Our Privacy Policy

Personal data refers to any information relating to an identified or identifiable natural person (“datasubject”), such as your name, address, phone number, or email address.

Special categories of personal data are used to describe a subset of personal data that is considered more sensitive and may include information such as race, ethnic origin, religion, sexual orientation, health information, and union membership. In Switzerland, these are considered “personal data requiring special protection” under the Swiss Data Protection Act (DSG).

We collect personal data about our employees, customers, suppliers, representatives of customers and suppliers, investors/shareholders, other stakeholders, and users of our websites. With regard to the collection of personal data in connection with our whistleblower system (“Speak-UpSystem”), please refer in particular to Section 3 of this Privacy Policy.

The types of personal data we may ask you to provide include, among other things, contact information (such as name, address, phone number, and email address), business-related information, photos, videos, and identification documents.

We collect your personal data for the following purposes:

- Talent management (e.g., to identify potential candidates, recruit and develop employees, etc.)

- Administration (e.g., employee administration, maintaining shareholder registers, etc.)

- Communication (e.g., with investors/shareholders, current and potential customers, other stakeholders, etc.)

- Understanding communication preferences: (e.g., as part of our customer engagement strategy, we use a method to better understand communication preferences. In doing so, we aim to ensure that our interactions and responses are tailored to our existing and potential customers in a way that promotes clear, effective, and mutually beneficial communication)

- Providing our services (e.g., to facilitate transactions, analyze and optimize operations, promote our offerings, handle complaints, manage contractual relationships, etc.)

- Procurement of services and products (e.g., to facilitate transactions, analyze markets, analyze and optimize our supply chain, manage contractual relationships, etc.)

- Monitoring the use of our systems and websites (e.g., to ensure secure and compliant use, to analyze and personalize the user experience, etc.)

The processing of your personal data for the purposes listed above is based on our legitimate interest in recruiting, selecting, and managing employees; engaging in credible and relevant communication; and developing our business. We may also process your personal data to comply with legal and regulatory requirements. In certain situations, we may also process your personal data based on your consent.

We reserve the right to withhold information or services from you if we are unable to identify you based on the information you have provided. While you have the right not to provide us with the requested information, doing so may limit our ability to assist you or fulfill your requests.

The following applies to Switzerland: Processing is carried out in accordance with the legal provisions of the DSG; the concept of “legitimate interest” is understood here in the sense of Swiss data protection law.

In accordance with ISS’s values and Code of Conduct, ISS’s business integrity is non-negotiable. We are committed to conducting our business in accordance with the law and high ethical standards. For this reason, we have established a whistleblower system, known as the “Speak Up” system, through which we may also process your personal data. For more information about the processing of your personal data—including the types of personal data processed, the purpose of the processing, the rights of data subjects, and more—please refer to our Speak Up Policy.

We generally collect personal data directly from you (unless you give us your consent to receive such data from third parties). We collect the personal data you provide to us through your use of our website, social media, telephone conversations with our representatives, the provision and administration of services to you, and in forms you complete or other correspondence.

If we receive personal data about you that we did not request and that is not relevant to the processing activities in question, we will delete this data or permanently anonymize it, unless required by law.

When you visit our website and consent to the use of cookies, a cookie is stored on your device. This is a small piece of information that is stored on your hard drive and tells us that your device has accessed our website. The cookie does not allow us to identify you directly. If you do not want us to use cookies, you can set your browser to reject them. If you consent to the use of cookies on our website, we process your personal data regarding how you use our website, and we use cookies to collect data from our website for the purpose of—and based on—our legitimate interest in understanding which of our pages are most popular and when the peak usage times are, along with other information such as Internet Protocol (IP) addresses, referring website addresses, application activity logs, and error logs, which help us improve the content and facilitate navigation on our website.

ISS uses Google Analytics or similar tools to obtain trend information about user interactions with our website, for system administration purposes, and to identify issues and improve the website. Google Analytics uses first-party cookies to report on visitor interactions. These cookies are used to store information such as the time of the current visit, whether the visitor has visited the website before, and which website referred the visitor to our site. For more information about Google Analytics, as well as links to Google’s privacy policy and a Google Analytics opt-out tool, please visit https://support.google.com/analytics in the Privacy and Security section.

