Private Policy
Privacy Policy for the digital reporting system of the University of Zurich (UZH) External Reporting Office
Last updated: October 2026
Below, we provide information on what data is collected, processed and disclosed when using this system, the purposes for which this is done, and the technical and organisational measures that have been put in place to protect this data. The German text is binding.
Scope and Responsibility
The digital reporting system enables the anonymous or confidential reporting of concerns or misconduct relating to UZH to the External Reporting Office within a secure environment. Use of the secure reporting platform is entirely voluntary.
The University of Zurich is responsible for data processing within the meaning of cantonal law.
The University of Zurich is responsible for data processing within the meaning of cantonal law.
Data Collection, Processing and Storage
The digital reporting system is technically designed in such a way that, by default, no identifying details are passed on to the External Reporting Office or the relevant UZH contact persons.
To protect your anonymity:
To protect your anonymity:
- no metadata (such as your IP address) is transmitted to the contact persons,
- all information is encrypted end-to-end directly within the browser.
If you choose to submit your report confidentially (rather than completely anonymously), your name and email address will be collected.
- Purpose of collection: The provision of your email address serves solely to uniquely identify you within the system.
- No email communication: There will be absolutely no communication regarding your report via email. Follow-up, the exchange of information and the answering of queries take place exclusively via the secure reporting platform using the access details (URL and password) provided to you after submission.
The following may also be collected and processed:
- Nature of the matter: e.g. breaches of (financial) compliance (such as fraud, embezzlement, mismanagement and other financial irregularities, corruption, bribery, conflicts of interest), breaches in procurement and contracting, and violations of personal integrity (such as sexual harassment, discrimination, bullying, bullying, stalking, abuse of power), breaches of academic integrity, endangerment of or harm to health, safety and the environment, as well as breaches of data protection and information security.
- Report text: The text you have entered describing the facts of the case.
- Voice messages (optional): Alternatively or in addition, you can record up to 5 voice messages (each up to 3 minutes long) directly within the system. Important note: Your voice message will not be anonymised or distorted. You may be identified by your voice.
- File attachments (optional): You can upload documents. Important note: Files (e.g. PDFs, Office documents such as DOCX/XLSX or image formats) often contain hidden metadata relating to the author or place of creation. You should remove this yourself before uploading.
- Link to view the notice again, as well as your personal password.
Storage location and data residency: All data entered via the secure reporting platform is stored exclusively in Switzerland or within the EU/EEA area.
Processing by third parties and disclosure of personal data
The report and its contents will only be disclosed to those persons who need to know them in order to process the report.
UZH may be obliged to disclose confidential information to a wider group of recipients due to legal requirements, procedural reasons or in cases of imminent danger.
Tracking settings
The digital reporting system does not use tracking, analytics tools or profiling mechanisms. No data is collected for the purpose of analysing user behaviour.
Cookies
The system does not set any cookies, with the exception of session cookies that are technically essential. These do not contain any personal data and are automatically deleted when the web browser is closed.
External links
Where the secure reporting platform contains links to external websites, this privacy policy does not extend to their content. The operators of linked sites are responsible for compliance with data protection regulations on those sites.
Data security
UZH and its service providers implement appropriate technical and organisational security measures (TOM) in accordance with the requirements of applicable data protection law.
Legal basis
The processing of personal data within the framework of this digital registration system is based on the statutory duties of UZH as a public-law institution of the Canton of Zurich and is governed by the provisions of the Information and Data Protection Act of the Canton of Zurich (IDG).
Rights of data subjects and contact point
As a data subject, you have specific rights under the cantonal IDG, in particular the right of access and the right to rectification, restriction or erasure of inaccurate or no longer required data, provided that this is not precluded by statutory retention obligations or overriding public interests. In the case of reports submitted completely anonymously, these rights can, for technical reasons, only be exercised if you provide us with data that enables us to identify you.
To exercise your rights or if you have any questions regarding data protection, please contact:
University of Zurich
Legal and Data Protection UZH
Hirschengraben 60
CH-8001 Zurich
privacy@rud.uzh.ch
To exercise your rights or if you have any questions regarding data protection, please contact:
University of Zurich
Legal and Data Protection UZH
Hirschengraben 60
CH-8001 Zurich
privacy@rud.uzh.ch
Validity
UZH reserves the right to amend this privacy policy at any time with future effect. We therefore recommend that you review the privacy policy regularly.