Commodity Trading and Shipping Club (CTSC)
University of St. Gallen (HSG) / Studentenschaft der Universität St. Gallen (SHSG)
Last updated: 30 July 2026
1. Scope and Who We Are
This Privacy Policy explains how the Commodity Trading and Shipping Club ("CTSC", "we", "us", "our") collects, uses, stores, and protects personal data when you visit hsg-cts.ch (the "Website"), interact with our LinkedIn/Instagram pages as linked from the Website, register for an event, contact us, or otherwise engage with us.
CTSC is a student organization officially recognized by the Studentenschaft der Universität St. Gallen (SHSG) and affiliated with the University of St. Gallen (HSG). CTSC operates independently for data protection purposes: the University of St. Gallen and the SHSG are not the controller of data processed through this Website, unless expressly stated otherwise. Where our activities intersect with HSG/SHSG systems (e.g., our @shsg.ch email address, HSG event venues, or SHSG communication channels), the relevant HSG/SHSG privacy declarations apply in addition to this policy.
Data Controller:
Commodity Trading and Shipping Club (CTSC)
c/o Studentenschaft der Universität St. Gallen (SHSG)
Email: commodityclub@shsg.ch
Contact for privacy questions / data subject requests:
Alexander Schauer, Data Protection Contact, CTSC Board
Email: alexander.schauer@student.unisg.ch
2. Which Laws Apply
Because CTSC is based in Switzerland but engages with individuals, partners, and companies both in Switzerland and the EU, we apply the higher of the following standards wherever they differ:
- Swiss Federal Act on Data Protection, as revised (revFADP, in force since 1 September 2023), and its implementing ordinances — applies to all processing carried out by CTSC as a Swiss-based private organization.
- EU General Data Protection Regulation (GDPR) — applies in parallel where we process personal data of individuals located in the EU/EEA (for example, EU-based partner contacts, event guests, or website visitors), since we offer content and event participation that reasonably extends to them.
- Where applicable, internal HSG/SHSG data protection guidance for recognized student organizations.
Switzerland and the EU each recognize the other as providing an adequate level of data protection, which generally permits personal data to flow between Switzerland and the EU/EEA without additional safeguards. Where we transfer data to countries without an adequacy decision, we implement appropriate safeguards (see Section 8).
3. What Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Website usage data | IP address (typically truncated/anonymized), browser type, device type, pages visited, referring site, approximate location (country/city level), date/time of visit | Automatically, via hosting provider and any analytics tool in use |
| Contact form submissions | Name, email address, message content, and anything else you choose to include | Directly from you |
| Event registrations | Name, email, HSG student status/university affiliation, dietary requirements or accessibility needs (if collected), sign-up timestamp | Directly from you |
| Newsletter/mailing list | Name, email address, subscription/unsubscribe timestamps | Directly from you |
| Team page content | Photo, name, role/title, short bio, LinkedIn profile link | Directly from the team member, with their consent (see Section 4a) |
| Partner/sponsor contact data | Company name, contact person, business email, logo/marketing material | Directly from the partner organization |
| Social media content | Public LinkedIn posts (including images/text) displayed via an embedded feed widget on our homepage; Instagram and LinkedIn profile links | Pulled from our public LinkedIn company page via a third-party embed service (see Section 6) |
| Cookies and similar technologies | Session identifiers, preference cookies, and any cookies set by embedded third-party widgets (e.g., the LinkedIn feed widget) | Automatically, see Section 9 |
We do not knowingly collect special categories of data (e.g., health data, political or religious views) except where a data subject voluntarily discloses accessibility or dietary needs for event planning, which we treat as confidential and use solely for that purpose.
3a. Team Member Photos and Bios
Because the Team page publishes each member's photo, name, role, short bio, and LinkedIn link publicly, we obtain each team member's explicit, informed consent before publishing their content, and allow any member to request removal or updates at any time (see Section 7). We recommend keeping a simple written consent record (e.g., a signed form or confirmation email) for each published profile.
4. Why We Process Your Data (Purposes and Legal Basis)
| Purpose | Legal basis (GDPR Art. 6) | Swiss law basis |
|---|---|---|
| Operating and improving the Website | Legitimate interest (Art. 6(1)(f)) | Legitimate interest / proportionality principle |
| Responding to contact form inquiries | Contract / pre-contractual steps or legitimate interest | Legitimate interest, performance of request |
| Managing event registrations | Performance of a contract-like arrangement / legitimate interest | Legitimate interest |
| Sending newsletters (if opted in) | Consent (Art. 6(1)(a)) | Consent |
| Publishing team member profiles | Consent | Consent |
| Displaying our public LinkedIn feed | Legitimate interest (promoting the club, transparency of activities) | Legitimate interest |
| Sharing partner logos/descriptions | Contract with the partner / legitimate interest | Legitimate interest, contractual arrangement |
| Cookies for essential site function | Legitimate interest / strictly necessary | No consent required, but disclosed |
| Cookies for analytics or embedded widgets | Consent, or legitimate interest with opt-out, depending on risk level | See Section 9 |
You may withdraw consent at any time (e.g., unsubscribe from a newsletter, request removal of your Team page profile) without affecting the lawfulness of processing carried out before withdrawal.
