Privacy Statement of St. Gallen Foundation for International Studies Valid from September 2018

1. Controller for the purposes of the General Data Protection Regulation
   The Controller for the purposes of the General Data Protection Regulation, other national
   data protection legislation or any other data protection law is
   St. Gallen Foundation for International Studies
   Dufourstrasse 83
   P.O. Box 1045
   9001 St. Gallen, Switzerland
   Phone +41 71 227 20 50, Fax +41 71 227 20 30
   Mrs Frauke Kops, [email protected]
   
   St. Gallen Foundation for International Studies (hereafter SSIS) is a charitable foundation established under Swiss law, which is entered into the Commercial Register of the Canton of St. Gallen under registration number CHE-110.227.416. Its purpose is the maintenance and further development of an economic and social system grounded on the values of freedom and social cohesion through international seminars and lectures, research activity and project work in the areas of economics, social science, law and politics, including in particular also modern management. It is subject to foundation oversight by the Swiss Federal Department of Home Affairs.
   
   
2. General information concerning data processing
   2.1 Processing of personal data
   We collect personal data if you contact us.
   We process these data where they are necessary for and conducive to the fulfilment of administrative purposes, including in particular also participation in the St. Gallen Symposium
   (hereafter referred to as the “SGS”). Within the ambit of participation in the SGS, we process
   your personal data in particular in relation to the application, on surveys relating to the SGS,
   in relation to active participation in the SGS Community, in relation to electronic and hardcopy lists of participants, for communication relating to the relevant SGS along with subsequent communication, as well as the exchange of contact information.
   We also specifically store and process your data after the relevant SGS in order to build up a
   comprehensive database for the SGS Community and ISC Alumni in the interest of all past
   and future participants in the SGS.
   2.2 Legal basis
   In transmitting your personal data, you thereby consent to the processing of the data transmitted to us by you in accordance with clause 2.1 above. Point (b) of Article 6(1) GDPR is thus
   the primary legal basis for data processing.
   SSIS also has a legitimate interest in processing the data transmitted to us by you along with
   any further data collected by us in relation to the relevant SGS, and also in storing and processing such data thereafter in order to enable us to build up a network in the interest of all
   Privacy Statement of St. Gallen Foundation for International Studies Valid from September 2018
   participants, from which all past and future participants of the SGS can benefit under the
   aegis of the SGS Community and the ISC Alumni. Point (f) of Article 6(1) GDPR is thus a subsidiary legal basis for the processing of your personal data.
   The storage of cookies and server log files and the use of Google Analytics (cf. also clause
   3.2 below) is also based on point (f) of Article 6(1) GDPR: We have a legitimate interest in collecting and storing such data in order to enable us to display and present our website in an optimal manner.
   2.3 Data erasure and storage
   We also specifically store and process your data after the relevant SGS in order to build up a
   comprehensive database through the SGS Community and ISC Alumni in the interest of all
   past and future participants in the SGS. Accordingly, your data will not as a matter of principle
   be erased by us, with the exception of data relating to identity cards and other comparable
   official documents, which are erased after 10 years.
   The personal data of the data subject will be erased or made unavailable once the purpose
   for which they were saved no longer applies.
   Data may be stored or erased thereafter if so required under European or national legislation
   in European Union regulations, laws or other provisions to which the Controller is subject. In
   such cases, data will be erased or made unavailable upon expiry of a maximum retention
   period prescribed under such provisions, unless it is necessary to continue to store the data
   and such continued storage is permitted.
3. Description and scope of data processing
   3.1 Personal data
   We collect primarily the personal data that you expressly provide to us, depending upon your
   relationship with us. This may include specifically: name, address, contact details, interests,
   (in some cases) identity card or comparable other official documents, (in some cases) driving
   licence, photograph, course of studies, university, confirmation of matriculation, language,
   previous participation and functions within the SGS. In addition, we also collect further data
   that we have obtained either from your previous communication with the SGS or from a freely
   available online source.
   We do not collect any sensitive data falling under Article 9 GDPR.
   3.2 Data collection on our website
   Our website uses cookies under certain circumstances; these are small text files that are
   downloaded to and stored on your computer, and which are used in order to render our content more user-friendly, more effective and more secure.
   Session cookies are automatically erased at the end of your visit. This is the case for most
   types of cookie. Other cookies allow us the opportunity to recognise you again the next time
   you visit our website. These cookies are stored on your end device until they are removed by
   you.
   Privacy Statement of St. Gallen Foundation for International Studies Valid from September 2018
   In addition, we, or the provider of our website, also use Google Analytics and automatically
   collect and store information in so-called server log files. Google Analytics investigates in
   particular the origin of visitors to our websites, the duration of their visits to individual pages
   and the usage of search engines. Server log files are automatically transmitted by your
   browser to us and contain in particular information concerning the browser type and version,
   the operating system used, the referrer URL, the host name of the accessing computer, the
   time of the server request and the IP address.
   Web-based data are not cross-referenced with any other data.
   3.3 Purpose and nature of data processing
   Your personal data are processed in accordance with clause 2.1 above with regard to your
   participation in the SGS and for the development of the network database for the SGS Community.
   Data are processed using standard IT applications such as e.g. Office, Sharepoint, CRM,
   Apps, etc., and physically in relation to the dispatch of postal correspondence.
   Employees of SSIS with responsibility for the SGS only have access to your data if and insofar
   as necessary in order to perform their tasks. All employees have been subjected to an individual duty of confidentiality.
   3.4 Disclosure of data to third parties
   Outside SSIS and the persons with responsibility for the SGS, we will only disclose the name
   of and information relating to your business; such information will only be disclosed to participants in the SGS.
   3.5 Duration of storage
   Data drawn from identity cards or other comparable official documents are erased after 10
   years. Other data are erased once they are no longer necessary in order to achieve the purpose for which they were collected, although such data are also collected and processed exclusively for the network database established in the interest of all members of the SGS Community.
   