No cookies controlled by ISS will be stored on your device unless you consent to it. An exception to this rule are cookies required for the website’s core functions. You can select a setting in your browser that allows cookies to be stored only with your consent. If you wish to accept only cookies from ISS, but not those from our service providers and partners, you can select the“ Block third-partycookies” setting in your browser. Generally, the Help function in your web browser’s menu will explain how to reject new cookies and disable cookies that have already been received. Detailed instructions on how to remove cookies can be found here:

Deleting Cookies in Internet Explorer
Deleting cookies in Google Chrome
Deleting cookies in Safari
Deleting cookies in Mozilla Firefox

In Switzerland, cookies that are necessary for the operation of the website (e.g., basic functions) may be used without separate consent.

Our website may contain links to third-party websites. Please note that the terms of the ISS Global Privacy Statement do not apply to external websites. If you would like to know how a third party handles your personal data, you must contact that third party and read its privacy policy.

We may disclose your personal data to third parties for the purposes set forth in Section 2. These third parties include: other business units, agents, external consultants, our third-party service providers and contractors (such as email providers, sales representatives, or support services), government agencies, including law enforcement, regulatory, and dispute resolution authorities (or other entities to which disclosure is required by law or court order), as well as any other persons or entities to whom you have authorized disclosure.

When we share your personal data with third parties who process personal data on our behalf, we take all reasonable measures to ensure that these third parties implement appropriate technical and organizational measures and are bound by confidentiality and legal obligations regarding the protection of your personal data. Any disclosure of your personal data is made in accordance with legal requirements. This means that such processing is governed by data processing agreements to ensure that personal data is not processed for purposes other than those explicitly specified, and to guarantee that our third parties adhere to appropriate security measures to protect your personal data.

We will not disclose your personal data to third parties located outside the country in which we received your data (if applicable) without your prior written consent, unless the disclosure is otherwise authorized or required by law or court order, as well as in the cases set forth below.

We may transfer your personal data within the ISS Group and to our operations or contractors outside the EU/EEA. However, such a transfer does not affect our obligation to protect your personal data in accordance with this Privacy Policy.

If your personal data is transferred outside the EU/EEA, ISS ensures an adequate level of security by transferring the data to countries recognized by the European Commission as having an adequate level of protection, or by entering into an appropriately structured contract between ISS and the non-EU/EEA entity receiving the data.

The following applies to Switzerland: Recipients may be located in Switzerland, the EEA/UK, and—depending on the IT/cloud services used—in other countries as well. If a country does not ensure an adequate level of data protection, we ensure protection through appropriate safeguards (e.g., contractual safeguards/standard contractual clauses and supplementary measures). The requirements of Swiss data protection law are decisive in assessing the adequacy of data protection.

ISS may use your personal data to provide you with information about our services and products or about products offered by third parties, provided that such information is relevant to you. With your express consent, we may share your personal data with such third-party organizations for specific marketing purposes.

Due to the nature of our business relationship, we may wish to use you as a reference when promoting our company to others. In such cases, we will ask for your explicit consent and will only share personal data to the extent that we have your consent.

You may ask us at any time not to contact you regarding products or services and not to share your data with others for this purpose by contacting us or, where applicable, by clicking the“Unsubscribe” buttonin our promotional emails.

The following applies to Switzerland: To the extent that we process personal data for marketing and informational purposes, we do so in accordance with applicable data protection and fair trading laws (in particular the DSG, UWG, and FMG). Marketing communications are sent only with the prior consent of the data subject (opt-in) or—to the extent permitted by law—within the framework of an existing business relationship, provided the recipient has not expressly objected (soft opt-in). Processing may be carried out using group-wide CRM and marketing tools to better understand the interests of data subjects and offer personalized information; data subjects have the option at any time to object to the continued use of their data (opt-out), by clicking the unsubscribe link in the email or by sending a message to marketing@ch.issworld.com.

We store your personal data in paper-based and/or electronic files and records. We have implemented the security measures required by law to protect the personal data we process from misuse, disruption, loss, unauthorized access, alteration, or disclosure. ISS has implemented a range of technical security measures. These include a series of system and communication security measures, as well as the secure storage of paper documents and the use of encryption. In addition, access to your personal data is restricted to those who need it to fulfill the purposes for which it is processed.

We retain your personal data only for as long as is necessary for the purpose for which we process the data, and in accordance with our Group standard for retention and deletion.

If you are an ISS employee, we retain your personal data for a period of up to five (5) years after the termination of your employment or for longer periods as required by applicable local law.

If you apply for a job, we will retain your personal data in accordance with your consent for future hiring purposes. In the event of a potential legal dispute related to the hiring process, your personal data may be retained for up to six (6) months after the hiring process is completed.

If you are an investor or shareholder, we will retain your personal data for as long as you are an investor or shareholder and, if relevant to certain corporate documents, for as long as ISS exists as a company.

