Privacy Notice

This Privacy Notice describes how your personal data is processed by the International Institute for Management Development (hereafter referred to as “IMD” or “we” or “us”), as well as, where applicable, IMD affiliates.

1) IMD’s role and contact details

IMD’s main establishment is the International Institute for Management Development (IMD), a Swiss-based foundation established in Lausanne, Vaud, that may be contacted with the following information:

IMD – International Institute for Management Development

Chemin de Bellerive 23

CH – 1007 Lausanne

[email protected]

IMD operates two branches in Singapore and Shenzhen (China), which qualify in the context of this Privacy Notice as “IMD Affiliates”. Specific privacy notices (apply whenever IMD Affiliates directly collect your personal data, please click for Singapore).

In the context of this Privacy Notice, IMD is the controller of your personal data. As a Swiss-based foundation, IMD is directly subject to the Swiss Federal Act on Data Protection (“FADP”).

2) Scope of the Privacy Notice

This Privacy Notice applies to all processing activities that are implemented by IMD in the context of its activities, especially in relation to:

IMD’s website (IMD.org) and other IT platforms as well as IMD’s mobile applications (hereafter together the “Online Platforms”)
Programs and courses, in person and/or online (including any assessments, reports, or other pedagogical tools)
Conferences and other events organized by and/or in relation to IMD
Fundraising and networking activities
Communication activities, including newsletters, as well as IMD’s presence on social networks
Management of the alumni community
Research and other scientific activities (including statistics)
Statistical activities

Please note that a specific privacy notice shall apply for employment-related processing activities as well as for the specific processing activities linked to board members of IMD.

3) Definitions

IMD affiliates

means the two branches operated by IMD in Singapore and Beijing (China).

Personal data

means any identified or identifiable information relating to a natural person.

Processing

means any activity linked to personal data implemented by IMD and/or by its processors, including collection, storage, sharing, using, and analyzing.

Processor

means the third-party person or entity who processes personal data on behalf of IMD.

Third-party

means any person other than IMD and IMD Affiliates, not including processors where mentioned under par. 4 hereunder.

4) Applicable modalities to the processing activities
(Categories of personal data, purpose, basis, retention period, and transfer to third parties)

In this chapter, IMD details the applicable modalities to the processing activities, being underlined that it chooses to apply a specific basis for each category of the processing operation. It is also specified that the transfers to “third parties” that are listed hereunder do not include processors of IMD, who are mentioned and listed under par. 5.

For further detail, please choose hereunder the chapter that relates to the processing operation you are interested in.

a) Information automatically collected

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Browsing-related data (including pages visited, path on a webpage)	Analytical purposes Enhancing our services, webpages and experience	Your consent	A	No
Device-related data (including hardware model, operating system version or unique device identifier)	Security purposes	Prevailing IMD interest	A	No
Log information (including your internet protocol address and device and event information, which can include crashes as well as system activity)	Analytical purposes Security purposes	Your consent for analytical purposes Prevailing IMD interest for security purposes	A	No
Geographical location	Functioning of certain applications Services provided through the application	Your consent for the use of the systems Prevailing IMD interest for security purposes	A	No

For information relating to our use of cookies, trackers, and/or online pixels, as well as to know how to communicate to us your choice regarding the personal data collected through them, please refer to our cookie policy. Please note that, when allowing third-party cookies on your browser, such third parties may themselves collect personal data for their own purposes.

b) Information communicated by you

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
As communicated by you	Creation and management of your personal account (MyIMD)	Execution of the contract with you and/or in your interest Your consent for non-compulsory personal data that would be provided	A	No
As communicated by you	Answer questions and/or remarks you would have	Your consent IMD’s prevailing interest for managing its requests and files	A	No

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Identification data (name, surname, date of birth, etc.) Contact details (email address, postal address, emergency contact person and details, etc.) Where applicable, financial data (payment details, payment means, etc.)	Enabling you to follow the program and/or course General management of the programs and/or courses	Execution of the contract with you and/or in your interest	B	Other Participants in the same program cohort for limited identification and contact details
Professional data (position, company, professional biography, financial information when available, etc.)	Tailor the programs and/or courses Enable networking among students and participants	IMD’s prevailing interest in the provision of its services	B	No
Program and/or course related data (subscription data, attendance data, grades and exams, etc.)	General management of the programs and/or courses	Execution of the contract with you and/or in your interest For grades and educational history, Legal obligations of IMD	C	If applicable, your employer and/or company sponsoring the program and/or course
Other information you would provide us with, especially through your MyIMD account	Enabling you to follow the program and/or course Enabling you to take part in events and conferences organized by or in relation to IMD Enhancing your profile within IMD Provide you with scholarships	Execution of the contract with you and/or in your interest Your consent for non-compulsory personal data that would be provided	B	No
Other information you would provide us with	Performance of surveys and assessments in relation to IMD’s programs and courses, as well as development of pedagogical tools	Your consent	B	No

