Privacy policy

Download as PDF

Version dated 5 November 2026

This privacy policy explains which personal data Dominique Raffray Consulting processes, for what purposes and for how long – and what rights you have. It applies to the websites raffray-consulting.com and raffray-consulting.ch, to enquiries and appointment bookings, to collaboration with clients and partners, and to candidates whom I approach or interview. It is governed by the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR); for tradeSPPRT GmbH, by the GDPR and the Austrian Data Protection Act (DSG).

1. Controllers

Dominique Raffray Consulting operates through two companies. The controller is the company that concludes the contract with the client – for the data of its own clients and of the individuals it approaches and interviews on their behalf:

• Dominique Raffray GmbH, Hinterdorfstrasse 6, 6390 Engelberg, Switzerland
• tradeSPPRT GmbH, Gföll 201, 5091 Unken, Austria

Dominique Raffray GmbH is the controller for the website and for general enquiries. Contact for both companies: Dominique Raffray, Managing Director · dr@raffray-consulting.ch · +41 78 883 08 84

2. Which data I process

• Enquiry and booking data: name, company, email address, telephone number, subject and appointment, when you write to me or book an initial consultation via Microsoft Bookings.
• Data of business clients and partners: names, functions and contact details of your contact persons, contract and invoicing data, project correspondence.
• Candidate data: name, contact details, career history, qualifications, CV and documents you provide to me, information from publicly accessible professional sources (e.g. company websites, professional networks), notes from interviews and my assessment.
• Website data: technically necessary data such as IP address, browser and time of access (server log files).

Sensitive data. In interviews, I do not ask about health, religion, political opinions or comparable data. If you raise such topics yourself, I record them only where this is strictly necessary for the assessment and you have given your express consent.

3. Why I process data

• responding to enquiries, scheduling appointments and initial consultations (pre-contractual measures; Art. 6(1)(b) GDPR);
• performing and invoicing engagements with business clients (contract; Art. 6(1)(b) GDPR);
• approaching candidates personally on behalf of a client, conducting interviews and preparing assessments (legitimate interest in filling positions or recruiting members; Art. 6(1)(f) GDPR);
• passing on your profile and my assessment to a specific client – only with your consent (consent; Art. 6(1)(a) GDPR);
• complying with statutory retention obligations, e.g. accounting (legal obligation; Art. 6(1)(c) GDPR);
• secure and stable operation of the website (legitimate interest; Art. 6(1)(f) GDPR);
• analysing website use with Google Analytics, only with your consent (Art. 6(1)(a) GDPR).

I do not use your data for advertising, I do not sell it, and I do not make automated decisions about individuals. I use AI tools, if at all, only for research and preparation – never to assess candidates.

4. Information for candidates

• Source of the data: If I approach you, your contact details come either from my client (e.g. a referral from its network) or from publicly accessible professional sources. When I first contact you, I tell you where I obtained your data and on whose behalf I am contacting you – at the latest within one month.
• Not interested? A brief “No, thank you” is sufficient. I will then delete or block your data so that you are not approached again.
• Disclosure: Your profile and my assessment are passed only to the client for whom the interview was conducted, and only with your consent. Without your consent, no one receives your documents.
• Confidentiality: I treat interview content as strictly confidential – including with respect to your current employer.

5. Service providers I use

For certain tasks, I use carefully selected service providers. They process data only on my behalf and for the purposes stated.

Service	Purpose and provider
Microsoft 365 (Teams, Bookings, Outlook)	Video conferencing for interviews and meetings (Microsoft Teams), online appointment booking (Microsoft Bookings: name, contact details, company, subject, appointment) and calendar. Provider: Microsoft Ireland Operations Ltd., Dublin, Ireland; parent company Microsoft Corporation, USA. A transfer to the USA is possible; it is based on the Data Privacy Framework (EU–US and Swiss–US) or standard contractual clauses. Interviews are not recorded.
STRATO	Website hosting: operation of the website and storage of server log files. Provider: STRATO GmbH, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany; servers in Germany.
DomainFactory	Email for correspondence and documents. Provider: DomainFactory GmbH, Neuturmstrasse 5, 80331 Munich, Germany; storage on servers in the EU.
LinkedIn	Research of publicly accessible professional profiles and initial contact. Provider: LinkedIn Ireland Unlimited Company, Dublin, Ireland; possible transfer to the USA (Data Privacy Framework).
Google Search Console / Google Analytics	Analysis of search visibility (Search Console) and website use (Analytics – only with your consent via the cookie banner). Provider: Google Ireland Ltd., Dublin, Ireland; possible transfer to the USA.

6. Transfers abroad

Data is generally processed in Switzerland and the EU/EEA. With Microsoft 365, LinkedIn and Google, data may be transferred to the USA. For companies certified under the Data Privacy Framework, the USA is regarded as providing an adequate level of data protection; otherwise, I rely on standard contractual clauses. With their consent, I also pass candidate profiles to clients in other countries where the engagement requires it.

7. Cookies and fonts

The website uses technically necessary cookies and – only with your consent – analytics cookies from Google Analytics. We obtain your consent on your first visit via a cookie banner, where you can withdraw or adjust it at any time. No advertising cookies are used. Google Analytics is operated with shortened IP addresses. Fonts are loaded locally from our own server, not from Google.

8. How long I retain data

• Accounting records (contracts, invoices, payments): 10 years, as required by law.
• Candidate data: up to 6 months after the end of the respective selection process, after which it is deleted – unless you consent to my retaining your profile for longer for future suitable positions (no more than 2 years, revocable at any time).
• Enquiries not followed by an engagement: 12 months after the last contact.
• Appointment data in Microsoft Bookings: 12 months after the appointment.
• Data of contact persons at clients: for the duration of the business relationship and thereafter to the extent required by law.

9. Data security

I protect your data with appropriate technical and organisational measures, in particular encrypted transmission, password-protected and encrypted devices, and access by me alone.

10. Your rights

You have the right to information about your data and its source, and to rectification, erasure, restriction of processing, data portability and objection to processing – in particular to being approached as a candidate. You may withdraw any consent you have given at any time with effect for the future. To do so, please contact dr@raffray-consulting.ch.

You may lodge a complaint with a supervisory authority – in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the data protection authority of your country of residence.

11. Representative in the EU

The following has been appointed as representative in the European Union pursuant to Art. 27 GDPR: tradeSPPRT GmbH, Gföll 201, 5091 Unken, Austria, dr@raffray-consulting.ch.

12. Changes

I update this privacy policy when my services or the service providers I use change. The version published on the website at the time applies.

This English version is provided for information. In the event of any discrepancy, the German version shall prevail.