Executive School of Management, Technology and Law (ES-HSG)
University of St.Gallen | November 2026

Privacy Policy for Executive Education at the University of St.Gallen (ES-HSG)

1. Scope & Purpose

This Privacy Policy provides information on how the University of St.Gallen processes personal data within the framework of its executive education programs, including legal bases, purposes, recipients, and data subject rights.

This policy applies to all executive education offerings of the University of St.Gallen and its organizational units, specifically the Executive School (ES-HSG), institutes, and schools. It covers:

  • Websites & Portals: websites, forms, and portals of these executive education programs (e.g., es.unisg.ch);
  • Programs & Services: advising, application, admission, and execution of programs (EMBA, MBA, Master, Diploma, and Certificate programs, open and customized courses);
  • Events & Communications: associated events, newsletters, and social media channels.

This policy supplements the general Privacy Policy of the University of St.Gallen. In case of discrepancies, specific terms prevail. The German text is legally binding.

2. Controller and Contact Information

The Data Controller responsible for data processing is the University of St.Gallen (Dufourstrasse 50, CH-9000 St.Gallen). Institutes and the Executive School are organizational units of the University.

Central contact point for executive education:

  • Executive School (ES-HSG): Rosenbergstrasse 20–22, 9000 St.Gallen, Switzerland | Email: datenschutz@unisg.ch
  • DPO / Data Protection Office CH: datenschutz@unisg.ch
  • EU Representative (Art. 27 GDPR): Attorney Frank Diem, fdiem@diempartner.de

3. Applicable Law

The University of St.Gallen is an autonomous public law institution of the Canton of St.Gallen. Primary applicable laws include:

  • University Act (UG, sGS 217.1): specifically Art. 2 (Mandate), Art. 12 (Data Processing), and Art. 13 (Disclosure);
  • Cantonal Law: Cantonal Data Protection Act of St.Gallen (DSG SG, sGS 142.1) and University Statutes;
  • Federal Law: Swiss Federal Act on Data Protection (FADP) and Art. 45c Telecommunications Act (FMG) for cookies;
  • EU GDPR: EU General Data Protection Regulation, insofar as we offer services to individuals in the EU/EEA or monitor their behavior (Art. 3(2) GDPR).

  1. Principles of Data Processing

Personal data is processed lawfully, fairly, and transparently based on statutory mandates, contractual fulfillment, legal obligations, or explicit consent (Privacy by Design and Default). Admission decisions are always made by humans; no automated decision-making takes place.

  1. Categories of Data & Origin

We process contact data, professional background, application records, academic performance, billing details, communication logs, event media, and technical usage data (IP addresses, cookies). Data is collected directly from you, your employer, references, or partner universities.

  1. Prospective Students, Advising & Information Events

When requesting brochures, booking consultations, or attending info sessions, we process your contact details in our CRM systems (primarily HubSpot and Full Fabric).

Legal Basis: Public education mandate (UG); pre-contractual measures (Art. 6(1)(b) GDPR); legitimate interest in effective advising (Art. 6(1)(f) GDPR). Inactive prospect data is deleted or anonymized after 24 months.

  1. Application and Admission

Application data submitted via our portal (Full Fabric) is processed for eligibility evaluation. Records of rejected applicants are erased after 12 months unless extended storage consent is granted.

  1. Programme Execution & Academic Records

Program management utilizes Canvas LMS (Instructure Global Ltd, UK; hosted in the EU). Academic certificates and degrees are retained permanently for degree verification. Accounting records are retained for 10 years.

  1. Corporate & Customised Programmes

For corporate clients, participation confirmations may be disclosed to the sponsoring employer as contractually agreed. Individual coaching content or personal feedback is never shared without explicit consent.

  1. Alumni & Community

Upon graduation from qualifying programs, contact details are shared with the independent association HSG Alumni (alumni@unisg.ch) pursuant to Art. 13(3) UG. You may object to this transfer at datenschutz@unisg.ch. Data sharing for rankings (e.g., Financial Times) occurs strictly upon opt-in consent.

  1. Events, Photography & Video Recordings

Media captured at events is stored for a minimum of 24 months or indefinitely based on consent. Individual portrait publication requires explicit opt-in consent.

  1. Newsletters & Marketing Communications

Direct newsletter subscriptions require Double Opt-in (Consent, Art. 6(1)(a) GDPR). For fee-paying participants and alumni, updates regarding similar courses are sent based on legitimate interest (Art. 6(1)(f) GDPR in conjunction with Art. 3(1)(o) UWG; existing customer relationship). For participants of free webinars or events, further informational communications are sent exclusively upon explicit Double Opt-in consent. An unsubscribe link is provided in every email.

Service Providers: HubSpot Ireland Limited (Dublin; EU Data Hosting) for CRM/email, and MailerLite Limited (Dublin; EU Data Hosting) for newsletter dispatch. Email performance tracking can be disabled or requested via datenschutz@unisg.ch.

