Privacy Notice

This Privacy Notice describes how your personal data is processed by the International Institute for Management Development (hereafter referred to as “IMD” or “we” or “us”), as well as, where applicable, IMD affiliates.

1) IMD’s role and contact details 

IMD’s main establishment is the International Institute for Management Development (IMD), a Swiss-based foundation established in Lausanne, Vaud, that may be contacted with the following information: 

IMD – International Institute for Management Development 

Chemin de Bellerive 23 

CH – 1007 Lausanne 

[email protected]  

IMD operates two branches in Singapore and Shenzhen (China), which qualify in the context of this Privacy Notice as “IMD Affiliates”. Specific privacy notices (apply whenever IMD Affiliates directly collect your personal data, please click for Singapore).

In the context of this Privacy Notice, IMD is the controller of your personal data. As a Swiss-based foundation, IMD is directly subject to the Swiss Federal Act on Data Protection (“FADP”). 

2) Scope of the Privacy Notice  

This Privacy Notice applies to all processing activities that are implemented by IMD in the context of its activities, especially in relation to: 

  • IMD’s website (IMD.org) and other IT platforms as well as IMD’s mobile applications (hereafter together the “Online Platforms”)
  • Programs and courses, in person and/or online (including any assessments, reports, or other pedagogical tools)
  • Conferences and other events organized by and/or in relation to IMD
  • Fundraising and networking activities
  • Communication activities, including newsletters, as well as IMD’s presence on social networks
  • Management of the alumni community
  • Research and other scientific activities (including statistics) 
  • Statistical activities  

Please note that a specific privacy notice shall apply for employment-related processing activities as well as for the specific processing activities linked to board members of IMD. 

3) Definitions

IMD affiliates

means the two branches operated by IMD in Singapore and Beijing (China).

Personal data

means any identified or identifiable information relating to a natural person.

Processing

means any activity linked to personal data implemented by IMD and/or by its processors, including collection, storage, sharing, using, and analyzing.

Processor

means the third-party person or entity who processes personal data on behalf of IMD.

Third-party

means any person other than IMD and IMD Affiliates, not including processors where mentioned under par. 4 hereunder.

4) Applicable modalities to the processing activities
(Categories of personal data, purpose, basis, retention period, and transfer to third parties)

In this chapter, IMD details the applicable modalities to the processing activities, being underlined that it chooses to apply a specific basis for each category of the processing operation. It is also specified that the transfers to “third parties” that are listed hereunder do not include processors of IMD, who are mentioned and listed under par. 5.

For further detail, please choose hereunder the chapter that relates to the processing operation you are interested in.

1. In relation to IMD’s online platforms
a) Information automatically collected
Personal data

Purpose

 Basis

Principles applied to retention period (for references see para 7)

Transfer to third parties

Browsing-related data (including pages visited, path on a webpage) 

Analytical purposes 
Enhancing our services, webpages and experience  

Your consent  

A

No 

Device-related data (including hardware model, operating system version or unique device identifier) 

Security purposes 

Prevailing IMD interest 

A

No 

Log information (including your internet protocol address and device and event information, which can include crashes as well as system activity) 

Analytical purposes 
Security purposes 

Your consent for analytical purposes 
Prevailing IMD interest for security purposes 

A

No 

Geographical location 

Functioning of certain applications 
Services provided through the application 

Your consent for the use of the systems 
Prevailing IMD interest for security purposes

A

No

For information relating to our use of cookies, trackers, and/or online pixels, as well as to know how to communicate to us your choice regarding the personal data collected through them, please refer to our cookie policy. Please note that, when allowing third-party cookies on your browser, such third parties may themselves collect personal data for their own purposes.

 

b) Information communicated by you
Personal data

Purpose

 Basis

Principles applied to retention period (for references see para 7)

Transfer to third parties

As communicated by you 

Creation and management of your personal account (MyIMD) 

Execution of the contract with you and/or in your interest 
Your consent for non-compulsory personal data that would be provided 

A

No 

As communicated by you 

Answer questions and/or remarks you would have 

Your consent 
IMD’s prevailing interest for managing its requests and files 

A

No 

2. In relation to programs, courses, and other offerings
Personal data

Purpose

 Basis

 Principles applied to retention period (for references see para 7)

Transfer to third parties

Identification data (name, surname, date of birth, etc.) 
Contact details (email address, postal address, emergency contact person and details, etc.) 
Where applicable, financial data (payment details, payment means, etc.)

