Privacy notice

• This website uses no advertising or tracking tools. It sets cookies only when you sign in to our member area.
• We count page views with Vercel Web Analytics, which works without cookies and does not identify you.
• We embed no content from social networks or other services. Our fonts are served from our own website.
• Our hosting provider, Vercel, processes technical data (server logs) so that the pages can be delivered.
• If you email us, we use your message only to reply and to handle your request.
• If the board invites you to the Emporium 2027, we keep your contact details and your answer only to organise it, and delete them at the latest three months after the event (see Emporium invitations).
• If you sign in to the member area with UniClubs, we keep only your user ID, first name (for club admins also the full name), membership status and club role, in an encrypted cookie on your device for up to 24 hours. Nothing else is stored on our servers, unless you add your CV to our CV Book or apply for a job through CTSC.
• If you add your CV to our CV Book, the companies on our Partners page can see it through personal links that expire. We delete it at the latest 12 months after your expected end of studies (see CV Book for our partners).
• If you apply for a job through our job board, the board decides whether your application goes to that company, which then gets it through a personal link on our website; no other company does. We delete it 6 months after the job's deadline (or, without a deadline, 6 months after you sent it). Fair-play rules apply (see Job board and applications).
• Links to LinkedIn, Instagram, WhatsApp and UniClubs lead to services with their own privacy policies.

The controller responsible for this website under the Swiss Federal Act on Data Protection (FADP) is:

Controller

Commodity Trading & Shipping Club (CTSC), University of St. Gallen

Email

commodityclub@shsg.ch

Our full contact details are listed in the imprint.

This website sets cookies only if you sign in to our member area: a short-lived cookie while you sign in (deleted after ten minutes at the latest), a session cookie that keeps you signed in for up to 24 hours, a small cookie that only says “signed in”, and, only while you add your CV to our CV Book or apply for a job without a CV Book entry, a cookie that lasts at most one hour (see CV Book for our partners and Job board and applications). The session, sign-in, CV Book and job cookies are encrypted and strictly necessary for signing in, for adding your CV and for applying. The “signed in” cookie contains nothing about you and only lets our pages check whether to show club admins a link to our editing area. None of them is used for anything else (see Sign in with UniClubs). Apart from that, nothing is stored on your device beyond what your browser caches by itself to load pages faster.

Apart from the cookie-free visitor statistics described below, we do not use analytics, advertising pixels, social media plug-ins or other tracking tools, and we do not build profiles of visitors. If we ever change this, we will update this notice first.

Our fonts are delivered from our own website, so your browser does not contact Google or any other font service when you visit.

This website is hosted by Vercel Inc., a company based in the United States. Whenever you open a page, your browser sends technical data that Vercel needs to deliver it:

• your IP address;
• the date and time of the request;
• the page or file requested, and the page you came from;
• your browser and operating system (user agent).

Vercel processes this data on our behalf to deliver the website, keep it secure and fix errors, and keeps the logs only for a limited period under its own retention rules. We do not use log data to identify visitors and do not combine it with other data. We rely on our legitimate interest in running a secure, working website.

Vercel may process data in the United States and other countries. It states that it complies with the Swiss-U.S. Data Privacy Framework and uses standard contractual clauses for international transfers. Details are in Vercel's privacy policy (opens in a new tab).

All pages are delivered over an encrypted connection (HTTPS).

To see which pages are read and how visitors find us, we use Vercel Web Analytics, the statistics service of our hosting provider Vercel. It sets no cookies and stores nothing on your device.

For each page view, Vercel records:

• the address of the page and the page you came from;
• the date and time;
• your approximate location (country, region and city), derived from the request;
• your browser, operating system and type of device.

Vercel does not store your IP address with these records. A visit is recognised by a hash created from the request, which is discarded after 24 hours, so visits cannot be linked across days or to other websites. We only see aggregated figures, such as the number of visitors per page, and cannot tell who you are.

Before a page view is sent, our website removes everything after the page address except campaign tags in our own links (utm_source, utm_medium and utm_campaign). Our editing area is not counted. You can block the statistics with a content blocker in your browser; the website works the same.

We rely on our legitimate interest in knowing which content is useful, so we can improve the website. Vercel processes the data on our behalf, as described under Hosting and server logs.

When you write to commodityclub@shsg.ch, for example through the buttons on our Partners and Emporium pages, we receive your email address, your name and anything else you include.

We use this information only to answer you and to handle your request, such as a partnership enquiry or your interest in the Emporium 2027. Only the board members who deal with your request read it. We do not pass it on to partners or other third parties without your permission.

We delete correspondence once it is no longer needed for your request, unless the law requires us to keep it.

The board invites some guests to the Emporium 2027 personally, mostly people from commodity trading and shipping companies. If you received such an invitation, this section is about you.

