Privacy Policy
Last updated: 23 October 2026
This is a translation for convenience. The German version at /datenschutz is legally binding.
1. Who is responsible for data processing
Stellar GmbH
Gewerbestrasse 10, 6330 Cham, Switzerland
We operate under the name haseln.
Email: founders@haseln.com
The company named above alone determines the purpose and means of any data processing that arises in the operation of this website and in the provision of the services offered.
2. Scope of this policy
This policy describes our presence at haseln.com including all subdomains, as well as the data processing that arises in our outbound sales services. A separate data processing agreement takes precedence where one exists with customers.
Our basis is the Swiss Federal Act on Data Protection (revFADP (revDSG)), in force since 1 September 2023. Where data subjects habitually reside in the European Economic Area, we additionally apply the EU General Data Protection Regulation (GDPR (DSGVO)).
3. Overview of data categories
We collect only what the operation of this website and the provision of our services actually require. The following may be involved:
- Messages to us: If you send us an email, your name, your email address and the content of your message reach us. We use this information to reply to you.
- Appointment booking: Anyone who books a Strategy Call or an interview via the embedded Cal.com widget provides their name, email address and preferred time, and possibly further details that are added voluntarily.
- Contract data: Where a client relationship exists, we record the business contact details of the contact persons as well as what makes up the engagement: services, terms, fees and correspondence.
- Applications: If you apply for a position, we review the documents submitted until the selection process has ended. What exactly we process and for how long is set out in Section 9.
- Server log data: For technical reasons, our hosting provider logs the IP address, date and time of the request, user agent, referrer URL, requested resource, HTTP status code and the amount of data transferred.
4. Why we process data and what we rely on
We pursue these purposes by processing personal data:
- Answering enquiries and preparing contracts (pre-contractual measures, Art. 31 para. 2 lit. a revFADP (revDSG) or Art. 6 para. 1 lit. b GDPR (DSGVO)).
- Performing existing contracts with our customers (Art. 31 para. 2 lit. a revFADP (revDSG) or Art. 6 para. 1 lit. b GDPR (DSGVO)).
- Providing and securing the website; our overriding interest lies in a stable and secure presence (Art. 31 para. 2 lit. d revFADP (revDSG) or Art. 6 para. 1 lit. f GDPR (DSGVO)).
- Complying with statutory retention obligations, for example under the Swiss Code of Obligations (OR) or Swiss VAT law (Art. 31 para. 1 revFADP (revDSG) or Art. 6 para. 1 lit. c GDPR (DSGVO)).
- If you consent: measuring which ads lead to appointments, re-serving ads and recognising company visits (Art. 6 para. 6 revFADP (revDSG) or Art. 6 para. 1 lit. a GDPR (DSGVO), and for access to your device § 25 para. 1 TDDDG). Details in Section 7.
5. Service providers we use
In operating the website and providing our services, we work with selected partners. They act as processors under Art. 9 revFADP (revDSG) or Art. 28 GDPR (DSGVO):
- Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: responsible for domain management and DNS, and where applicable also for CDN and security functions. Cloudflare acts as a processor and is certified under the EU Standard Contractual Clauses.
- Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA: hosts the website, keeps server logs in doing so, and delivers the content worldwide via the Vercel Edge Network. The company is certified under the EU Standard Contractual Clauses and registered under the EU-US Data Privacy Framework.
- Cal.com, Inc.: provides the embedded appointment booking widget at cal.com. When an appointment is booked, the data entered goes to Cal.com, Inc., based in the USA. We base the transfer to the USA on the EU Standard Contractual Clauses, which form part of Cal.com's data processing agreement.
- For outbound campaigns on behalf of customers we use industry-standard tools for CRM, email sequences, telephony, data enrichment and deliverability. Such processing does not run through this website, but on the basis of a data processing agreement (DPA) concluded with the respective client.
- Business email correspondence: It runs through common email providers. Once the business infrastructure is finalised, we will name the specific provider setup here (planned are Cloudflare Email Routing together with a mailbox provider whose servers are located in the EU).
Where data goes to countries outside Switzerland or the EEA, we rely on an adequacy decision, on the EU Standard Contractual Clauses or on explicit consent. We will tell you at any time which third-party providers are in use on request at founders@haseln.com.
6. How long we retain data
Personal data stays with us for as long as the respective purpose requires, and no longer:
- Contract data: for the duration of the contract and thereafter until the statutory retention periods have expired.
- Email enquiries: until your request has been finally dealt with, and where a business relationship results, until it ends, but no longer than statutory retention periods require (under the OR generally ten years).
- Application data: until the selection process has ended, and beyond that for six months at most if no employment results; 12 months with consent to the talent pool. Details in Section 9.
- Server logs: deleted or anonymised after 30 days at the latest.
- Appointment bookings and the resulting lead data in the CRM: deleted if no business relationship arises within 24 months of the last contact; if one does arise, the rule for contract data applies.
- Cookies on this website: your cookie choice 12 months, origin data (only with consent) 90 days. More in Section 7.
8. Application to the Sales Academy
Anyone who applies to the Sales Academy via haseln.com/academy/bewerben gives us this information: name, email address, phone number, optionally a LinkedIn profile, the answers to the questions in the application flow, optionally one sentence on motivation and a voice message of up to 30 seconds. In addition, we record which link brought you to the page (campaign parameters and referral code), where available.
Purpose: We use this data to review your application, to contact you and to decide on admission to a cohort.