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Identification data (name, surname, date of birth, etc.)	Management of the conference and/or event	Execution of the contract with you and/or in your interest Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference	B	Speakers Other participants to the conference and/or event If applicable, catering and/or hosting partners If applicable, your employer and/or company sponsoring your participation in the conference or event
Contact details (email address, postal address, etc.)	Management of the conference and/or event	Execution of the contract with you and/or in your interest Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference	B	Other participants to the conference and/or event for email address No
Where applicable, financial data (payment details, payment means, etc.)	Management of the conference and/or event	Execution of the contract with you and/or in your interest Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference	D	No
Attendance data	Management of the conference and/or event	Execution of the contract with you and/or in your interest Exceptionally (in the absence of any contract), IMD’s prevailing interest in the organization of the event and/or conference	B	If applicable, your employer and/or company sponsoring your participation in the conference or event
Other information you would provide us with, especially through the registration documentation	Management of the conference and/or event Communication on future events and conferences	Your consent	B	If applicable, catering and/or hosting partners If applicable, your employer and/or company sponsoring your participation in the conference or event
Other information you would provide us with	Performance of surveys and assessments	Your consent	B	No

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Identification data (name, surname, date of birth, etc.) Contact details (email address, postal address, etc.) Professional data (position, company, professional biography, financial information when available, etc.)	Fundraising activities	IMD’s prevailing interest in the sourcing of funds	B	In certain limited situations, transfer to third-party fundraising entities
Where applicable, financial data (payment details, payment means, general financial information, etc.)	Fundraising activities Follow-up of the payments and donations account	IMD’s prevailing interest in the sourcing of funds After payment, execution of the contract with you.	B	No
Available personal data on social networks	Fundraising activities	IMD’s prevailing interest in the sourcing of funds	B	No

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Identification data (name, surname) Contact details (email address, postal address, etc.)	Sending of newsletter and general communications on IMD’s activities	Your consent	A	No
Available personal data on social networks Any further information you provide to us through the social network	Communication with you Management of our relationship	IMD’s prevailing interest in its communication activities In case you contact us through social networks, your consent	A	No

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Identification data (name, surname) Contact details (email address, postal address, etc.)	Managing IMD’s business development activities	IMD’s prevailing interest in the development of its activities	A	No
Publicly available data (including deriving from social networks)	Managing IMD’s business development prospecting activities	IMD’s prevailing interest in the development of its activities	A	No

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Identification data (name, surname) Contact details (email address, postal address, etc.) History within IMD (programs and courses, grades, conferences, etc.)	Management of the alumni community	Execution of the contract with you	B	Alumni club in your geographical zone
Identification data (name, surname) Contact details (email address, postal address, etc.)	Sending of newsletter and general communications on IMD’s activities	Your consent	B	Alumni club in your geographical zone
Data on participation into events (attendance, payment details, etc.)	Management of the alumni community	Execution of the contract with you	B	Alumni club in your geographical zone

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Identification data (name, surname) Contact details (email address, postal address, etc.)	Pursuing research and scientific activities	Your consent	A	As the case may be and as specifically communicated to you, partner universities and research institutions
Further personal data as communicated by you	Pursuing research and scientific activities	Your consent	A	As the case may be and as specifically communicated to you, partner universities and research institutions
Behavioral and personality data derived from surveys, IT programs or other educational contexts	Provide you with an analysis of aspects of your personality, including professional activity	Your consent	A	If applicable and only if explicitly provided prior to the collection, your employer and/or company sponsoring your participation in the program or situation
Any personal data contained in filmed interviews	Pursuing research and scientific activities	Your consent	A	As the case may be and as specifically communicated to you, partner universities and research institutions As the case may be and as specifically communicated to you, other participants and general public through IMD’s teaching material

a) Pictures videos and audio recordings

During events and conferences, as well as throughout IMD’s programs and activities, pictures and videos may be taken of participants and students. Such pictures and videos constitute an important networking, marketing, and communication tool both for IMD and for participants. In addition, filmed interviews may be used as training and/or research material within IMD’s programs and activities (see above).

Personal data	Purpose	Basis	Principles applied to retention period (for references see para 7)	Transfer to third parties
Individual photos and filmed interviews, including all personal data provided by you in this context	Communication (including on social networks) Teaching and research	Your consent	A	As the case may be, other participants and general public through IMD’s teaching material
General photos and videos (without an individual scope)	Communication (including on social networks)	IMD’s prevailing interest to communicate on its activities, provided specific information has been given prior to the event	E	As the case may be, the general public through IMD’s communication activities

b) Statistics

Please note that any personal data that is collected and/or processed by IMD as referred to above may be used to establish and develop statistics. The results of such statistics shall be anonymized as soon as possible.

c) Ad-hoc processing activities

Please note that, in certain specific situations, IMD may implement ad-hoc processing activities that are not (entirely or in part) covered by this general privacy notice. In such a case, You shall be informed of such a specific processing activity with a dedicated information sheet. Such a dedicated information sheet comes in addition to this privacy notice and must be read in connection with it.