If your personal data is part of financial records, we generally retain your personal data for a period of five (5) years from the end of the fiscal year to which the financial records relate, or for longer periods required by applicable regulations.

If you have consented to receiving direct marketing via electronic means, we are required to retain your personal data for up to two (2) years after you withdraw your consent in order to document compliance with applicable anti-spam rules.

If you are a user of our websites, please note the retention period for cookies mentioned above.

If you are a current or potential customer or supplier, we generally retain your personal data for a period of five (5) years following our last interaction with you.

We take appropriate measures to delete or permanently anonymize all personal data once it can no longer be used in accordance with this Privacy Policy.

The following applies to Switzerland: The actual retention period is determined by the applicable statutory retention and record-keeping requirements (in particular under the Swiss Code of Obligations, the Business Records Ordinance, tax and social security law) as well as ISS Switzerland’s internal group and country-specific guidelines on retention and archiving.

We take appropriate steps to ensure that you can exercise your privacy rights. Unless otherwise specified in specific privacy laws, you have the following rights:

You have the right to access your personal data and to receive a copy of that data. You also have the right to have the personal data we process corrected and the right to have it erased. You may object to our processing of your personal data, including the processing of your personal data for direct marketing purposes, or request that we restrict such processing. In addition, in certain cases, you may request a copy of your personal data in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another data controller (data portability). If the processing of your personal data is based solely on your consent, you may withdraw your consent at any time. Please note that this does not affect our processing of your personal data prior to the withdrawal of your consent.

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact our Group Data Protection Officer in writing:

- Address: Group Data Protection Officer, ISS A/S, Buddingevej 197, DK 2860 Søborg, Denmark

- Email: dpm@group.issworld.com

You will not be charged any fees for exercising your data protection rights. However, you may be charged for additional copies of your personal data in accordance with applicable data protection laws.

For Switzerland: The rights mentioned above apply within the framework and scope of applicable data protection law (DSG and DSV).

In Switzerland , the entity responsible for the data processing described in this Privacy Policy (within the meaning of the DSG) is:

ISS Facility Services AG
Data Protection Manager
Vulkanplatz 3, 8048 Zurich
Email: dpo@ch.issworld.com

Before we respond to a request from a data subject, we must verify the identity of the person making the request. Therefore, a request from a data subject must be accompanied by relevant information that ISS needs to identify you and process your request. If necessary, we will take appropriate measures to ensure that the personal data is corrected or deleted, and we will notify you of the correction ordeletion, as well as notify all other recipients of the personal data if we are required to do so under applicable data protection regulations.

There may be situations in which we must deny a request for correction or deletion. In such cases, you may request that we attach a statement to the personal data that you wish to have corrected or deleted.

We will process and respond to your request without undue delay and, in any event, within one (1) month of receiving the request, unless we have the right to extend the response period in accordance with applicable data protection laws. In the event of an extension, we will notify you of this along with the reasons for the delay. If we are unable to comply with your request, you will receive a written explanation of why this is the case, as well as details regarding your further options should you be dissatisfied with our response.

You are welcome to contact us anonymously. However, if you choose to remain anonymous, we will be able to provide you with only a limited range of the services or information you request.

If you would like to file a complaint regarding our processing of your personal data, please contact our Group Data Protection Officer:

- Phone: +45 38 17 00 00

- Address: Group Data Protection Officer, ISS A/S, Buddingevej 197, DK 2860 Søborg, Denmark

- Email: dpm@group.issworld.com

We will do our best to address your complaint as quickly as possible. If you are not satisfied with the outcome of your complaint, you may forward your complaint to the following authority:

Datatilsynet (the Danish Data Protection Authority)

- Phone: +45 33 193 200

- Address: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark

- Website: www.datatilsynet.dk

Data subjects in Switzerland may contact:

ISS Facility Services AG
Data Protection Manager
Vulkanplatz 3, 8048 Zurich
Email: dpo@ch.issworld.com

Data subjects in Switzerland also have the right to file a complaint with the
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch

For more information on data protection in general, please visit the Danish Data Protection Agency’s website at www.datatilsynet.dk.

For Switzerland, you can find further general information on data protection on the website of the Federal Data Protection and Information Commissioner at www.edoeb.admin.ch.

We may review, change, or revise our Privacy Policy and the way we process personal data from time to time. We will post the updated Privacy Policy on our website at www.issworld.com. All amended terms will take effect on the date of publication.

You can download the files related to the ISS-BCR guidelines here:

ISS BCR Policy
ISS BCR Appendices 1–8

Report a data breach here.