Privacy Policy
1. INTRODUCTION
The Helvetic Institute of Technology in Switzerland needs to create, collect, process, and retain certain information about its employees, workers, students, clients, agents, and other individuals for various purposes. These purposes include managing the progress of students, managing staff, recruiting and employing staff, and complying with legal and statutory regulations. The institution is committed to protecting the rights and freedoms of individuals with respect to managing the personal information that it processes.
This policy sets out the responsibilities and actions that the institution will take to meet this commitment in accordance with its obligations and ensure compliance with the Swiss Federal Act on Data Protection (FADP) and the European General Data Protection Regulation (GDPR).
This policy applies to all staff and students and to all personal data that is created, collected, stored, and processed through the activities of the institution. It also sets out the responsibilities of the institution, its staff, and its students to comply with the provisions of the above-mentioned regulations and laws.
AGSB S.A., Chemin du Levant 5, 1814 La Tour-de-Peilz, Switzerland, is the Data Controller of the personal data you provide to the Helvetic Institute of Technology. The Helvetic Institute of Technology determines the purposes for which, and the manner in which, any personal data is collected and processed. Personal data means any information that relates to an identified or identifiable natural person.
The President of the Helvetic Institute of Technology, Mohamad El Khansa, acts as a representative of the institution and as its Data Protection Officer. His responsibilities include overseeing and monitoring data protection procedures and ensuring compliance with Swiss data protection regulations (such as the Swiss Federal Act on Data Protection of September 1, 2023) and EU data protection regulations (GDPR). He may be contacted at info@helvetictech.ch.
2. THE DATA WE COLLECT
The categories of personal data that we collect and process include those listed below.
In general:
- Personal identifiers (such as name, business affiliation, contact details, and address)
- Payment details
- Content of communications with you
- Engagement with the institution (events attended, interactions, etc.)
- Security information (such as CCTV footage)
- Cookies and website usage data
- Regarding students and their families:
- Personal identifiers (such as name, student number, contact details, and address)
- Characteristics (such as gender, age, language, and nationality)
- Attendance information (classes attended, absences, previous studies)
- Assessment information (grades, tracking, and testing)
- Relevant medical information (insurance, health conditions, allergies, medication)
- Special educational needs information
- Safeguarding information
- Photographs and videos
- Behavioral information
- Student support information
- Residency information (visa details, permits, etc.)
3. WHY WE COLLECT PERSONAL DATA
Personal data is used to manage our relationship with you, communicate with you, and provide requested information. More specifically, data may be used for the following purposes:
- To support student learning
- To monitor and report on student progress
- To provide appropriate care and support
- To assess the quality of our services
- To meet legal and regulatory requirements
- To support admissions processes
- To inform parents about institutional activities
- To investigate concerns or complaints
- To establish, defend, or exercise legal claims
- To manage contractual relationships
- To build and maintain the institutional community
- To communicate services, news, and events
- To respond to alumni requests
Personal data may also be used for any purpose for which you give explicit consent or where there is a legitimate institutional interest.
Most personal data is provided by you during admissions or during your relationship with the institution. Some data may also be obtained from public sources or third parties where permitted.
When submitting personal data, please ensure it is accurate. If you provide data about another person, you must have permission and ensure they are aware of this policy.
Some personal data is mandatory to fulfil contractual obligations, while other data may be optional.
4. SPECIAL RULE ON CAMERA SURVEILLANCE, PHOTOGRAPHS, AND VIDEOS
The campus is under CCTV surveillance for security reasons. Video footage is retained for up to 30 days unless required for investigation or legal purposes.
Photographs and videos may be taken during academic activities. These may be used for educational, internal, or marketing purposes, where consent is required.
5. DATA PROTECTION PRINCIPLES
The institution follows these principles:
- Personal data is processed fairly and lawfully
- Data is collected for specific and legitimate purposes
- Processing is proportionate and done in good faith
- Data is adequate, relevant, and not excessive
- Data is accurate and kept up to date
- Data is not kept longer than necessary
- Data is processed in line with FADP and GDPR rights
- Appropriate security measures are applied
- Data is not transferred without adequate protection
6. DEFINITIONS
- Personal data: any information relating to an identifiable person.
- Sensitive data: includes health, biometric, and other protected categories.
- Processing: any operation performed on personal data.
- Data controller: entity determining how data is used.
- Data processor: entity processing data on behalf of the controller.
7. ROLES AND RESPONSIBILITIES
All Data Processors must read this policy and ensure that any processing of personal data is carried out in accordance with the data protection principles and the policies of the Helvetic Institute of Technology.
Line Managers are responsible for ensuring that their teams comply with this policy and apply the data protection principles in their daily activities.