  1. Website, Cookies & Infrastructure

Hosted by Hostpoint AG (Rapperswil-Jona, Switzerland). We use Google Tag Manager (GTM-5J738GB) for script deployment. We categorize cookies into:

  • Essential Cookies: for core functionality, security (e.g., Google reCAPTCHA), and consent management.
  • Analytics Cookies: for usage and performance measurement (Section 14).
  • Marketing Cookies: for ad conversion tracking, retargeting, and audience building on third-party platforms (Section 14).
  • External Media: for embedded media such as YouTube videos.

Cookie consent is managed via OneTrust (OneTrust Technology Limited, UK; 12-month retention via OptanonConsent, OptanonAlertBoxClosed). Non-essential cookies require prior user opt-in.

We deploy the HubSpot Tracking Code (Portal 25191048; cookies hubspotutk, __hstc, __hssc, __hssrc) to analyze website traffic and recognize visitors arriving from email link clicks.

Form submissions are handled via Fluent Forms (WordPress plugin; data stored on Hostpoint AG servers). Google reCAPTCHA (_GRECAPTCHA cookie) is integrated for anti-spam protection.

  1. Web Analytics & Marketing Tracking

Analytics and Marketing tracking services are deployed strictly with user consent (Art. 6(1)(a) GDPR; Art. 45c FMG).

Google Analytics 4 (Analytics): Measurement IDs G-VHF99RJPQK and G-E77VFBYB09. Deployed with user consent via server-side tracking (Server-Side GTM via Stape; server container sgtm.es.unisg.ch, server location France/EU). Within GA4, Google Signals and personalized advertising features are disabled; IP addresses are discarded. Event retention: 14 months. Cookies: _ga, _ga_*.

Matomo (Analytics): Tracker es-matomo.diseluba.myhostpoint.ch (cookies _pk_id, _pk_ses). Matomo is self-hosted at Hostpoint AG in Switzerland for privacy-compliant usage statistics.

Google Ads (Marketing): Conversion tracking (AW-11404524616, AW-408480862), Conversion Linker, and Remarketing (AW-18092074719) measure ad effectiveness directly client-side via browser. Cookies: _gcl_au, _gcl_aw.

LinkedIn Insight Tag (Marketing): Partner ID 5652906. Tracks conversions, retargeting, and demographics directly client-side via browser. Cookies: li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_fat_id.

Meta Pixel (Marketing): Tracks form submissions (InfoEventSubmit) and builds custom audiences on Facebook and Instagram directly client-side via browser. Cookies: _fbp, _fbc.

  1. Video Conferencing, Cloud Services & AI Tools

We use Zoom (Zoom Communications, Inc.) and Microsoft Teams for online sessions. Office collaboration relies on Microsoft 365 (Microsoft Ireland Operations Ltd.) with core data residing in Switzerland.

Where employees utilize approved AI tools (e.g., Microsoft 365 Copilot) for administrative or educational tasks, processing strictly follows institutional HSG governance rules. Personal data is not used to train public AI models. Automated decision-making does not take place.

  1. Social Media & Embedded Content

We maintain profiles on LinkedIn and YouTube. Embedded YouTube videos load via standard mode upon consenting to external media.

  1. Third-Party Disclosures

Personal data is disclosed strictly for defined purposes to university units, partner institutions, instructors, event venues, and vetted data processors:

  • CRM & Application Portal: FULL FABRIC, S.A. (Portugal), HubSpot Ireland Limited (Ireland).
  • Email & Newsletters: HubSpot Ireland Limited, MailerLite Limited (Ireland).
  • Web Hosting & Analytics Infrastructure: Hostpoint AG (Switzerland), Stape Europe (Server container sgtm.es.unisg.ch in France/EU).
  • LMS & Forms: Instructure Global Ltd (Canvas, UK/EU), Fluent Forms / Hostpoint AG.
  • Alumni: Association HSG Alumni (Switzerland).

  1. International Data Transfers

Data processing occurs primarily in Switzerland and the EU. Transfers to third countries – particularly the USA – occur through the use of global cloud and marketing providers (Google LLC, Meta Platforms, Inc., LinkedIn Corp., HubSpot, Inc., Zoom Video Communications, Inc., OneTrust). These transfers rely on the Swiss-US Data Privacy Framework (DPF), the EU-US DPF, and Standard Contractual Clauses (SCCs). For international study modules, transfers occur to partners in the respective destination countries (e.g., USA, China, Singapore).

  1. Retention Summary

Data Category Retention Period
Inactive Prospects 24 months
Rejected Applications 12 months
Participant Dossier & Financials 10 years (Art. 958f Code of Obligations)
Degree Verification Records Permanent
Event Photos and Videos Min. 24 months / Indefinite (per consent)
Cookie Consent (OneTrust) 12 months

  1. Data Security & Subject Rights

Data is secured via appropriate technical and organizational measures (need-to-know access, encryption, MFA). You hold rights to access, rectification, erasure, restriction, objection, and consent withdrawal. Requests should be sent to datenschutz@unisg.ch. Cantonal Supervisory Authority in Switzerland: Fachstelle für Datenschutz Kanton St.Gallen (Klosterhof 7, 9001 St.Gallen).