5. Who We Share Data With
We do not sell personal data. We share personal data only with:
- Hosting provider: Lovable/hosting partner, which stores Website data on servers located in the European Union.
- Website/embed platform provider (e.g., Lovable or successor platform), for building and operating the site.
- LinkedIn feed embed service: Xio, a third-party widget provider that retrieves and displays our public LinkedIn posts on the homepage. This provider may set its own cookies or process visitor data according to its own privacy policy, which we link to on our Website.
- Email service provider: underlying the @shsg.ch address, operated by SHSG/HSG IT services (Un.IT).
- SHSG/HSG, where required for administrative recognition of CTSC as a student organization, or where you contact us via our @shsg.ch address.
- Partner organizations, limited to the specific contact and marketing information they provide to us for display on the Partners page.
- Public authorities, only where legally required (e.g., a valid request from the Swiss Federal Data Protection and Information Commissioner or a court order).
All third-party processors are contractually or by design limited to processing data only for the purposes we specify, consistent with revFADP and GDPR requirements for data processing agreements where applicable.
6. Embedded Third-Party Content (LinkedIn Feed, Social Icons)
Our homepage displays a live feed of our public LinkedIn posts via a third-party embed widget. When this widget loads:
- It may load resources directly from the widget provider's and/or LinkedIn's servers, which can result in your browser sending them information such as your IP address and browser type, independent of us.
- It may set its own cookies, governed by the widget provider's and LinkedIn's own privacy policies, not this one.
- Clicking through to a LinkedIn or Instagram post takes you to that platform, where its own privacy policy applies.
Where feasible, we configure the widget to load only after a visitor has interacted with a consent banner (see Section 9), or we use a "click-to-load" approach so the feed only activates once you choose to view it.
7. Your Rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"), e.g., removal of a Team page profile.
- Restrict processing in certain circumstances.
- Object to processing based on legitimate interest, including direct marketing.
- Data portability, i.e., receive your data in a structured, machine-readable format (GDPR; recognized under revFADP for data you provided).
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with a supervisory authority (see Section 11).
To exercise any of these rights, contact us at commodityclub@shsg.ch. We will respond within 30 days, consistent with Swiss and EU practice, and may need to verify your identity first.
8. International Data Transfers
Where personal data is transferred outside Switzerland and the EU/EEA (for example, if a service provider we use stores data in the United States), we rely on one or more of the following safeguards:
- Transfer to a country recognized by the Swiss Federal Council and/or the European Commission as providing an adequate level of data protection; or
- Standard contractual clauses or equivalent contractual safeguards with the recipient; or
- Your explicit consent to the specific transfer, where no other safeguard applies.
9. Cookies and Similar Technologies
We use the following categories of cookies/trackers:
- Strictly necessary cookies (e.g., session/security cookies): required for the Website to function. No consent is required, but they are disclosed here.
- Functional/preference cookies: remember settings such as language. Operate on an opt-out basis with clear disclosure, consistent with current FDPIC guidance.
- Analytics cookies (if enabled): help us understand aggregate usage.
- Third-party embed cookies (LinkedIn feed widget, social share buttons): set by the embed provider or LinkedIn/Instagram directly; we do not control these but disclose them here and link to the relevant third-party policies.
Cookies that involve profiling, advertising, or cross-site tracking are not currently used on this Website. If this changes, we will implement an explicit opt-in consent banner before any such cookie is set, consistent with revFADP and GDPR expectations for higher-risk tracking.
You can control or delete cookies through your browser settings at any time; blocking essential cookies may affect Website functionality.
10. Data Retention
Contact form submissions: retained for 24 months after resolution of your inquiry, then deleted.
Event registration data: retained for duration of the academic year / until the event plus 6 months, then deleted or anonymized.
Team page profiles: retained while the individual is an active team member and for a reasonable period afterward (e.g., historical "past board members" archive), unless removal is requested earlier.
Newsletter data: retained until you unsubscribe.
Website usage/log data: retained for 30–90 days for security and troubleshooting purposes.
We periodically review and delete data that is no longer needed for the purpose it was collected.
11. Supervisory Authorities
Switzerland:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
www.edoeb.admin.ch
European Union: If you are located in the EU/EEA, you may also lodge a complaint with your local data protection authority.
12. Data Security
We take reasonable technical and organizational measures appropriate to the risk to protect personal data against unauthorized access, loss, or misuse, including access restrictions, secure hosting, and limiting data collection to what is necessary (data minimization and privacy-by-design, as required under revFADP and GDPR). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. Children's Privacy
This Website is directed at university students, prospective partners, and industry professionals, and is not intended for children. We do not knowingly collect personal data from individuals under 16.
14. Changes to This Policy
We may update this Privacy Policy from time to time, for example to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will indicate the most recent revision. Material changes will be highlighted on the Website.
15. Contact Us
For any questions about this Privacy Policy or how we handle your personal data:
Commodity Trading and Shipping Club (CTSC)
Email: commodityclub@shsg.ch
This policy is intended to operate alongside, and does not replace, the University of St. Gallen's own data protection declaration (available at unisg.ch) or SHSG's own guidelines, which apply to HSG/SHSG systems used by CTSC.