Legal basis: § 26 BDSG or Art. 6 para. 1 lit. b GDPR (DSGVO) (carrying out the application process). Contact via WhatsApp and inclusion in the talent pool take place only with your consent (Art. 6 para. 1 lit. a GDPR (DSGVO)), which you give separately in the application flow and can withdraw at any time with effect for the future.
Recipients and hosting: The application flow runs on the website at Vercel (Section 5). From there, your details go encrypted to our internal applicant management; the database and file storage for voice messages are with Supabase, and we send confirmation emails via Resend. If we write to you via WhatsApp, the message is transmitted via WhatsApp; this happens only if you have agreed to it.
Retention period: If you do not take part, we delete your application including the voice message six months after the rejection or after your withdrawal. If you have agreed to inclusion in the talent pool, we instead keep the application for 12 months in order to approach you for later cohorts, and delete it afterwards.
Anyone who states in the first question that they are not yet 18, or who speaks only basic German, ends the flow early; in that case, we receive no details. The interim state of the application and the campaign parameters remain only in your browser's memory (session storage) until submission and disappear when you close the tab.
9. Applications for a position
This section applies to applications via haseln.com/karriere and via the application links we send you (haseln.com/bewerbung and personal links beneath it), and to the video case study to which we invite some applicants (below).
What data: Contact details (name, email address, phone number, optionally a LinkedIn profile), your CV, your answers in the form (German level, earliest start date, a few sentences on motivation or a voluntary note to us) and, if you book one, the appointment for the interview together with the details you enter in doing so. In addition, we record which link brought you to the page (campaign parameters, referral or invitation code), where available.
Purpose: We use this data to process your application, to contact you, to arrange interview appointments and to decide on a hire.
Legal basis: § 26 BDSG in conjunction with Art. 88 GDPR (DSGVO) and Art. 6 para. 1 lit. b GDPR (DSGVO) (carrying out the application process). Inclusion in the talent pool takes place only with your consent (Art. 6 para. 1 lit. a GDPR (DSGVO)), which you give separately in the form. You can withdraw it at any time with effect for the future; an email to founders@haseln.com is enough.
Recipients and processors:
- Our hosting and database provider: The form runs on the website at Vercel (Section 5). From there, your details go encrypted to our internal applicant management; the database and file storage for CVs are with Supabase.
- Our email delivery provider (Resend), through which we send confirmations and messages about your application.
- Our internal team chat: There the team learns of a new application, but receives only your first name and the role.
- Cal.com (Section 5), if you book an interview via the embedded widget or the link. Cal.com receives your name, email address, the chosen appointment and a technical identifier with which we assign the booking to your application.
Within haseln, your application is seen only by the people involved in the selection process.
Retention period: We store your application until a decision is made. After a rejection or your withdrawal, we delete it including the CV after six months. If you have agreed to inclusion in the talent pool, we instead keep the application for 12 months in order to approach you for other positions, and delete it afterwards, or earlier if you withdraw your consent. If you are hired, the data goes into your personnel file.
Video case study
For individual roles, we invite you to a case study after the first interview. It runs via a personal link that we send you by email (haseln.com/case/…): you record short videos of yourself in the browser, such as the opening of a simulated phone call and answers to objections, and write a short text.
What data: Your video and audio recordings, your written answers, when you started and submitted the case, as well as technical details such as browser type, operating system, whether you use a mobile device, and the video format. The test recording in the technical check stays in your browser and is not uploaded. Your browser keeps a draft of your text on your device until you submit it (local storage).
Purpose and legal basis: We use the case study to assess, within the application process, whether you are suited to the role. As for the rest of the application, the legal basis is § 26 BDSG in conjunction with Art. 88 GDPR (DSGVO) and Art. 6 para. 1 lit. b GDPR (DSGVO) (carrying out the application process).
Who sees it: Only the two founders see the recordings and answers. The page runs at Vercel (Section 5); the recordings go encrypted directly into the same file storage at Supabase as the CVs, and the answers into our internal applicant management.
No automated evaluation: People decide on your application, not an automated process. We also do not analyse the recordings automatically, in particular not your face, facial expressions or emotions.
Retention period: We delete recordings and answers six months after our decision on your application, or immediately on request. A request for deletion covers everything: the recordings, the answers and the rest of the application.
Voluntary: Taking part is voluntary. If you do not want to record videos of yourself, tell us at founders@haseln.com; we will then find another way, for example an interview in which you go through the case live with us.
Your rights: You can request access to your data, its rectification, erasure or the restriction of processing, object to processing and receive your data in a common format (data portability). You can also lodge a complaint with a data protection supervisory authority. To do so, write to us informally at founders@haseln.com; details are in Section 10.
10. What you can request from us
Applicable data protection law grants you these claims:
- Information about which data we process about you;
- Erasure of your data;
- Rectification of incorrect and completion of incomplete information;
- Release or transfer of your data;
- Restriction of processing;
- Withdrawal of consent once given, effective for the future;
- Objection to processing, in particular where we rely on legitimate interests.
An informal message to founders@haseln.com is enough to exercise these rights. So that we can be sure we are speaking to the right person, we may ask for suitable proof of identity.
Your right to lodge a complaint with the competent supervisory authority remains unaffected: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, in German EDÖB, edoeb.admin.ch), in the EEA with the respective national data protection supervisory authority.
11. Protection of your data
We secure your data with suitable technical and organisational measures against loss, destruction, unauthorised access and accidental or deliberate manipulation. We continuously keep what we do for this in line with the state of the art. Data is transmitted over the internet encrypted via TLS.
12. Updates to this document
This policy may change, for example because new legal requirements demand it or because we change our range of services. The version published on this page at the time of your visit applies.