Rflect AG (hereinafter also referred to as "we", "us") obtains and processes personal data concerning you or other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data" or "personal information"
In this Privacy Notice, we describe what we do with your data when you use https://rflect.ch or our applications (hereinafter "Website"), purchase our services or products, are otherwise in contact with us under a contract, communicate with us or otherwise deal with us. If applicable, we will provide you with timely written notice of additional processing activities not mentioned in this Privacy Notice. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual terms and conditions, additional data protection notices, forms and notices.
If you transmit or disclose data about other persons to us we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed of this data protection notice.
This data protection notice is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the Swiss Data Protection Act ("DSG"). However, whether and to what extent these laws are applicable depends on the individual case.
Rflect AG, Zurich, is responsible under data protection law for the data processing by Rflect AG described in this data protection notice, unless otherwise communicated in individual cases,e.g. in further data protection notices, on forms or in contracts.
You can contact us regarding your data protection concerns and to exercise your rights in accordance with Section 11 as follows:
Rflect AG
c/o Jovanovic
Neunbrunnenstrasse 118
8050 Zurich
info@rflect.ch
We process various categories of data about you. The main categories are as follows:
Technical data: When you use our website or other electronic services, we collect the IP address of your end device and other technical data to ensure the functionality and security of these services. This data also includes logs that record the use of our systems. We generally retain technical data for 6 months. To ensure the functionality of these services, we may also assign you or your end device a customised code (e.g. in the form of a cookie, see Section. 12). The technical data itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your personal information).
Registration data: Certain offers and services can only be used with a user account or registration, which can be done directly with us or via our external login service providers. In doing so, you must provide us with certain data and we collect data on the use of the offer or service. Registration data may be collected during access controls to certain systems; depending on the control system, biometric data may also be collected. We generally retain registration data for 12 months after the end of service usage or the cancellation of the user account.
Communication data: If you contact us via the contact form, by e-mail, telephone, letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the ancillary data of the communication. If we record or listen in on telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will make you aware of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed if and when such recordings take place, e.g. by a notification during the relevant video conference. If you do not wish to be recorded, please let us know or end your participation. If you simply do not wish your image to be recorded, please switch off your camera. If we want or need to establish your identity, e.g. if you request information, apply for media access, etc., we will collect data to verify your identity (e.g. a copy of an ID card). We generally store this data for 12 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. Emails in personal mailboxes and written correspondence are generally stored for at least 10 years. Recordings of (video) conferences are generally retained for 24 months. Chats are generally retained for 2 years.
Master data: We define master data as the basic data that we require in addition to the contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorisations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. in the context of marketing and advertising). We receive master data from you yourself (e.g. when you make a purchase or register), from organisations for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the Internet. As a rule, we store this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons . In the case of pure marketing and advertising contacts, the period is normally much shorter, usually no more than 2 years from the last contact.
Contract data: This is data that arises in connection with the conclusion or processing of a contract, such as information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions (e.g. complaints or information on satisfaction, etc.). As a rule, we collect data from you, from contractual partners and from third parties involved in the fulfilment of the contract, as well as from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources. We generally store this data for 10 years from the last contractual activity, but at least until the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons.
Behavioural and preference data: Depending on the relationship we have with you, we aim to get to know you and customise our products, services and offers accordingly. To achieve this, we collect and use data about your behaviour and preferences. We do this by evaluating information about your behaviour in our environment, and we may also supplement this information with data from third parties, including from publicly accessible sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. when you use our services), or we obtain this data by recording your behaviour (e.g. how you navigate our website). We anonymise or delete this data when it is no longer relevant for the purposes pursued, which may be up to 24 months (for product and service preferences), depending on the type of data. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. We describe how tracking works on our website in Section 12.
Data collected and processed in our application including reflections: Through your interaction with our application, we collect data related to your (the student/learner’s) interaction with personal growth activities. These include your personal reflections, results of assessment data, perceived quality of your reflections, actions you defined in relation to these activities and other data used in the current and following personal development activities. The data which is in our services and is referred to as your private data is processed by Rflect as a controller. Other (anonymised) data that is called shared reflections is provided to third parties including institutions you are affiliated with.
We collect data about your affiliation with institutions through which you use our service (e.g. University, or your employer).
Other data: We also collect data from you in other situations. In connection with official or court proceedings, for example, data is collected (such as files, evidence, etc.) that may also relate to you. We may also collect data for health protection purposes (e.g. as part of protection concepts). We may receive or produce photos, videos and audio recordings in which you may be identifiable (e.g. at events, through security cameras, etc.). We may also collect data about who enters certain buildings and when, or who has the corresponding access rights (including in the case of access controls, based on registration data or visitor lists, etc.), who takes part in events or campaigns and when, or who uses our infrastructure and systems and when. The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and usually a few weeks for contact tracing data to visitor data, which is usually stored for 3 months, to reports on events with images, which can be stored for several years or longer.
