Data protection notice
The Swiss Federal Audit Office (SFAO) processes personal data in fulfilment of its legal duty as a whistleblowing reporting office. In doing so, it is obliged to comply with Swiss data protection regulations.
Purpose of the whistleblowing system
The SFAO uses the whistleblowing platform to receive information on damaging conduct (e.g. corruption, indiscretions, other illegal acts or irregularities) in the Federal Administration, in organizations close to the Confederation or among recipients of subsidies in a secure and confidential manner and to be able to process it in a protected area.
Responsible authority
The SFAO is responsible for data protection in the whistleblowing system.
The whistleblowing system is operated by a company specialized in this area, EQS Group GmbH, on behalf of the SFAO. Personal data and information entered into the whistleblowing system is stored exclusively in encrypted form in a high-security data center in Switzerland. Access to the data is only possible for the SFAO with multi-level password protection. The operator of the system and other third parties have no access to the encrypted data.
Type of personal data collected
The use of the whistleblowing system and the possible disclosure of your identity is voluntary; anonymous reports are possible. If you submit a report via the whistleblowing system, the following personal data and information may be collected, depending on the individual case:
- Your name, your contact details and any other personal data if you disclose your personal data or if your report allows conclusions to be drawn about it,
- Names of institutions, companies and persons as well as other personal data of the aforementioned, which you may name in your report or your report allows conclusions to be drawn about them.
Treatment of personal data and information by the SFAO
Access to the reported personal data and information at the SFAO is restricted to a very narrow circle of expressly authorized and specially trained employees. Incoming information is received exclusively by these persons. For the purpose of reviewing the report and for further clarification, the reported personal data and information may be forwarded within the SFAO to the specialized audit domains and competence centres. All SFAO employees are subject to official secrecy.
Transmission of personal data
If necessary or if the SFAO is not the competent authority, the report can be forwarded anonymously to other administrative units of the Federal Administration, the competent authority or the prosecution authorities.
If your report contains personal data about you or allows conclusions to be drawn about your person and anonymization would be difficult or very time-consuming, the SFAO will ask you, in case that you have set up a postbox, whether your personal data may be passed on before forwarding it to third parties. Please note that in individual cases, e.g. in court or criminal proceedings, the SFAO may be obliged to disclose the report and the personal data in full.
You will achieve the greatest possible protection if you do not disclose any personal data to the SFAO and do not provide any information in the report that would allow conclusions to be drawn about your person.
Data subject rights
You have the right to request information about the processing of your personal data by the SFAO at any time and free of charge. Any request for information should be sent in writing, signed and accompanied by a copy of your identity document (passport or ID card) to: Eidgenössische Finanzkontrolle, Rechtsdienst, Monbijoustrasse 45, 3003 Bern. Further rights such as the right to erasure, rectification and restriction of the processing of your personal data exist within the legally prescribed framework.
Retention period of personal data
The SFAO retains the personal data for 5 years after clarification of the facts.
Use of the whistleblowing system
Communication between your computer and the whistleblowing system takes place via an encrypted connection (SSL). The IP address of your computer is not stored while you are using the whistleblowing system. In order to maintain the connection between your computer and the whistleblowing system, a cookie is stored on your computer which only contains the session ID (so-called session cookie). The cookie is only valid until the end of your session and becomes invalid when you close your browser. The origin of the messages can therefore not be traced.
You have the option of setting up a secured postbox in the whistleblowing system with a pseudonym/user name and password of your choice. This way you can receive feedback from the SFAO and, if necessary, answer any questions that remain open or supplement your report anonymously and securely. With this function, the data is stored exclusively in the whistleblowing system and is therefore particularly secure; it is not an ordinary e-mail communication. If you lose your access data to the postbox, it cannot be restored.
Status: June 2024
