top of page

Privacy and Cookie Policy

Last update: 17 August 2026

​1. Data controller

The controller responsible for processing personal data is:
San Gallenses Oeconomiae Comites (SGOC)
c/o Universität St.Gallen
Dufourstrasse 50
CH-9000 St.Gallen
Switzerland

studenti.sgoc@gmail.com · sgoc@shsg.ch

SGOC is a student association that organises events, activities, projects and initiatives primarily for students from Ticino and other Italian-speaking students at the University of St.Gallen.

2. Scope of this policy

This policy explains how SGOC collects, uses, stores and discloses personal data:

  • through the website www.sgoc.ch;

  • when an account is created or managed;

  • when a person joins SGOC or renews their membership;

  • through contact forms and partnership enquiries;

  • when registering for or attending events;

  • in connection with donations and payments;

  • in its relationships with sponsors, partners and suppliers;

  • during activities and events organised by SGOC;

  • through email communications and other digital channels.
     

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

3. Personal data we process

Depending on your relationship with SGOC and the features you use, we may process the following categories of personal data.
 

3.1 Technical and browsing data

When you visit the website, the following data may be collected automatically:

  • IP address;

  • device type, operating system and browser;

  • date and time of access;

  • pages visited and interactions with the website;

  • technical information and system logs;

  • cookie and consent preferences;

  • data required to keep the website secure and functioning correctly.
     

3.2 Contact details

When you complete a form, send an email or contact SGOC, we may collect:

  • first and last name;

  • email address;

  • telephone number;

  • organisation or company;

  • message content;

  • any attachments and other information you provide voluntarily.
     

3.3 Member data

When you create an account, join SGOC or renew your membership, we may process:

  • first and last name;

  • telephone number;

  • email address, including your university email address;

  • level of study;

  • current semester;

  • degree programme or field of study;

  • membership status;

  • membership period;

  • administrative information relating to the renewal;

  • information required to issue and verify an invoice or payment.
     

Login credentials are managed through Wix’s technical services. SGOC cannot view users’ passwords in plain text.

3.4 Event data

When you register for or attend an event, we may process:

  • identification and contact details;

  • registration information;

  • attendance or non-attendance;

  • organisational preferences;

  • any information you provide voluntarily that is required to organise the event;

  • photographs and video recordings taken during the event.
     

3.5 Donation and payment data

To process a donation or payment, we may collect:

  • first and last name;

  • email address;

  • postal address, if provided for a thank-you note or other postal correspondence;

  • payment amount, date and reference;

  • payment status;

  • accounting and administrative information;

  • correspondence relating to the donation.
     

Payments are made by bank transfer or Swiss QR invoice. SGOC does not collect credit card details or online banking login credentials through the website.
 

Providing a postal address is optional unless it is required for a specific request by the data subject.
 

3.6 Sponsor, partner and supplier data

In connection with sponsorships and partnerships, we may process:

  • names and roles of contact persons;

  • professional contact details;

  • company or organisation;

  • correspondence;

  • sponsorship proposals, offers and terms;

  • agreements and contracts;

  • administrative, accounting and payment information;

  • agreed services and evidence of their delivery.
     

4. How we collect personal data

We may collect personal data:

  • directly from the data subject;

  • through forms on the website;

  • when an account is created or used;

  • through membership registrations and renewals;

  • by email, telephone or other communication channels;

  • through external forms or services linked from the website;

  • during events and activities;

  • from representatives of companies, sponsors or partners;

  • automatically when you browse the website;

  • through technical service providers used by SGOC.
     

Please do not provide personal data that is not necessary for your request.
 