Enabling you to follow the program and/or course 
General management of the programs and/or courses 

Execution of the contract with you and/or in your interest 

B

Other Participants in the same program cohort for limited identification and contact details  

Professional data (position, company, professional biography, financial information when available, etc.) 

Tailor the programs and/or courses 
Enable networking among students and participants 

IMD’s prevailing interest in the provision of its services 

B

No 

Program and/or course related data (subscription data, attendance data, grades and exams, etc.) 

General management of the programs and/or courses 

Execution of the contract with you and/or in your interest 
For grades and educational history, Legal obligations of IMD  

C

If applicable, your employer and/or company sponsoring the program and/or course 

Other information you would provide us with, especially through your MyIMD account 

Enabling you to follow the program and/or course 
Enabling you to take part in events and conferences organized by or in relation to IMD 
Enhancing your profile within IMD 
Provide you with scholarships 

Execution of the contract with you and/or in your interest 
Your consent for non-compulsory personal data that would be provided 

B

No

Other information you would provide us with

Performance of surveys and assessments in relation to IMD’s programs and courses, as well as development of pedagogical tools

Your consent 

B

No

3. In relation to conferences and other events organized by and/or in relation to IMD
Personal data

Purpose

 Basis

 Principles applied to retention period (for references see para 7)

Transfer to third parties

Identification data (name, surname, date of birth, etc.) 

Management of the conference and/or event

Execution of the contract with you and/or in your interest 
Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference 

B

Speakers  
Other participants to the conference and/or event 
If applicable, catering and/or hosting partners 
If applicable, your employer and/or company sponsoring your participation in the conference or event

Contact details (email address, postal address, etc.)

Management of the conference and/or event 

Execution of the contract with you and/or in your interest 
Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference 

B

Other participants to the conference and/or event for email address 
No

Where applicable, financial data (payment details, payment means, etc.)

Management of the conference and/or event 

Execution of the contract with you and/or in your interest 
Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference 

D

No

Attendance data 

Management of the conference and/or event

Execution of the contract with you and/or in your interest 
Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference 

B

If applicable, your employer and/or company sponsoring your participation in the conference or event 

Other information you would provide us with, especially through the registration documentation

Management of the conference and/or event 
Communication on future events and conferences 

Your consent 

B

If applicable, catering and/or hosting partners 
If applicable, your employer and/or company sponsoring your participation in the conference or event

Other information you would provide us with

Performance of surveys and assessments  

Your consent

B

No

4. In relation to fundraising activities
Personal data

Purpose

 Basis

 Principles applied to retention period (for references see para 7)

Transfer to third parties

Identification data (name, surname, date of birth, etc.) 
Contact details (email address, postal address, etc.) 
Professional data (position, company, professional biography, financial information when available, etc.)

Fundraising activities 

IMD’s prevailing interest in the sourcing of funds

B

In certain limited situations, transfer to third-party fundraising entities

Where applicable, financial data (payment details, payment means, general financial information, etc.)

Fundraising activities 
Follow-up of the payments and donations account 

IMD’s prevailing interest in the sourcing of funds 
After payment, execution of the contract with you.

B

No

Available personal data on social networks

Fundraising activities 

IMD’s prevailing interest in the sourcing of funds

B

No

5. In relation to communication activities (including through social media)
Personal data

Purpose

 Basis

Principles applied to retention period (for references see para 7)

Transfer to third parties

Identification data (name, surname) 
Contact details (email address, postal address, etc.)

Sending of newsletter and general communications on IMD’s activities

Your consent 

A

No 

Available personal data on social networks 
Any further information you provide to us through the social network 

Communication with you 
Management of our relationship 

IMD’s prevailing interest in its communication activities 
In case you contact us through social networks, your consent 

A

No 

6. In relation to business development activities
Personal data

Purpose

 Basis

 Principles applied to retention period (for references see para 7)

Transfer to third parties

Identification data (name, surname) 
Contact details (email address, postal address, etc.) 

