As part of its academic, research and continuing education activities, the Institute collects and processes your personal data when you browse the website, fill in registration forms or interact with the Institute while on the website.
In accordance with applicable legislation, the Institute is committed to respecting your privacy and protecting your personal data.
The responsible and lawful processing of personal data is a central concern of the Institute. It ensures that personal data is processed in accordance with the principles of lawfulness, purpose, proportionality, good faith, security, privacy and transparency. Our policy on the processing of personal data (hereinafter referred to as "Policy") describes how we handle your data.
By using our website and our services you acknowledge that you have read the terms of this Policy.
We process your personal data only for the purpose for which it was provided and in compliance with applicable data protection laws, in particular the Federal Act on Data Protection (LPD in French). For certain processing operations, pursuant to Art. 3 para. 2 of the GDPR, we are subject to the General Data Protection Regulation.
The processing of personal data needs to be justified by legal bases. At the Institute, processing operations are based on one or more of the following legal bases:
- Consent provided (for example when subscribing to a newsletter)
- Fulfilling a contract agreement with you (for example, when recruiting personnel)
- Compliance with a legal obligation (e.g. the transmission of information to the Cantonal Tax Office )
- Protection of the legitimate interests of the Institute (e.g. advertising for our training courses)
- Execution of a mission of public interest (e.g. academic monitoring of students)
Where legitimate interests constitute the legal basis for the processing, the justification of these legitimate interests can be obtained on request from : firstname.lastname@example.org
- Consent: an unambiguous expression of will, which is free, specific to a processing operation and derives from prior information, whereby in a clear and positive act a data subject agrees that his/her personal data can be processed
- Data controller: any person who decides on the purpose and means of processing personal data
- Data processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller
- Data subject: any identifiable or identified natural person whose personal data are processed by the data controller
- Personal data: any information allowing the direct or indirect identification of a natural person (referred to as the data subject)
- Processing: any operation on personal data (in particular collection, recording, use, processing, modification, storage, retrieval, consultation, transmission, erasure)
4.Data controller of personal data
All your personal data processed by the Institute in the context of this Policy are controlled by the Institute, which is considered to be the data controller.
Our address is as follows:
- Graduate Institute of International and Development Studies
- Chemin Eugène-Rigot 2A
- Case postale 1672
- CH- 1211 Genève 1
5.The categories of data we process
As part of your use of our services, we collect and process various categories of personal data about you.
- Contact and identification data such as your last name, first name, title, address, email address, telephone number, identification number
- Personal data such as date of birth, gender, nationality, place of birth, residence status, marital status, language, photo, copy of ID
- Data on career and education such as CV, education, diplomas obtained, previous studies, letters of recommendation, references
- Data produced during your studies such as scores, evaluation, questionnaire results
- Financial data such as bank account information, payment information, income, tax situation, stock exchange
- IT user account data such as username, password
- Interaction and usage data such as correspondence, chat and webinar content, information on "customer" segment (applicants, candidates, subscribers, alumni) and target group, user preference feedback, device type, operating system, software, information from claiming rights
- Website data such as browser settings, IP address, cookie information, frequency and duration of visits, search terms, clicks on content. Usage data is not associated with personal data.
- Data obtained through third parties such as personal data we legally obtain on a regular basis from affiliated entities, business partners and other independent third parties. We add this information to the information we already have in our databases.
6.For what purposes are your personal data processed?
We process your personal data for the following purposes:
- Recruitment of candidates for study programmes (including executive education)
- Administrative aspects of the education of students during their studies
- Management of support services for students (IT, library, housing, financial aid, career ...)
- Alumni community follow-up
- Recruitment of academic and administrative staff
- Personnel management
- Training management
- Promotion of institutional activities and information
- Video surveillance and security
We do not use your personal data for purposes other than those set out above unless we are required to do so by law. If we need to use your data for other purposes, we will inform you.
7.With whom do we share your personal data?
The Institute shares your data only under certain circumstances and in accordance with the provisions of the applicable regulations or with your consent.
Your personal data can be shared:
- Internally for the needs of certain services (e.g. Centres, Research Office)
- With third party service providers who process personal data on behalf of the Institute and with whom the issue of personal data is dealt within the contracts (e.g. hosting, storage, database management or computer maintenance services)
- With academic partners subject to obtaining the consent of the data subjects (e.g. University of Geneva)
- With institutions or entities with which the Institute may collaborate on various subjects (e.g. Swiss Political Science Association)
- With administrative authorities in the context of fulfilling legal obligations (e.g. Cantonal Tax Office)
When third party service providers have access to your data, they only collect the data necessary for the execution of their tasks. They are prohibited from sharing or using the data for any other purpose.
