Privacy Notice
This Privacy Notice describes how your personal data is processed by the IMD – Scholarship Foundation (hereafter referred to as the “Foundation” or “we” or “us”).
1) The Foundation’s role and contact details
The IMD Scholarship Foundation is a Swiss-based foundation established in Lausanne, Vaud, that may be contacted with the following information:
IMD – International Institute for Management Development
Chemin de Bellerive 23
CH – 1007 Lausanne
In the context of this Privacy Notice, the Foundation is the controller of your personal data. As a Swiss based foundation, we are directly subject to the Swiss Federal Act on Data Protection (“FADP”).
2) Scope of the Privacy Notice
This Privacy Notice applies to all processing activities that are implemented by the Foundation in the context of its activities, especially in relation to:
- The Foundation’s webpages, and other IT platforms (hereafter together the “Online Platforms”);
- Fundraising activities;
- Communication activities;
- Management of scholarships, donor and prospect relations;
- Statistical activities.
Please note that a specific privacy notice applies for the specific processing activities linked to board members of the Foundation.
3) Definitions
4) Applicable modalities to the processing activities
(Categories of personal data, purpose, basis, retention period, and transfer to third parties)
In this chapter, we detail the applicable modalities to the processing activities, being underlined that it chooses to apply a specific basis for each category of processing operation. It is also specified that the transfers to “third parties” that are listed hereunder do not include processors of the Foundation, who are mentioned and listed under par. 5.
The Foundation’s Online Platforms are managed by IMD – International Institute for Management Development (“IMD”), who functions here as an independent data controller for the information automatically collected. The Foundation itself does not personally process the personal data collected through the Online Platforms. As a consequence, you may consult:
- IMD’s privacy notice for all information on their processing of personal data in relation to Online Platforms; and
- IMD’s cookie policy for all information relating to their use of cookies, trackers and/or online pixels, as well as to know how to communicate your choice regarding the personal data collected through them.
For ease of transparency, please find hereafter a list of the personal data collected by IMD through the Online Platforms:
5) Sharing of personal data and international transfers
As mentioned under par. 4 above for each category of processing operations, some of your personal data may under limited circumstances be disclosed and shared with third-parties.
Overall, the Foundation is assisted by IMD for all of its activities under this privacy notice. Except for the automatic processing activities linked to the Online Platforms (see par. 4. Aa above), for which IMD is the sole data controller, as well as for limited information linked to the scholarship itself (see par. 4. B above), for which IMD may also act as a controller, IMD functions as a data processor for the Foundation in relation to the Foundation’s fundraising activities. Please note that IMD may, for some specific processing activities, function as an independent controller (e.g. organization of events, specific fundraising activities through its programs, etc.).
In addition, sharing may also be made with processors and subcontractors who support the Foundation in performing its services. This is especially the case for the various software that are used in the context of the Foundation’s purpose, to offer you the best and most complete experience in this context, as well as for continuous improvement of our online services. A list of such processors and subcontracts may be made available on request. It is also the case for part of the hosting of our IT environment.
Overall, we never share, sell or in any other way transmit your data to any third-party for commercial purposes without your permission. In any cases of transfer of some of your personal data to third-parties and processors, any such recipient are contractually prohibited from using or sharing further such personal data for any other purpose than what is contractually provided.
From a geographical point of view, the Foundation favors whenever possible processors and hosting facilities located in Switzerland and/or the EEA (for its general personal data). Whenever this is not possible, and that such recipients are in a country that does not offer adequate data protection legislation, the Foundation performs a prior data transfer impact assessment (DTIA) that includes the analysis of alternatives existing in an adequate country. Whenever this last possibility is not available, and the transfer has to be made, the Foundation applies additional safeguards with each recipient, which include inter alia (i) the obligation for the recipient to answer a detailed questionnaire on IT security and data protection, (ii) the signing of Standard Contractual Clauses (SCCs) or the use of another safeguard mechanism that is compliant with applicable law, as well as (iii) the regular review and updating of these mechanisms. Regarding specifically recipients based in the US, the Foundation follows closely the current evolutions linked to the Data Privacy Framework.
Please note that, aside from the above, the Foundation may also communicate personal data to third-parties when we are ordered or obliged to do so because of a court order, governmental authority and/or by law. In such a situation, the Foundation shall implement the required means to limit as much as possible the transfer of personal data. You shall also be informed of this, unless applicable law prohibits us from doing so.
Should you have any question on the above, require any further information and/or wish to receive a copy of the additional safeguards that apply, please contact us directly.
6) Security, internet security, and integrity
We take high-end precautions to protect personal data in our possession from loss and misuse as well as unauthorized access, disclosure, alteration and destruction. We also maintain physical, electronic and procedural safeguards that comply with applicable laws to safeguard personal data.
At the Foundation we make every effort to follow industry standard security. However, no data transmitted through the internet and/or stored on servers is 100% secure. As a result, we are unable to guarantee that any personal data covered by this Privacy Notice will be entirely secure. That being said, we do work thoroughly to limit as much as possible any risks.
7) The Foundation Principles applied to Retention Period
The Foundation applies the following principles for retention of data (Letters are used in the applicable modalities for ease of reference):
Basis | Pniciples applied to retention period (for references see para 7) |
A | From the last active contact with the Foundation we retain data for 10 years for a donor or scholarship recipient, or for 2 years otherwise |
B | 10 years from the last active contact with the Foundation |
8) Your rights
Please note that you benefit from various rights, depending on the applicable legal regime to your personal data. Each may be limited based on the Foundation’s and/or third-parties’ legitimate interests or based on other grounds, including the Foundation’s legal obligations. To exercise them, please contact us by using the contact information provided under par. 1 above.
- Information right: See current notice.
- Access right: You have the right to receive from the Foundation confirmation about the actual processing or not of your personal data. If your Personal data is processed, you have the right to access such personal data (including to receive a copy).
- Rectification right: You have the right to request that your personal data be rectified or completed, without undue delay.
- Erasure right: You have the right to request the erasure of your personal data without undue delay.
- Limitation of processing right: the Foundation grants you the right to request that your personal data be processed in a limited manner.
- Data portability right: the Foundation grants you the right to retrieve the data you have provided, in a structured, commonly used and machine-readable format, and you have the right to transfer this personal data to another controller.
- Right to object: the Foundation grants you the right at any time to object to the processing of your personal data for reasons deriving from your personal situation, even if this processing concerns the Foundation legitimate interest or public interest.
- Possible right to lodge a complaint with a supervisory authority: If you are a resident of Switzerland, the complaint can be lodged at the following address: Swiss Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Berne, Switzerland. For more information please visit www.edoeb.admin.ch.
When the processing is based on your consent, you can at any time withdraw it. Please note however that in such a case, the Foundation may be authorized to continue processing your personal data, based on another lawful ground. Similarly, the lawfulness of any data processing occurred before the consent’s withdrawal is not impacted by such withdrawal.
Access and modification of most of your personal data can be done at any time by emailing [email protected].
9) Changes
This Privacy Notice was last updated on 11/07/2024
We may update this Privacy Notice at any time. Any changes to it will be posted on this page.