Many of the items listed in this Section 3, you provide us with much of the data mentioned in this section yourself (e.g. via forms, as part of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, except in individual cases, e.g. as part of binding protection concepts (legal obligations ). If you wish to conclude contracts with us or make use of services, you must also provide us with data as part of your contractual obligation in accordance with the relevant contract, especially master data, contract data and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data. In the case of behavioural and preference data, however, you always have the option of objecting or not giving your consent.
Insofar as this is not unauthorised, we also obtain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, media or the Internet including social media) or receive data from other companies within our group, from authorities and from other third parties (such as credit agencies, address dealers, associations, contractual partners, Internet analysis services, etc.).
We process your data for the purposes explained below. Further information for the online area can be found in Section 12 and 13. These purposes and the underlying objectives represent legitimate interests of ourselves and, where applicable, of third parties. You will find further information on the legal basis of our processing in Section 5.
We process your data for purposes related to communication with you, particularly to respond to enquiries and assert your rights (Section 11) and to contact you in the event of queries. In particular, we use communication data and master data for this purpose and, in connection with offers and services used by you, also registration data. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for enquiries.
We process data for the establishment, administration and fulfilment of contractual relationships.
We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalised advertising about our products and services. This may take the form of e.g. newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have your contact information, but also as part of individual marketing campaigns. You can reject such contacts at any time (see at the end of this section) or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see Section 12).
We continue to process your data for market research, to improve our services and operations and for product development.
We may also process your data for security purposes and for access control.
We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations ("compliance").
We also process data for the purposes of our risk management and as part of prudent corporate governance, including business organisation and corporate development .
We may process your data for other purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes.
Insofar as we ask for your consent for certain processing (e.g. for the processing of particularly sensitive personal data, for marketing mailings, and for advertising control and behaviour analysis on the website), we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time with effect for the future by sending us a written notification (by post) or, unless otherwise stated or agreed, by email; our contact details can be found in Section 2. For the revocation of your consent in the case of online tracking, see Section 12. If you have a user account, you may also be able to withdraw your consent or contact us via the website or other service in question. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.
Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in it, in particular in order to fulfil the purposes described above in Section 4 described above and the associated objectives and to be able to implement corresponding measures. Our legitimate interests also include compliance with statutory provisions, insofar as this is not already recognised as a legal basis by the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and Switzerland). However, this also includes the marketing of our products and services, the interest in better understanding our markets and managing and further developing our company, including its operations, securely and efficiently.
If we receive sensitive data (e.g. health data, information on political, religious or ideological views or biometric data for identification purposes), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the necessity of processing for any legal proceedings or the enforcement or defence of legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately if necessary.
We may use certain personal characteristics of yours for the purposes set out in Section 4 based on your data (section Section 3) automatically ("profiling") if we want to determine preference data, but also to determine risks of misuse and security threats. Additionally, we may conduct statistical analyses or use this data for operational planning purposes. For the same purposes, we can also create profiles, i.e. we can combine behavioural and preference data, but also master and contract data and technical data assigned to you in order to better understand your interests and other personal attributes.
In both cases, we ensure the proportionality and reliability of the results and take measures to prevent any misuse of these profiles or profiling. If these processes could have legal consequences or significant disadvantages for you, we always provide for a manual review.
In connection with our contracts, the website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests and the other data protection requirements set out in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:
Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility (e.g. IT providers, mail order companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurance companies, debt collection companies, credit agencies or address verifiers). We use OpenAI, and/or similar artificial intelligence service providers to provide you additional value in supporting your personal development. For information on the service providers used for the website and apps, see Section 12. Our central service provider in the IT area is Amazon Web Services, OpenAI and Google.
Contractual partners including customers: This initially refers to customers (e.g. service recipients) and other contractual partners of ours, as this data transfer arises from these contracts. If you work for such a contractual partner yourself, we may also transmit data about you to them in this context. Recipients also include contractual partners with whom we cooperate.
Authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or authorised to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us on their own responsibility.
Our Partners including Universities: We share anonymized shared reflections with partners so we and they can improve their service offering and the functioning of their institutions. Additionally, they may carry out studies to identify patterns or for other purposes. In no case will the data be used for marketing purposes.
Other persons: This refers to other cases where the inclusion of third parties arises from the purposes in accordance with Section 4 (e.g. service recipients, media and associations in which we are involved or if you are part of one of our publications).