5) Sharing of personal data and international transfers

As mentioned under par. 4 above, for each category of processing operations, some of your personal data may, under limited circumstances, be disclosed and shared with third parties.

In addition to the third parties mentioned above, such sharing may also be made with processors and subcontractors who support IMD in performing its services. This is especially the case for the various software used in the context of IMD’s courses and programs to offer you the best and most complete experience in this context, as well as for the continuous improvement of our online services and learning experience. A list of such processors and subcontractors may be made available on request. It is also the case for part of the hosting of our IT environment.

Transfers may also occur with IMD Affiliates, for example when organizing courses, programs, and events.

Overall, we never share, sell, or in any other way transmit your data to any third party for commercial purposes without your permission. In any case of transfer of some of your personal data to third parties and processors, any such recipients are contractually prohibited from using or sharing further such personal data for any other purpose than what is contractually provided.

From a geographical point of view, IMD favors whenever possible processors and hosting facilities located in Switzerland and/or the EEA (for its general personal data). Whenever this is not possible, and such recipients are in a country that does not offer adequate data protection legislation, IMD performs a prior data transfer impact assessment (DTIA) that includes the analysis of alternatives existing in an adequately protected country. Whenever this last possibility is not available, and the transfer has to be made, IMD applies additional safeguards with each recipient, which include inter alia (i) the obligation for the recipient to answer a detailed questionnaire on IT security and data protection, (ii) the signing of Standard Contractual Clauses (SCCs), or the use of another safeguard mechanism that is compliant with applicable law, as well as (iii) the regular review and updating of these mechanisms.

For IMD Affiliates in China and Singapore, dedicated copies and hosting requirements for personal data may apply, as provided in the applicable specific privacy notice.

Please note that, aside from the above, IMD may also communicate personal data to third parties when we are ordered or obliged to do so because of a court order, governmental authority, and/or by law. In such a situation, IMD shall implement the required means to limit as much as possible the transfer of personal data. You shall also be informed of this unless applicable law prohibits us from doing so.

Should you have any questions on the above, require any further information, and/or wish to receive a copy of the additional safeguards that apply, please contact us directly.

6) Security, internet security, and integrity

Considering the absolute importance of security applied to personal data, IMD is certified ISO 27001 and ISO 27701. In compliance with these two certifications, we take high-end precautions to protect personal data in our possession from loss and misuse as well as unauthorized access, disclosure, alteration, and destruction. We also maintain physical, electronic, and procedural safeguards that comply with applicable laws to safeguard personal data.

At IMD, we make every effort to follow industry-standard security. However, no data transmitted through the internet and/or stored on servers is 100% secure. As a result, we are unable to guarantee that any personal data covered by this Privacy Notice will be entirely secure. That being said, we do work thoroughly to limit any risks as much as possible.

7) IMD principles applied to the retention period

IMD applies the following principles for the retention of data (letters are used in the applicable modalities for ease of reference). Please note that specific regulations and retention periods may apply to some of our processing activities.

Basis	Pniciples applied to retention period (for references see para 7)
A	From the last active contact with IMD we retain data for 10 years for a program participant, or for 2 years otherwise
B	10 years from the last active contact with IMD
C	6 months from program completion
D	1 month from payment
E	No limitation

8) Your rights

Please note that you benefit from various rights, depending on the applicable legal regime to your personal data. Each may be limited based on IMD’s and/or third parties’ legitimate interests or based on other grounds, including IMD’s legal obligations. To exercise them, please contact us by using the contact information provided under par. 1 above.

Information right: See current notice.
Access right: You have the right to receive from IMD confirmation about the actual processing or not of your personal data. If your personal data is processed, you have the right to access such personal data (including to receive a copy).
Rectification right: You have the right to request that your personal data be rectified or completed without undue delay.
Erasure right: You have the right to request the erasure of your personal data without undue delay.
Limitation of processing right: IMD grants you the right to request that your personal data be processed in a limited manner.
Data portability right: IMD grants you the right to retrieve the data you have provided in a structured, commonly used, and machine-readable format, and you have the right to transfer this personal data to another controller.
Right to object: IMD grants you the right at any time to object to the processing of your personal data for reasons deriving from your personal situation, even if this processing concerns IMD’s legitimate interest or public interest.
Possible right to lodge a complaint with a supervisory authority: If you are a resident of Switzerland, the complaint can be lodged at the following address: Swiss Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Berne, Switzerland. For more information please visit www.edoeb.admin.ch.

When the processing is based on your consent, you can at any time withdraw it. Please note, however, that in such a case, IMD may be authorized to continue processing your personal data based on another lawful ground. Similarly, the lawfulness of any data processing that occurred before the consent’s withdrawal is not impacted by such withdrawal.

Access and modification of most of your personal data can be done at any time by accessing your profile on MyIMD. It is your responsibility to ensure that the personal data used in the context of your profile and activities with IMD is up-to-date and correct.

9) Changes

This Privacy Notice was last updated on 14 June 2023.

We may update this Privacy Notice at any time. Any changes to it will be posted on this page.