The Helvetic Institute of Technology is responsible for ensuring that all documents used to collect personal data (such as staff contracts, application forms, and surveys) include appropriate data protection notices. These notices must clearly inform data subjects about what data is collected, the purpose of collection, and how it may be used or disclosed.
The Helvetic Institute of Technology maintains a record of processing activities in accordance with applicable legal requirements.
All staff and students must ensure that personal data is handled securely and is not disclosed to unauthorized third parties.
Any questions regarding data protection should be directed to the administration of the Helvetic Institute of Technology.
Students must comply with this policy when processing personal data as part of their studies and may only do so with the knowledge and explicit consent of an appropriate staff member.
Students are responsible for ensuring compliance with this policy when collecting or using personal data in academic work.
Students must obtain prior approval from the Research Committee before conducting any research involving personal data or human participants, in accordance with institutional regulations.
8. RIGHTS OF THE DATA SUBJECTS
Under applicable data protection legislation, individuals have rights regarding their personal data processed by the Helvetic Institute of Technology.
These rights include:
- The right to be informed about the processing of personal data
- The right of access to personal data
- The right to rectification of inaccurate or incomplete data
- The right to erasure, where applicable
- The right to restrict processing
- The right to data portability
- The right to object to processing
- Rights related to automated decision-making and profiling
- The right to data security and confidentiality
Individuals may request:
- Information about their personal data
- A copy of their personal data in a structured, commonly used format
- Correction or deletion of their personal data
Where processing is based on consent, individuals may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
These rights may be limited where necessary to protect overriding legitimate interests or comply with legal obligations.
Individuals also have the right to lodge a complaint with the competent supervisory authority in Switzerland, the Federal Data Protection and Information Commissioner.
The Helvetic Institute of Technology ensures appropriate procedures are in place to facilitate these rights.
9. STORING PERSONAL DATA
Personal data is stored in compliance with the Swiss Federal Act on Data Protection and the GDPR.
Data may be stored on servers located in Switzerland, EU/EFTA countries, and the United States, provided appropriate safeguards are in place.
The Helvetic Institute of Technology implements technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration.
Personal data is retained only for as long as necessary to fulfill the purposes outlined in this policy or to comply with legal and contractual obligations.
10. DATA SHARING
The Helvetic Institute of Technology restricts access to personal data to authorized individuals who require it to perform their duties.
Personal data may be shared with:
- Service providers necessary for operations (e.g., IT, payment processing)
- Educational and academic partners
- Local, cantonal, and federal authorities
- Accreditation or regulatory bodies
- Auditors
- Health authorities
- Law enforcement or judicial authorities
Where necessary, personal data may also be shared with students’ families or representatives, in accordance with applicable laws.
All third parties receiving personal data are required to process it securely and only for authorized purposes.
International transfers of personal data are limited to jurisdictions with adequate protection or subject to appropriate safeguards, such as standard contractual clauses recognized under Swiss law.
11. DATA SECURITY
The Helvetic Institute of Technology ensures that personal data is protected through appropriate security measures, including:
- Password protection and access controls
- Encryption and secure storage systems
- Physical security measures for paper records
Personal data must not be retained longer than necessary and must be securely destroyed when no longer required.
Special care must be taken when handling personal data on portable devices. Such data must not be stored on unsecured or non-encrypted devices.
In the event of a data breach (including loss, unauthorized access, or disclosure), staff must immediately inform the administration of the Helvetic Institute of Technology.
All breaches must be promptly contained, assessed, and managed in accordance with internal procedures. A Data Protection Impact Assessment may be conducted where required.
Communication regarding data breaches will be handled centrally by the Helvetic Institute of Technology.
12. ACCOUNTABILITY AND GOVERNANCE
The Helvetic Institute of Technology implements appropriate technical and organizational measures to ensure and demonstrate compliance with data protection laws.
These measures include:
- Data minimization
- Privacy-by-design and by-default principles
- Controlled access to personal data
Processing activities are limited to what is necessary for specific purposes.
Requests from external individuals regarding access, correction, deletion, portability, or objection must be submitted through official communication channels of the Helvetic Institute of Technology.
The administration of the Helvetic Institute of Technology is responsible for overseeing compliance and implementing data protection policies.
13. WEBSITE ANALYTICS
The Helvetic Institute of Technology uses analytics tools such as Google Analytics to monitor website usage and improve user experience.
Collected data may include:
- IP address (anonymized where applicable)
- Device and browser type
Geographic region
Pages visited and time spent
This data is aggregated and does not directly identify individuals.
Users may opt out of analytics tracking through browser settings or tools provided by analytics providers.
The website of the Helvetic Institute of Technology may use cookies to enhance user experience. Cookies are small text files stored on a user’s device.
Users may accept or decline cookies through their browser settings. Disabling cookies may impact website functionality.
The website may contain links to external websites. The Helvetic Institute of Technology is not responsible for the privacy practices of third-party sites.