8.International data transfers
We may share certain personal data abroad in the following cases:
- Collaboration with academic partners in the context of exchanges or internships
- Transfer to data processor who, as service providers, process personal data on behalf of the Institute
In cases where a transfer takes place outside the EU/EEA to a data controller/data processor, the Institute ensures that your personal data is transferred to countries offering adequate protection and/or are protected by sufficient safeguards, including the standard contractual clauses adopted by the European Commission.
9.How long do we keep your personal data?
We process and store your data for as long as we need them to fulfil our contractual or legal obligations, or for as long as they are necessary for the purposes for which we collected them, or as long as our legitimate interests continue to exist or consent has not been withdrawn.
In certain circumstances, we may be required to retain your personal data for a longer time due to legal requirements or for statistical purposes. In the latter case, the data is anonymized and you can no longer be identified.
Details of data retention periods are provided in the annexes.
10.Security and protection of personal data
Data security is one of the Institute's priorities. The Institute takes all reasonable administrative and technical measures to prevent any unauthorised disclosure and use, alteration or erasure of data.
11.What are your rights and how can you exercise them?
- The right of access and information: You can ask what data concerning you is kept at the Institute and receive a copy. You also have the right to obtain information on the purpose of the processing, the data concerned by the processing, the recipients, the storage period, the rights you may exercise over the processing of your data, the sources used for the collection of the data and the transfer of the data if applicable.
- The right to rectify the data: You may request at any time the modification of your personal data that you believe is inaccurate or not up to date.
- The right to erasure: Also known as the right to be forgotten. You may request the deletion of data concerning you at any time, unless the data are still necessary for the purposes for which they were collected, their retention is required by law, or their retention is necessary for archiving for statistical and historical purposes.
In this context, the Institute cannot guarantee the general erasure of data and we must take into account the technologies available and the cost of their implementation.
- The right to restriction of processing: You may request the limitation of the processing of your data when one of the following applies: you dispute the accuracy of the data collected, the processing is unlawful but you do not wish to exercise your right to erase the data, the data is no longer necessary for processing but you wish us to retain it for the exercise of a legal right, or you dispute a processing operation and you request a limitation of the processing pending the resolution of the dispute.
- The right to data portability: You may be entitled to obtain your personal data in a structured, commonly used and machine-readable form in order to transfer it to another data controller. This right applies where processing of personal data (supplied by the data subject) is carried out by automated means, and where you have either consented to processing, or where processing is conducted on the basis of a contract between you and the data controller.
- The right to complain to a supervisory authority: located in the Member State where you live, work or where the breach occurred if you believe that a breach of applicable law has occurred in the processing of your personal data.
- The right to object the processing: You may object to the processing of data concerning you, provided that a legitimate reason is given. The Institute may object by demonstrating that there are legitimate and compelling reasons which prevail over your interests and rights. In certain cases, we process your personal data for prospecting purposes, you have the right to object to such processing at any time.
- The right to withdraw consent: You have the right to withdraw a consent to the processing of your personal data at any time.
12.Does the Institute engage in profiling?
The Institute does not use automated decision making or profiling.
14.How to contact us
For Swiss and other non-EEA individuals:
If you need to exercise your data protection rights, you can contact us by sending an email to: email@example.com or by post to the attention of the IT Service Desk at the following address:
- Graduate Institute of International and Development Studies
- Chemin Eugène-Rigot 2A
Case postale 1672
CH- 1211 Genève 1
For EEA based individuals:
If you are an EEA individual and need to exercise your data protection rights or have a request relating to your data, you can also contact our representative in the EU, IDEA AARPI, which has been appointed in accordance with article 27 of the GDPR for the processing of personal data covered by this Policy. You can do so:
In some cases, you may need to provide us with personal information (for example, a copy of your passport) to verify your identity.
We will do our best to satisfy your request within the legal time limit (30 days). However, the processing time may be extended for specific reasons related to the basis or complexity of your request. If this is the case, you will be informed.
If you have any questions or uncertainties about our use of your personal data, you can send an email to the Data Protection Officer at firstname.lastname@example.org or by post to the attention of the Data Protection Officer using the contact details mentioned above.
The Policy is effective as of the date of the last modification indicated. The policy is available in French and in English. In any case, the French version shall prevail.