A board member adds you to our guest list with:

• your name and how we greet you (for example “Dear Ms Müller”);
• your email address, your company and your position;
• if we invite you to speak: that you are a speaker and the session we invite you to;
• whether and when we sent you the invitation;
• your answer: whether you will attend, on which days, the note you leave us, and when you answered;
• if you accept: your answers to the practical questions on your invitation page.

We use these details only to invite you, to know who is coming on which day and to organise the Emporium, for example to print name badges or to send you the practical information you asked for. We do not use them for a newsletter or anything else, and we do not pass them on to partners or other third parties. Whether you are a speaker, your session and your answers are shown only on your own invitation page and to the board. The note field is for practical things, such as a colleague you would like to bring. Please don't share health or other sensitive details there.

The invitation email is written and sent by a board member from the club mailbox (commodityclub@shsg.ch); this website sends no emails. It contains a personal link to your invitation page, where you answer. Anyone who has the link can open that page, so please don't forward it. The page shows only your own invitation, is never listed by search engines and does not pass its address on to other websites.

Your details and your answer are stored in the private, non-public storage of our hosting provider Vercel in Frankfurt (Germany); Vercel processes them on our behalf (see Hosting and server logs). On our website, only board members with admin rights for the club on UniClubs see the guest list, after signing in to our editing area. The few club members who manage our hosting account can technically also reach the stored files.

After you accept, your invitation page offers two ways to add the Emporium to your calendar: a calendar file from our own website, and a link to Google Calendar. If you click the Google Calendar link, your browser opens Google's website, which sees your IP address and, if you are signed in, your Google account. The link itself carries only the Emporium's date, hours, place and programme link, and Google's privacy policy applies there.

We delete your details and your answer at the latest three months after the Emporium, together with any copy of the guest list we made, for example for name badges. We rely on our legitimate interest in inviting you and organising the event, and on your own answer.

You can ask us at any time what we hold about you, have it corrected, or be taken off the guest list: write to commodityclub@shsg.ch. Your other rights are listed under Your rights.

Members can sign in to our member area with their UniClubs account. UniClubs is run by Evanescor GmbH, St. Gallen. You sign in on the UniClubs website, so we never see your UniClubs password.

When you sign in and agree on UniClubs, we ask UniClubs for:

• your UniClubs user ID;
• your name and the basic profile details you have set on UniClubs (such as a profile picture or language);
• whether you have an active CTSC membership, with its tier and dates, and your role in the club on UniClubs, if any.

For signing in we do not ask for your email address; only the CV Book and job applications do, if you use them (see CV Book for our partners and Job board and applications).

We use this only to check whether you are an active member and to greet you by name. We keep just your user ID, your first name, your membership status and end date, and your club role, in an encrypted cookie on your device; for club admins (the board) also their full name, which signs the Emporium invitation emails they write in our editing area. Your browser sends it back with each visit to our website, and only our website can read it. It expires after 24 hours or when you sign out. Everything else UniClubs sends us is discarded immediately: we store none of it on our servers and keep no member database. The exceptions are the CV Book and job applications, where members add their own entry or application.

A second cookie, __Host-ctsc-signed-in, only says “signed in”: it contains nothing about you, lets our pages check whether to show club admins a link to our editing area, lasts as long as your session (24 hours) and is removed when you sign out.

One exception concerns committee members who edit this website. When a club admin publishes a change in our editing area, we save their UniClubs user ID and first name with that change and with its earlier versions (we keep the 50 most recent per section), so the committee can see who changed what and undo mistakes. These versions are stored with our hosting provider, Vercel, and are deleted as newer versions replace them. Photos uploaded there are published without their embedded metadata, such as location data.

We rely on your request to sign in and on our legitimate interest in opening the member area to members only. UniClubs manages our club memberships on our behalf, as our processor under section 7 of the UniClubs terms (opens in a new tab). For your UniClubs account itself, the UniClubs privacy policy (opens in a new tab) applies. You can disconnect our website from your account at any time in your UniClubs settings.

Members can add their CV to our CV Book, on the CV Book page of the member area, so that the companies on our Partners page can consider them for internships, graduate roles and thesis projects. This happens only if you choose it: nothing is added without your explicit agreement.

Your CV is the PDF you upload on the CV Book page. From UniClubs we get only the sign-in, your membership and the details we fill in for you. When you open the CV Book and agree on UniClubs, we additionally ask UniClubs for your email address and your profile: your degree programme, graduation year and LinkedIn profile. UniClubs sends your phone number, your short bio and the address of the CV on your UniClubs profile with the same permission; we don't use them and discard them at once. To read your name, email address, degree programme and membership again when you add your CV, we keep UniClubs' access key in an encrypted cookie that only the CV Book page receives, for at most one hour. It is deleted as soon as your CV is added, when you sign out, or when the hour is over.