5. Purposes of processing

We may process personal data for the following purposes:

  • managing the website and ensuring its security and operation;

  • creating and managing user accounts;

  • managing registrations, renewals and member relations;

  • organising events, activities and projects;

  • responding to enquiries, messages and partnership proposals;

  • sending confirmations, organisational information and payment documents;

  • preparing and sending QR invoices;

  • recording and verifying payments and donations;

  • sending acknowledgements to donors;

  • managing relationships with sponsors, partners and suppliers;

  • fulfilling sponsorship agreements;

  • documenting and communicating the association’s activities;

  • maintaining accounts and complying with legal obligations;

  • preventing misuse and protecting the website and user accounts;

  • sending updates about events and initiatives when requested or consented to by the data subject.


Depending on the circumstances, processing is based on the need to handle a request or manage the membership relationship, perform an agreement, comply with SGOC’s legal obligations, pursue the association’s legitimate interests or, where required, obtain the data subject’s consent.
 

6. Required and optional data

Fields marked as required are necessary to process the relevant enquiry, registration, renewal, event booking or donation.
 

Without this information, we may be unable to process the request.
 

All other information is optional. In particular, a donor’s postal address should only be requested when it is needed to send a thank-you note or other postal correspondence.
 

Acknowledging this policy does not constitute consent for optional purposes. Any consent required for promotional communications, photographs or other optional activities is requested separately.
 

7. Communications and newsletters

SGOC may send:

  • communications required to manage an account;

  • registration confirmations;

  • information about renewals;

  • invoices and payment details;

  • organisational information about events;

  • responses to enquiries and proposals;

  • communications relating to sponsorships and partnerships.
     

These communications are necessary to provide the requested service and are not considered promotional communications.


General updates, newsletters and promotional communications are sent only where there is an appropriate legal basis or the data subject has given consent. Consent may be withdrawn at any time using the link in the communication, where available, or by contacting SGOC.
 

8. Photographs and videos

Photographs or video recordings may be taken during SGOC events and activities for the following purposes:

  • documenting the association’s activities;

  • informing members and the University community;

  • publishing content on the website;

  • sharing the association’s activities through SGOC’s social media channels;

  • preparing informational and institutional materials.


Where a person is clearly the main subject of an image, SGOC obtains consent where required.


General or group photographs may be used to document an event, with due regard for the rights and interests of the people shown.


Anyone who does not wish to be photographed may inform the organisers. You may also ask SGOC to remove a published photograph where the request is justified and removal is reasonably possible.


Withdrawal of consent takes effect for the future and does not make any use before withdrawal unlawful.
 

9. Cookies and similar technologies

The website uses cookies and similar technologies to operate its pages, protect user accounts, remember preferences and, where consent is required, analyse website usage or load external content.


The categories used may include:

  • essential cookies, which are required for the website to function securely;

  • functional cookies, which provide additional features;

  • statistical or analytical cookies, which help us understand how the website is used;

  • cookies from external services and content, such as maps or other embedded elements.


Services used on the website may include Wix, Wix Events, Usercentrics and Google Maps. The exact selection may change as features are added or removed.
 

Non-essential cookies and related content are activated only after the user has made a choice, where consent is required.
 

Preferences are managed through the consent banner and menu provided by Usercentrics. Users may accept, reject or change their preferences, and may update their choice later using the privacy settings icon on the website.
 

Disabling certain cookies may limit some features but will not prevent access to the essential parts of the website.
 

10. Recipients and service providers

Personal data is processed by members of the SGOC Committee and authorised persons who need it to perform their duties.
 

Where necessary, personal data may also be disclosed to:

  • Wix.com and its technical service providers, for website hosting and management;

  • Usercentrics, to manage cookie preferences;

  • Google services used by SGOC, such as Google Maps or external forms;

  • email services used by SGOC;

  • infrastructure and services provided by SHSG or the University of St.Gallen;

  • Banana Accounting, for administrative and accounting purposes;

  • banks and service providers involved in processing payments;

  • suppliers required to organise events;

  • legal, accounting or technical advisers;

  • public authorities, where disclosure is required by law.
     

SGOC does not sell users’ personal data.
 

Service providers may process personal data only as necessary to provide their services and in accordance with their applicable terms and privacy policies.
 