Managing IMD’s business development activities 

IMD’s prevailing interest in the development of its activities 

A

No 

Publicly available data (including deriving from social networks) 

Managing IMD’s business development prospecting activities

IMD’s prevailing interest in the development of its activities 

A

No 

7. In relation to the management of the alumni community
Personal data

Purpose

 Basis

Principles applied to retention period (for references see para 7)

Transfer to third parties

Identification data (name, surname) 
Contact details (email address, postal address, etc.) 
History within IMD (programs and courses, grades, conferences, etc.) 

Management of the alumni community 

Execution of the contract with you 

B

Alumni club in your geographical zone 

Identification data (name, surname) 
Contact details (email address, postal address, etc.)

Sending of newsletter and general communications on IMD’s activities

Your consent

B

Alumni club in your geographical zone 

Data on participation into events (attendance, payment details, etc.)

Management of the alumni community

Execution of the contract with you

B

Alumni club in your geographical zone 

8. In relation to research and other scientific activities, as well as analytic activities for clients and participants
Personal data

Purpose

 Basis

 Principles applied to retention period (for references see para 7)

Transfer to third parties

Identification data (name, surname) 
Contact details (email address, postal address, etc.) 

Pursuing research and scientific activities 

Your consent 

A

As the case may be and as specifically communicated to you, partner universities and research institutions

Further personal data as communicated by you 

Pursuing research and scientific activities

Your consent 

A

As the case may be and as specifically communicated to you, partner universities and research institutions

Behavioral and personality data derived from surveys, IT programs or other educational contexts

Provide you with an analysis of aspects of your personality, including professional activity

Your consent

A

If applicable and only if explicitly provided prior to the collection, your employer and/or company sponsoring your participation in the program or situation 

Any personal data contained in filmed interviews 

Pursuing research and scientific activities 

Your consent 

A

As the case may be and as specifically communicated to you, partner universities and research institutions 
As the case may be and as specifically communicated to you, other participants and general public through IMD’s teaching material 

9. Other specific processing activities

a) Pictures videos and audio recordings

During events and conferences, as well as throughout IMD’s programs and activities, pictures and videos may be taken of participants and students. Such pictures and videos constitute an important networking, marketing, and communication tool both for IMD and for participants. In addition, filmed interviews may be used as training and/or research material within IMD’s programs and activities (see above).

Personal data

Purpose

 Basis

Principles applied to retention period (for references see para 7)

Transfer to third parties

Individual photos and filmed interviews, including all personal data provided by you in this context

Communication (including on social networks) 
Teaching and research 

Your consent 

A

As the case may be, other participants and general public through IMD’s teaching material 

General photos and videos (without an individual scope)

Communication (including on social networks) 

IMD’s prevailing interest to communicate on its activities, provided specific information has been given prior to the event 

E

As the case may be, the general public through IMD’s communication activities

b) Statistics

Please note that any personal data that is collected and/or processed by IMD as referred to above may be used to establish and develop statistics. The results of such statistics shall be anonymized as soon as possible.

c) Ad-hoc processing activities

Please note that, in certain specific situations, IMD may implement ad-hoc processing activities that are not (entirely or in part) covered by this general privacy notice. In such a case, You shall be informed of such a specific processing activity with a dedicated information sheet. Such a dedicated information sheet comes in addition to this privacy notice and must be read in connection with it.

5)  Sharing of personal data and international transfers 

As mentioned under par. 4 above, for each category of processing operations, some of your personal data may, under limited circumstances, be disclosed and shared with third parties.  

In addition to the third parties mentioned above, such sharing may also be made with processors and subcontractors who support IMD in performing its services. This is especially the case for the various software used in the context of IMD’s courses and programs to offer you the best and most complete experience in this context, as well as for the continuous improvement of our online services and learning experience. A list of such processors and subcontractors may be made available on request. It is also the case for part of the hosting of our IT environment.   

Transfers may also occur with IMD Affiliates, for example when organizing courses, programs, and events. 

Overall, we never share, sell, or in any other way transmit your data to any third party for commercial purposes without your permission. In any case of transfer of some of your personal data to third parties and processors, any such recipients are contractually prohibited from using or sharing further such personal data for any other purpose than what is contractually provided.  