When you add your CV, we store:

• your name and email address;
• your degree programme, and whether it is a Bachelor's or a Master's;
• your expected end of studies;
• the markets that interest you and your LinkedIn profile, if you give them;
• your CV: the PDF you uploaded (its content, not its file name);
• when you agreed, and to which version of this text;
• when you added or last updated it;
• how often board members opened your CV on our website, and when and by whom it was last opened;
• your UniClubs user ID and the end date of your membership, so the rules below can be applied.

Who sees it. The companies listed on our Partners page, each through a personal link that a board member creates for it. A link works for at most 90 days, stops working when the company is no longer on our Partners page, and can be switched off at any time; it needs no login. For each link we count how often it was opened and how many CVs were downloaded with it; we store nothing about the people at the company. On our website, board members with admin rights see a list of the entries (names, degrees, dates and LinkedIn profiles) and can open each CV, to check it and to answer requests from our partners; we record each time a board member opens a CV this way (how often, and when and by whom last). A board member who creates a partner link can open it and then sees what the partner sees. We ask partners to use the CVs only for recruiting and to delete downloaded copies when they no longer need them. A copy a partner has downloaded is in their care, and their own privacy rules apply to it.

Where. Your entry and your CV are stored in the private, non-public storage of our hosting provider Vercel in Frankfurt (Germany); Vercel processes them on our behalf (see Hosting and server logs), as for the Emporium invitations. The few club members who manage our hosting account can technically also reach the stored files.

How long. We delete your entry and your CV automatically 12 months after the end of your expected last semester. Spring semesters end on 30 June, autumn semesters on 31 December: for “Spring 2028”, we delete it after 30 June 2029. If you leave the club, your CV is hidden from partners at once and deleted 30 days later, unless you renew your membership in the meantime. We notice that your membership has ended in whichever way comes first: its end date on UniClubs passes, you sign in here without an active membership, or our daily check with UniClubs no longer finds you among the club's active members. You can change your expected end of studies, and you can remove your CV at any time on the CV Book page: it is deleted at once, and partners lose access immediately.

The daily check. Once a day, our server checks with UniClubs, using the club's own API key, whether the members in the CV Book are still members of the club. For this it loads the list of the club's active members from UniClubs and uses only their UniClubs user IDs, university email addresses and membership end dates: it compares them with the CV Book and discards the list at once. Nothing from it is stored, except the new membership end date of members who are in the CV Book.

Legal basis. Your consent. You can withdraw it at any time with “Remove my CV” on the CV Book page or by writing to commodityclub@shsg.ch; this does not affect what happened before. For the daily check, which also reads the list entries of members who are not in the CV Book, we rely on our legitimate interest in deleting CVs on time; UniClubs manages our memberships on our behalf (see Sign in with UniClubs).

Your rights. You can see your entry on the CV Book page, correct your details there, replace your CV with a new PDF (“Update my CV”) and remove it. Your name, email address and degree programme come from UniClubs: after changing them there, remove your CV and add it again. Your other rights are listed under Your rights.

Signed-in active members see jobs, internships and open applications from our partners on the job board in the member area. Some link to the company's own website, where its privacy rules apply. For jobs marked “Apply through CTSC”, including open applications (a company without a job description that would like to see CVs and contacts those who fit), members can apply for that one company. The board reviews the applications and decides which ones go to it. Nothing is sent without your explicit agreement for that application.

Postings without the company's name. Some postings don't name the company but describe it instead, for example “a fertilizer trading company”. Your application then goes to the company behind the posting, if the board forwards it. The board tells you the company's name if you ask (write to commodityclub@shsg.ch).

When you apply through CTSC, we store:

• your name and email address;
• your degree programme and your expected end of studies;
• your CV: a copy of the PDF in your CV Book entry, or the PDF you upload for this application (its content, not its file name);
• your note to the company and your LinkedIn profile, if you give them;
• the job (for a posting without the company's name, also the description you saw), when you sent the application, and when the company could first see it;
• the board's decision on your application, when it was made and which board member made it;
• how often board members opened your CV on our website, and when and by whom it was last opened;
• when you agreed, and to which version of this text;
• your UniClubs user ID, so that you can apply only once per job and the fair-play rules below can be applied.

Where the details come from. From your CV Book entry, if you have one. Otherwise from UniClubs: when you apply and agree on UniClubs, we ask it for your email address and your profile (degree programme, graduation year and LinkedIn profile), as for the CV Book. UniClubs sends your phone number, your short bio and the address of the CV on your UniClubs profile with the same permission; we don't use them and discard them at once. We fill in the LinkedIn profile from your CV Book entry or from UniClubs for you; you can change or remove it before you send the application. When you send the application, we read your name, email address, degree programme and membership again, with UniClubs' access key kept in an encrypted cookie that only the job pages receive, for at most one hour. It is deleted when you send your application, when you sign out, or when the hour is over.