11. Processing abroad

Some service providers used by SGOC may process personal data outside Switzerland, particularly in the European Economic Area, Israel, the United States or other countries in which their service providers operate.


Where personal data is transferred to a country that does not provide a recognised adequate level of protection, the transfer is made, where required, subject to appropriate safeguards such as standard contractual clauses or another legally permitted basis.
 

The use of international services may also allow authorities in the relevant country to access personal data in accordance with local law.
 

12. Retention periods

SGOC retains personal data only for as long as necessary for the purposes for which it was collected and to comply with legal obligations.
 

As a general guide:

  • contact and partnership enquiries: for up to 24 months after the enquiry has been closed;

  • event registrations: for up to 24 months after the event, unless a longer period is required;

  • member data: for the duration of the membership and, as a rule, for up to 24 months after it ends;

  • accounting records, invoices, payments, donations and contracts: for the period required by applicable law, normally up to 10 years;

  • data used for optional communications: until consent is withdrawn or an objection is made;

  • records of preferences and consent: for as long as necessary to document the choices made;

  • photographs and videos: for as long as they retain reasonable documentary, informational or historical relevance for the association, taking into account the rights of the people shown.
     

At the end of the applicable retention period, personal data is deleted or anonymised unless it must still be retained to protect legal rights, comply with legal obligations or manage a dispute.
 

13. Data security

SGOC implements appropriate technical and organisational measures to protect personal data against:

  • unauthorised access;

  • loss;

  • destruction;

  • alteration;

  • unauthorised disclosure;

  • misuse.
     

These measures may include access controls, personal user accounts, restricted permissions, protection of login credentials and the use of appropriate technical service providers.
 

However, no IT system can guarantee absolute security.
 

14. External links and social networks

The website may contain links to websites, forms, social media platforms or services operated by third parties, including Instagram, LinkedIn and Google services.
 

When you open an external link, your personal data is processed in accordance with the relevant provider’s terms and privacy policy. SGOC does not control any processing carried out independently by these third parties.
 

The mere presence of a link or social media icon on the website does not necessarily result in data being transmitted to the external service before the user interacts with it.
 

15. Rights of data subjects

Subject to applicable law, data subjects may request:

  • confirmation as to whether SGOC processes personal data about them;

  • access to their personal data;

  • correction of inaccurate personal data;

  • deletion of personal data;

  • restriction of certain processing activities;

  • provision or transfer of personal data in a usable format, where applicable;

  • withdrawal of consent for the future;

  • an objection to certain processing activities;

  • information about the source, purposes and recipients of the personal data.
     

To exercise these rights, please write to studenti.sgoc@gmail.com or sgoc@shsg.ch.
 

SGOC may request information needed to verify the identity of the person making the request. Certain personal data may need to be retained despite a deletion request where necessary to comply with legal obligations or protect legitimate rights.
 

You may also contact the Federal Data Protection and Information Commissioner (FDPIC).
 

16. Automated decision-making

SGOC does not make decisions based solely on automated processing of data collected through the website that produce legal effects or similarly significant consequences for the data subject.
 

Automations used to send confirmations, payment details, invoices or other communications do not constitute automated decision-making of this kind.
 

17. Minors

SGOC’s activities are primarily intended for university students.
 

SGOC does not knowingly seek to collect personal data through the website from anyone under the age of 16 without the involvement or authorisation of their legal representative, where required.
 

18. Changes to this policy

SGOC may update this policy following legal, organisational or technical changes or the introduction of new services.
 

The updated version will be published on this page together with the date of the latest revision. If material changes are made, SGOC may provide an additional notice through the website or other appropriate channels.
 

19. Contact details

For questions about this policy or the processing of personal data, please contact:

San Gallenses Oeconomiae Comites (SGOC)
c/o Universität St.Gallen
Dufourstrasse 50
CH-9000 St.Gallen
Switzerland
 

studenti.sgoc@gmail.com · sgoc@shsg.ch

bottom of page