1 Controller for the purposes of the General Data Protection Regulation

The Controller for the purposes of the General Data Protection Regulation, other national data protection legislation or any other data protection law is

St. Gallen Foundation for International Studies
Dufourstrasse 83
P.O. Box 1045
9001 St. Gallen, Switzerland
Phone +41 71 227 20 50, Fax +41 71 227 20 30
Mrs Frauke Kops, [email protected]

St. Gallen Foundation for International Studies (hereafter SSIS) is a charitable foundation established under Swiss law, which is entered into the Commercial Register of the Canton of
St. Gallen under registration number CHE-110.227.416. Its purpose is the maintenance and
further development of an economic and social system grounded on the values of freedom
and social cohesion through international seminars and lectures, research activity and project work in the areas of economics, social science, law and politics, including in particular
also modern management. It is subject to foundation oversight by the Swiss Federal Department of Home Affairs.

2 General information concerning data processing

2.1 Processing of personal data

We collect personal data if you contact us.

We process these data where they are necessary for and conducive to the fulfilment of administrative purposes, including in particular also participation in the St. Gallen Symposium (hereafter referred to as the “SGS”). Within the ambit of participation in the SGS, we process your personal data in particular in relation to the application, on surveys relating to the SGS, in relation to active participation in the SGS Community, in relation to electronic and hardcopy lists of participants, for communication relating to the relevant SGS along with subsequent communication, as well as the exchange of contact information.

We also specifically store and process your data after the relevant SGS in order to build up a comprehensive database for the SGS Community and ISC Alumni in the interest of all past and future participants in the SGS.

2.2 Legal basis

In transmitting your personal data, you thereby consent to the processing of the data transmitted to us by you in accordance with clause 2.1 above. Point (b) of Article 6(1) GDPR is thus the primary legal basis for data processing.

SSIS also has a legitimate interest in processing the data transmitted to us by you along with any further data collected by us in relation to the relevant SGS, and also in storing and processing such data thereafter in order to enable us to build up a network in the interest of all Privacy Statement of St. Gallen Foundation for International Studies Valid from September 2018 participants, from which all past and future participants of the SGS can benefit under the aegis of the SGS Community and the ISC Alumni. Point (f) of Article 6(1) GDPR is thus a subsidiary legal basis for the processing of your personal data.

The storage of cookies and server log files and the use of Google Analytics (cf. also clause 3.2 below) is also based on point (f) of Article 6(1) GDPR: We have a legitimate interest in collecting and storing such data in order to enable us to display and present our website in an optimal manner.

2.3 Data erasure and storage

We also specifically store and process your data after the relevant SGS in order to build up a comprehensive database through the SGS Community and ISC Alumni in the interest of all past and future participants in the SGS. Accordingly, your data will not as a matter of principle be erased by us, with the exception of data relating to identity cards and other comparable official documents, which are erased after 10 years.

The personal data of the data subject will be erased or made unavailable once the purpose for which they were saved no longer applies.

Data may be stored or erased thereafter if so required under European or national legislation in European Union regulations, laws or other provisions to which the Controller is subject. In such cases, data will be erased or made unavailable upon expiry of a maximum retention period prescribed under such provisions, unless it is necessary to continue to store the data and such continued storage is permitted.

3 Description and scope of data processing

3.1 Personal data

We collect primarily the personal data that you expressly provide to us, depending upon your relationship with us. This may include specifically: name, address, contact details, interests, (in some cases) identity card or comparable other official documents, (in some cases) driving licence, photograph, course of studies, university, confirmation of matriculation, language, previous participation and functions within the SGS. In addition, we also collect further data that we have obtained either from your previous communication with the SGS or from a freely available online source.

We do not collect any sensitive data falling under Article 9 GDPR.

3.2 Data collection on our website

Our website uses cookies under certain circumstances; these are small text files that are downloaded to and stored on your computer, and which are used in order to render our content more user-friendly, more effective and more secure.

Session cookies are automatically erased at the end of your visit. This is the case for most types of cookie. Other cookies allow us the opportunity to recognise you again the next time you visit our website. These cookies are stored on your end device until they are removed by you.