Who sees it. On our website, board members with admin rights see the applications (names, email addresses, degrees, end of studies, LinkedIn profiles, notes and CVs) and can open the CVs. They review the applications for each job and decide which ones go to the company: they forward an application, highlight it (the company then sees it first, marked as recommended by CTSC), or don't forward it. They can change that decision while the company's link works. We record each time a board member opens a CV this way (how often, and when and by whom last). Board members can add a short internal comment to an application, which only the board sees (never the company, nor you) and which is deleted with the application. Only the company of that job gets the applications the board forwarded or highlighted, through a personal link on our website that a board member creates for that job; it never sees the others, nor who else applied. The link needs no login, works for at most 90 days and can be switched off at any time. For each link we count how often it was opened and how many CVs were downloaded with it; we store nothing about the people at the company. On the job page you see whether your application was forwarded to the company or not (not whether it was highlighted). A copy the company has downloaded is in its care, and its own privacy rules apply to it. We ask companies to use the CVs only for this role.

Fair-play rules. Companies count on the people who apply. You get a strike if you don't show up to an interview, withdraw after being invited without a good reason, or don't reply to the company within 5 working days; only for an application the board forwarded to the company. The first strike is a warning in the member area; a second strike within 12 months means no applying for 6 months. Strikes expire after 12 months and are then deleted. With a strike we store your name and UniClubs user ID, the reason, the job and company (for a posting without the company's name, also the description you saw), when it was given, which board member gave it (their UniClubs user ID and first name) and a short note for the board, which neither you nor the company sees. A strike is kept until it expires, even when the application it relates to has already been deleted. We rely on our legitimate interest in reliable applications, so that companies keep offering jobs to our members. You can object at any time by writing to commodityclub@shsg.ch; the board can remove a strike.

Where. Your applications, their CVs and any strikes are stored in the same private storage of our hosting provider Vercel in Frankfurt (Germany) as the CV Book; Vercel processes them on our behalf (see Hosting and server logs). The few club members who manage our hosting account can technically also reach the stored files.

How long. We delete an application and its CV automatically 6 months after the job's deadline (for a deadline on 15 November 2026: after 15 May 2027), or, for a job without a deadline, 6 months after you sent it, whether the board forwarded it or not. If you withdraw it before the company can see it, it is deleted at once. Company links are deleted 90 days after they stopped working. Strikes are deleted 12 months after they were given.

Legal basis. Your consent, given for each application, which covers the board's review. You can withdraw it: on the job page with “Withdraw my application” until the company can see it, that is until the board has forwarded it while the company's link works (it is deleted at once), and afterwards by writing to commodityclub@shsg.ch: we then delete our copy, while a copy the company has downloaded is in its care. This does not affect what happened before. For the fair-play strikes, our legitimate interest, as described above.

Your rights. You see the status of your application on the job page (under review, forwarded to the company, or not forwarded) and can withdraw it there as described. Your other rights are listed under Your rights.

Upcoming events on our home and events pages come from the public events list that the club publishes on UniClubs (Evanescor GmbH, St. Gallen). Our server loads that list; your browser does not connect to UniClubs for it, and no data about you is sent. When you follow a “Register on UniClubs” link, you are on UniClubs and the UniClubs privacy policy (opens in a new tab) applies.

Our pages link to services run by other companies. We do not embed them, so they receive no data from you just because you visit our website. Once you follow a link, you are on their website and their privacy policy applies.

LinkedIn

Our company page, where we announce events and opportunities. Privacy policy (opens in a new tab)

Instagram

Our profile. Privacy policy (Meta) (opens in a new tab)

WhatsApp

Our community, which every HSG student can join. Privacy policy (opens in a new tab)

UniClubs

The student club platform at HSG, used for membership, event registration and signing in to our member area. Privacy policy (opens in a new tab)

The same applies to the websites of our partners.

Under the FADP you have the right to:

• find out whether we process personal data about you, and receive a copy of it;
• have incorrect data corrected;
• have your data deleted, or object to its processing;
• receive data you gave us in a common electronic format, where the law provides for this;
• withdraw your consent at any time, with effect for the future.

If you are in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) gives you similar rights.

To use your rights, email us at commodityclub@shsg.ch. We may ask you to confirm your identity first. If you believe we handle your data unlawfully, you can complain to the Federal Data Protection and Information Commissioner (FDPIC) (opens in a new tab) or, in the EU, to your local data protection authority.

We update this notice when our website or the way we handle data changes. The version published on this page always applies.

Last updated: October 2026

Questions about this notice or about your data? Write to commodityclub@shsg.ch and we will get back to you as soon as we can.