   
4. Rights of the data subject
   Since we process your personal data, you are a Data Subject for the purposes of the GDPR
   and have the following rights against SSIS:
   
   4.1 Right to information
   You can request confirmation as to whether any personal data relating to you are processed
   by us.
   If such processing takes place, you can request information concerning:
   a the purposes for which the personal data are processed;
   b the categories of personal data concerned;
   c the recipients or categories of recipient to which your personal data have been or will be disclosed;
   d the envisaged period for which the personal data relating to you will be stored or, if specific information concerning this matter cannot be provided, the criteria used to determine that period;
   e the existence of a right to request the rectification or erasure of personal data concerning you, a right to obtain the restriction of processing or a right object to such processing;
   f the right to lodge a complaint with a supervisory authority;
   g any available information as to the source of data, where the personal data are not collected from you;
   h the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
   You also have the right to request information as to whether personal data relating to you are
   transmitted to a third country or to an international organisation. In this respect, you may request that you be informed of the appropriate safeguards pursuant to Article 46 GDPR in
   relation to the transmission.
   
   4.2 Right to rectification
   You have the right to obtain rectification and/or completion in the event that the personal
   data processed in relation to you are inaccurate or incomplete.
   
   4.3 Right to erasure
   You may request SSIS to erase the personal data relating to you, and SSIS is obliged in such an eventuality to erase the personal data concerning you without undue delay, where one of the following reasons applies:
   a the personal data relating to you are no longer necessary in relation to the purposesfor which they were collected or otherwise processed;
   b you withdraw your consent on which processing was based pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) GDPR, and there is no other legal basis for processing;
   c you object to processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object to processing pursuant to Article 21(2) GDPR;
   d the personal data relating to you have been processed unlawfully;
   e the personal data relating to you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; or
   f the personal data relating to you have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
   
   4.4 Right to restriction of processing
   Where the following prerequisites are met, you may obtain the restriction of processing of personal data relating to you:
   a if you contest the accuracy of the personal data relating to you, for a period enabling the controller to verify the accuracy of the personal data;
   b if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
   c if SSIS no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or
   d if you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the Controller override those of your own.
   Where processing of personal data concerning you has been restricted, such personal data
   shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If processing has been restricted in accordance with the prerequisites set out above, you will be informed by SSIS before the restriction of processing is lifted, as the case may be.
   
   4.5 Right to notification
   If you have a right to rectification, erasure or restriction of processing in accordance with the above and if you have exercised this right against SSIS, SSIS is obliged to communicate the rectification, erasure or restriction of processing to each recipient to whom the personal data relating to you have been disclosed, unless this proves impossible or involves disproportionate effort (for instance therefore, in particular participants in the SGS and the members of the SGS Community will not be informed of such rectification, erasure or restriction). You have the right to be informed by SSIS about such recipients.
   
   4.6 Right to object
   You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1)
   GDPR, including profiling based on those provisions. In such an eventuality, SSIS will no longer process the personal data relating to you unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
   
   4.7 Right to withdraw the declaration of consent to data processing
   Privacy Statement of St. Gallen Foundation for International Studies Valid from September 2018 If SSIS has obtained a declaration of consent to data processing from you, you have the right to withdraw this at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
   
   4.8 Right to lodge a complaint with a supervisory authority
   Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
   
   signed
   
   
   Frauke Kops
   Vice President
   [email protected]
   St. Gallen Foundation for International Studies
   P.O. Box 1045
   9001 St. Gallen, Switzerland
   Phone +41 71 227 20 50