In addition, we, or the provider of our website, also use Google Analytics and automatically collect and store information in so-called server log files. Google Analytics investigates in particular the origin of visitors to our websites, the duration of their visits to individual pages and the usage of search engines. Server log files are automatically transmitted by your browser to us and contain in particular information concerning the browser type and version, the operating system used, the referrer URL, the host name of the accessing computer, the time of the server request and the IP address.

Web-based data are not cross-referenced with any other data.

3.3 Purpose and nature of data processing

Your personal data are processed in accordance with clause 2.1 above with regard to your participation in the SGS and for the development of the network database for the SGS Community.

Data are processed using standard IT applications such as e.g. Office, Sharepoint, CRM, Apps, etc., and physically in relation to the dispatch of postal correspondence.

Employees of SSIS with responsibility for the SGS only have access to your data if and insofar as necessary in order to perform their tasks. All employees have been subjected to an individual duty of confidentiality.

3.4 Disclosure of data to third parties

Outside SSIS and the persons with responsibility for the SGS, we will only disclose the name of and information relating to your business; such information will only be disclosed to participants in the SGS.

3.5 Duration of storage

Data drawn from identity cards or other comparable official documents are erased after 10 years. Other data are erased once they are no longer necessary in order to achieve the purpose for which they were collected, although such data are also collected and processed exclusively for the network database established in the interest of all members of the SGS Community.

4 Rights of the data subject

Since we process your personal data, you are a Data Subject for the purposes of the GDPR and have the following rights against SSIS:

4.1 Right to information

You can request confirmation as to whether any personal data relating to you are processed by us.

If such processing takes place, you can request information concerning:

a) the purposes for which the personal data are processed;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to which your personal data have been or will be disclosed;
d) the envisaged period for which the personal data relating to you will be stored or, if specific information concerning this matter cannot be provided, the criteria used to determine that period;
e) the existence of a right to request the rectification or erasure of personal data concerning you, a right to obtain the restriction of processing or a right object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) any available information as to the source of data, where the personal data are not collected from you;
h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You also have the right to request information as to whether personal data relating to you are transmitted to a third country or to an international organisation. In this respect, you may request that you be informed of the appropriate safeguards pursuant to Article 46 GDPR in relation to the transmission.

4.2 Right to rectification

You have the right to obtain rectification and/or completion in the event that the personal data processed in relation to you are inaccurate or incomplete.

4.3 Right to erasure

You may request SSIS to erase the personal data relating to you, and SSIS is obliged in such an eventuality to erase the personal data concerning you without undue delay, where one of the following reasons applies:

a) the personal data relating to you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) you withdraw your consent on which processing was based pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) GDPR, and there is no other legal basis for processing;
c) you object to processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object to processing pursuant to Article 21(2) GDPR;
d) the personal data relating to you have been processed unlawfully;
e) the personal data relating to you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; or
f) the personal data relating to you have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

4.4 Right to restriction of processing

Where the following prerequisites are met, you may obtain the restriction of processing of personal data relating to you:

a) if you contest the accuracy of the personal data relating to you, for a period enabling the controller to verify the accuracy of the personal data;
b) if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
c) if SSIS no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
or
d) if you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the Controller override those of your own.

Where processing of personal data concerning you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If processing has been restricted in accordance with the prerequisites set out above, you will be informed by SSIS before the restriction of processing is lifted, as the case may be.

4.5 Right to notification

If you have a right to rectification, erasure or restriction of processing in accordance with the above and if you have exercised this right against SSIS, SSIS is obliged to communicate the rectification, erasure or restriction of processing to each recipient to whom the personal data relating to you have been disclosed, unless this proves impossible or involves disproportionate effort (for instance therefore, in particular participants in the SGS and the members of the SGS Community will not be informed of such rectification, erasure or restriction).

You have the right to be informed by SSIS about such recipients.

4.6 Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

In such an eventuality, SSIS will no longer process the personal data relating to you unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

4.7 Right to withdraw the declaration of consent to data processing

If SSIS has obtained a declaration of consent to data processing from you, you have the right to withdraw this at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.8 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

signed
Frauke Kops
Vice President
[email protected]
St. Gallen Foundation for International Studies
P.O. Box 1045
9001 St. Gallen, Switzerland
Phone +41 71 227 20 50