All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).
We reserve the right to disclose this data even if it concerns confidential data (unless we have expressly agreed with you that we will not disclose this data to certain third parties, unless we are legally obliged to do so). Irrespective of this, your data will continue to be subject to appropriate data protection even after disclosure in Switzerland and the rest of Europe. For disclosure to other countries, the provisions of Section 8. If you do not wish certain data to be passed on, please let us know so that we can check whether and to what extent we can accommodate you (Section 2).
We also allow certain third parties to collect personal data from you on our website and at our events. Insofar as we are not significantly involved in this data collection, these third parties are solely responsible for it. If you have any concerns and wish to assert your data protection rights, please contact these third parties directly. See Section 12 for details regarding the website.
As in No. 7, we also disclose data to other organisations. These organisations are not only located in Switzerland; your data may therefore be processed both in the EEA and in exceptional cases in any country in the world.
If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection standards (we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj? ), unless the recipient is already subject to a legally recognised set of rules to ensure data protection and if we cannot rely on an exception. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interest or if the fulfilment of a contract requires such disclosure, if you have given your consent or if the data in question has been made generally accessible by you and you have not objected to its use.
Please also note that data exchanged via the Internet is often routed via third countries. Your data may therefore be sent abroad even if the sender and recipient are located in the same country.
We process your data for as long as necessary to fulfil our processing purposes, to comply with statutory retention periods, to meet our legitimate interests in processing for documentation and evidence purposes, or if storage is technically required. Further information on the respective storage and processing periods can be found under the individual data categories in Section 3 or under the cookie categories in Section 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymise your data after the storage or processing period has expired as part of our normal processes. Data defined as private in our application will be deleted or anonymised within 12 months of the account deletion or explicit request for the deletion. Data which is shared with the institution may be subject to different deletion periods as defined by those institutions.
We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, safeguarding it against unauthorised or unlawful processing and mitigating the risks of loss, unintentional modification, unwanted disclosure, or unauthorised access.
Under certain circumstances, applicable data protection law grants you the right to object to the processing of your data, particularly for the purposes of direct marketing, profiling for direct advertising and other legitimate interests involved in processing.
To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:
The right to request information from us as to whether we process your data, and if so, which data;
The right to have us correct data if it is incorrect;
The right to request the deletion of data;
The right to obtain from us the personal data concerning you in a commonly used electronic format or to transmit those data to another controller;
The right to withdraw consent where our processing is based on your consent;
The right to receive, upon request, further information necessary for the exercise of these rights;
The right to object to automated individual decisions (Section 6) to express your point of view and to request that the decision be reviewed by a natural person.
If you wish to exercise the above rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by e-mail; our contact details can be found in Section 2. To prevent misuse, we must confirm your identity (e.g. with a copy of your ID card, if necessary).
You also have these rights vis-à-vis other organisations that cooperate with us on their own responsibility. Please contact them directly if you wish to exercise rights in connection with their processing. You can find details of our key cooperation partners and service providers in Section 7 and further information in Section 12.
Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly if necessary.
If you do not agree with our handling of your rights or data protection, please let us know. In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority in your country. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. You can contact the UK supervisory authority here: https://ico.org.uk/global/contact-us/. You can contact the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/de/home/deredoeb/kontakt.html. You can contact the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/de/home/deredoeb/kontakt.html.
We use various technologies on our website with which we and third parties engaged by us can recognise you when you use our website and, under certain circumstances, track you over several visits. We will inform you about this in this section.
In essence, we want to be able to distinguish between access by you (via your system) and access by other users so that we can ensure the functionality of the website and carry out analyses and personalisation. We do not want to draw conclusions about your identity, even if we can, insofar as we or third parties engaged by us can identify you by combining this with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognised as an individual visitor each time you visit the website, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called "cookie").
We use such technologies on our website and allow certain third parties to do the same. However, depending on the purpose of these techniques, we may ask for your consent before they are used. You can access your current settings when logged into Rflect here [link]. You can set your browser to block or mislead certain cookies or alternative technologies or delete existing cookies. You can also add software to your browser that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the heading "Data protection") or on the websites of the third parties listed below.
A distinction is made between the following cookies (technologies with comparable functions such as fingerprinting are also included here):
Necessary cookies: Some cookies are necessary for the functioning of the website as such or for certain functions. They ensure, for example, that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, consent given, the function for automatic log-in, etc.). These cookies have an expiry date of up to 24 months.
