be deleted via browser settings or the "Create new CV" function. For translation, PDF creation and delivery, the necessary content is transmitted to server-side services. The PDF service generates the file exclusively in memory. CV-EXPRESS does not permanently store finished PDFs, CV content, photos or signatures. Downloading again requires a new creation by the user. Email and delivery data is processed only to the extent technically required for sending.

5. Recipients and processors

Depending on the activated function, data may be transmitted to the following recipients or processors: Infomaniak for hosting and infrastructure in Geneva, DeepL for translations, Infomaniak as SMTP email provider for delivery, and Payrexx AG, Burgstrasse 20, 3600 Thun, Switzerland, for the payment process. Payrexx processes payment data under its own terms; CV-EXPRESS does not receive complete card or account data.

Processors may process data only within the scope of the contractually agreed service.

6. International data transfers

The following recipient countries are relevant for the services used: Infomaniak (hosting, SMTP delivery) processes exclusively in Switzerland. DeepL SE processes translations in Germany (EU/EEA). Payrexx AG processes the payment process in Switzerland. For embedded web resources — Google Fonts (Google LLC) and the CDN delivery of Font Awesome (Cloudflare, Inc.) — a technical transfer to the USA cannot be ruled out; both providers are certified under the EU-US Data Privacy Framework, which provides an adequate level of data protection. For Switzerland, the corresponding adequacy decision of the Federal Council regarding the Data Privacy Framework applies.

7. Retention

Browser drafts generally remain until deleted by the user or until the respective browser storage ends. CV content, photos and PDF files are not stored server-side. Technical security logs are retained only as long as necessary for operation and abuse prevention. Payment and booking records are retained for the statutory retention period, generally ten years in Switzerland.

8. Cookies, external resources and security

CV-EXPRESS does not use advertising or profiling cookies. Technically necessary browser storage serves the draft. External fonts from Google Fonts and icons via the Cloudflare CDN may receive technical data such as the IP address when the page is accessed (see section 6 on international data transfers).

We take appropriate technical and organizational measures, in particular HTTPS, access restrictions, server-side secrets, rate limits, and minimal data retention. However, complete security of data transmission cannot be guaranteed.

9. Your rights

To the extent legal requirements are met, you may request access, rectification, erasure, restriction or provision of your data, and object to processing. You may withdraw consent for the future. Requests should be sent to support@cv-express.ch. Under the GDPR, you also have a right to lodge a complaint with the competent supervisory authority. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible.

10. No automated individual decisions

CV-EXPRESS does not make automated individual decisions with legal or similarly significant effect. Machine translations are an aid and are not used to evaluate individuals.

11. Changes

We may amend this policy if functions, service providers or the legal situation change. The version published at any given time is decisive.