From a geographical point of view, IMD favors whenever possible processors and hosting facilities located in Switzerland and/or the EEA (for its general personal data). Whenever this is not possible, and such recipients are in a country that does not offer adequate data protection legislation, IMD performs a prior data transfer impact assessment (DTIA) that includes the analysis of alternatives existing in an adequately protected country. Whenever this last possibility is not available, and the transfer has to be made, IMD applies additional safeguards with each recipient, which include inter alia (i) the obligation for the recipient to answer a detailed questionnaire on IT security and data protection, (ii) the signing of Standard Contractual Clauses (SCCs), or the use of another safeguard mechanism that is compliant with applicable law, as well as (iii) the regular review and updating of these mechanisms. 

For IMD Affiliates in China and Singapore, dedicated copies and hosting requirements for personal data may apply, as provided in the applicable specific privacy notice.

Please note that, aside from the above, IMD may also communicate personal data to third parties when we are ordered or obliged to do so because of a court order, governmental authority, and/or by law. In such a situation, IMD shall implement the required means to limit as much as possible the transfer of personal data. You shall also be informed of this unless applicable law prohibits us from doing so. 

Should you have any questions on the above, require any further information, and/or wish to receive a copy of the additional safeguards that apply, please contact us directly. 

6) Security, internet security, and integrity 

Considering the absolute importance of security applied to personal data, IMD is certified ISO 27001 and ISO 27701. In compliance with these two certifications, we take high-end precautions to protect personal data in our possession from loss and misuse as well as unauthorized access, disclosure, alteration, and destruction. We also maintain physical, electronic, and procedural safeguards that comply with applicable laws to safeguard personal data. 

At IMD, we make every effort to follow industry-standard security. However, no data transmitted through the internet and/or stored on servers is 100% secure. As a result, we are unable to guarantee that any personal data covered by this Privacy Notice will be entirely secure. That being said, we do work thoroughly to limit any risks as much as possible. 

7)  IMD principles applied to the retention period 

IMD applies the following principles for the retention of data (letters are used in the applicable modalities for ease of reference). Please note that specific regulations and retention periods may apply to some of our processing activities.

 Basis

 Pniciples applied to retention period (for references see para 7)

A

From the last active contact with IMD we retain data for 10 years for a program participant, or for 2 years otherwise 

B

10 years from the last active contact with IMD 

C

6 months from program completion 

D

1 month from payment 

E

No limitation 

8) Your rights 

Please note that you benefit from various rights, depending on the applicable legal regime to your personal data. Each may be limited based on IMD’s and/or third parties’ legitimate interests or based on other grounds, including IMD’s legal obligations. To exercise them, please contact us by using the contact information provided under par. 1 above. 

  • Information right: See current notice. 
  • Access right: You have the right to receive from IMD confirmation about the actual processing or not of your personal data. If your personal data is processed, you have the right to access such personal data (including to receive a copy). 
  • Rectification right: You have the right to request that your personal data be rectified or completed without undue delay. 
  • Erasure right: You have the right to request the erasure of your personal data without undue delay. 
  • Limitation of processing right: IMD grants you the right to request that your personal data be processed in a limited manner. 
  • Data portability right: IMD grants you the right to retrieve the data you have provided in a structured, commonly used, and machine-readable format, and you have the right to transfer this personal data to another controller. 
  • Right to object: IMD grants you the right at any time to object to the processing of your personal data for reasons deriving from your personal situation, even if this processing concerns IMD’s legitimate interest or public interest.  
  • Possible right to lodge a complaint with a supervisory authority: If you are a resident of Switzerland, the complaint can be lodged at the following address: Swiss Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Berne, Switzerland. For more information please visit www.edoeb.admin.ch

When the processing is based on your consent, you can at any time withdraw it. Please note, however, that in such a case, IMD may be authorized to continue processing your personal data based on another lawful ground. Similarly, the lawfulness of any data processing that occurred before the consent’s withdrawal is not impacted by such withdrawal. 

Access and modification of most of your personal data can be done at any time by accessing your profile on MyIMD. It is your responsibility to ensure that the personal data used in the context of your profile and activities with IMD is up-to-date and correct.  

9) Changes

This Privacy Notice was last updated on 14 June 2023. 

We may update this Privacy Notice at any time. Any changes to it will be posted on this page.