Performance cookies: In order to optimise our website and corresponding offers and to better tailor them to the needs of users, we use cookies to record and analyse the use of our website, possibly even beyond the session. We do this by using third-party analysis services. We have listed these below. Before we use such cookies, we will ask for your consent. You can revoke your consent at any time via the cookie settings here [link]. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.
Marketing cookies : We and our advertising contract partners have an interest in precisely targeting advertising, i.e. only displaying it to those we want to address. We have listed our advertising contract partners below. For this purpose, we and our advertising contract partners - if you consent - also use cookies with which the content accessed or contracts concluded can be recorded. This enables us and our advertising contract partners to display adverts that we can assume are of interest to you on our website, but also on other websites that display adverts from us or our advertising contract partners. Depending on the situation, these cookies have an expiry date of between a few days and 12 months. If you consent to the use of these cookies, you will be shown the relevant adverts. If you do not consent to these cookies, you will not see fewer adverts, but simply any other adverts.
We currently use offers from the following service providers and advertising contract partners (insofar as they use data from you or cookies set by you for advertising purposes):
Google Docs: Our website uses Google Docs from Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland). Google Docs allows us to dynamically provide you with content, such as embedded documents and forms, to improve our service and customise it to your needs. When you use Google Docs, data is transferred to Google. Data is usually transferred by calling up Google Docs elements, which establishes at least one connection to Google's servers. In order for Google Docs to function properly, Google must collect and store certain data from you. This includes the IP address of your device and information about your browser. Google may place cookies on your device in order to analyse user behaviour and, if necessary, display personalised content or advertising. The data collected by Google Docs may be passed on to Alphabet Inc, Google LLC and Google Ireland Limited. Further information on data protection and the cookie guidelines at Google can be found under the following links: Responsible use of business data and How Google uses cookies - Privacy Policy & Terms of Use - Google.
Google Fonts: Our website uses Google Fonts from Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) to display fonts attractively and uniformly. When you access a page, your browser loads the required web fonts from Google in order to display texts and fonts correctly. To do this, the browser you are using must connect to Google's servers. Google will then receive your IP address and possibly other data. The data collected by Google Fonts may be passed on to Alphabet Inc, Google LLC and Google Ireland Limited. Further information on data protection and Google's cookie policy can be found at the following links: Responsible use of business data and How Google uses cookies - Privacy Policy & Terms of Use - Google.
Friendlyanalytics.ch
Our website uses the analysis tool friendlyanalytics, offered by Friendly Technologies AG (accessible at friendlyanalytics.ch). This tool enables us to analyse the interactions of our visitors on the website anonymously in order to optimise our offer and user-friendliness. friendlyanalytics collects data such as the IP address (in anonymised form), the origin of the users, browsers used, pages visited and the duration and frequency of interactions on our website. Further information on data protection at Friendlyanalytics can be found here: Privacy policy of Friendly GmbH - Friendly.
We may operate pages and other online presences ("fan pages", "channels", "profiles", etc.) on social networks and other platforms operated by third parties and provide the services described in Section 3 and below about you. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presence and link this data with other data about you known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to control their platforms (e.g. which content they display to you).
We process this data for the purposes described in Section 4 in particular for communication, marketing purposes (including advertising on these platforms, see section 12) and for market research. You will find information on the relevant legal bases in Section 5. We may redistribute content published by you (e.g. comments on an announcement) ourselves (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms can also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).
For further information on the processing by the platform operators, please refer to the platforms' data protection notices. There you can also find out in which countries they process your data, which rights of access, erasure and other rights of data subjects you have and how you can exercise these or obtain further information. We currently use the following platforms:
LinkedIn: Here we operate the page: https://www.linkedin.com/company/rflect-ch. LinkedIn Ireland Unlimited Company, Ireland, is responsible for the operation of the platform for users from Europe. Together with Wilton Place, Dublin 2, Ireland, we are responsible for the data that is collected and processed when you visit our site to create "Page Insights". As part of Page Insights, statistics are compiled about what visitors do on our site (comment on posts, forward content, etc.). This is described at https://legal.linkedin.com/pages-joint-controller-addendum. It helps us to understand how our website is used and how we can improve it. We only receive anonymous, summarised data.
This data protection notice is not part of a contract with you. We may amend this data protection notice at any time. The version published on this website is the current version.
Last updated: 6th January 2025
Somebody from Rflect would run the course. For program directors who do not have the resources or experience to run the programs themselves. This includes all duties related to leading a course. The program will be run by a mutually agreed lecturer.
CHF 1’250
1 ECTCHF 2’250
2 ECTsCHF 3’250
3 ECTsCustomized support to help you run the program, from co-creating the content, joining sessions and feedbacking concrete experiences.
CHF 400
2 HoursCHF 1’500
10 Hours