Privacy
1. Who is responsible
The St. Gallen Endowment for Prosperity Through Trade (SGEPT) operates Digital Acquis (https://digital-acquis.eu), a joint project with Kai Zenner and TUM Think Tank. SGEPT is responsible for the personal information described in this policy. Contact us at office@sgept.org, or write to St. Gallen Endowment for Prosperity Through Trade, Guisanstrasse 36, 9010 St. Gallen, Switzerland.
2. Information collected when you use the website
Our servers and service providers receive technical information needed to deliver the website, including your IP address, request time, requested page or endpoint, browser information and response status. We use appropriate operational logs to protect the website and investigate failures.
With your analytics consent, Google Analytics 4 records how the website is used. This includes cookie and session identifiers, pages visited (the address without query string or fragment), the page that referred you to the website, time and interactions, device and browser information, language, approximate location, search text entered on Explore, filters selected, links followed to official sources and other websites, files opened such as Markdown exports, and use of the AI reading guide.
Search text you type on Explore is sent to Google Analytics when you have accepted analytics. Please do not type personal information into the search box.
Google states that GA4 uses IP addresses to derive location at collection and then discards them before logging. The remaining identifiers and usage data can still be personal information. How Google uses information.
When you follow a link to Digital Policy Alert, our server log records where the link sat (for example the footer), the type of page and the entry it belonged to. This measurement sets no cookie and records no identifier for you.
The website loads its typeface from Bunny Fonts (bunny.net), which receives your IP address when the page loads.
3. When you write to us
When you email office@sgept.org, we use your message and contact details to answer you.
4. Editing panel
The /admin panel is for named editors only. It uses an editorial_session cookie for sign-in that lasts up to eight hours. Google Analytics never runs there.
5. Purposes and legal grounds
We follow Swiss data-protection law. Where the EU or UK GDPR applies, we use the following grounds:
| Purpose | Legal ground |
|---|---|
| Deliver and protect the website | Our legitimate interests in operating a secure, reliable website, balanced against your rights |
| Answer enquiries | Our legitimate interests in responding to people who contact us, balanced against your rights |
| Optional website analytics | Consent |
| Editor accounts | Our legitimate interests in operating the editing service, balanced against your rights |
Our cookie controls offer Accept analytics and Reject analytics. Analytics stays off until you choose to accept it. Use Cookie settings in the website footer to change or withdraw your choice at any time.
Withdrawal stops future consent-based collection and use; it does not change the lawfulness of processing carried out before withdrawal. The browser setting applies to that browser and website. Browser settings also let you clear or block storage, although blocking essential storage can affect sign-in.
| Storage | Purpose | Duration |
|---|---|---|
Consent preference: digital-acquis.privacy.choice in localStorage | Remember your analytics choice | Until you change or clear your choice, or we ask you to choose again because the purposes have changed |
Google Analytics identifiers, including _ga and _ga_* | Optional usage statistics | Google’s default expiry is two years from the last update; browser limits or configuration can shorten this. Visits can renew the expiry. Removed on withdrawal in that browser |
Editor session cookie: editorial_session | Sign-in for named editors | Up to eight hours |
Browser storage lifetimes do not determine how long server records are retained. The retention criteria below apply separately.
7. Who receives information and where
Authorised SGEPT staff and providers receive information needed for their work. Amazon Web Services hosts the website in the EU, in its Ireland region. Google receives information for analytics when you consent. Bunny Fonts provides the typeface.
Where a provider acts on our behalf, we require it to process information under an appropriate agreement. A provider may have its own responsibilities for services you choose directly. Its own notice explains that processing.
Information may be processed outside Switzerland and your home country. We use an applicable adequacy arrangement or appropriate contractual safeguards for transfers that require them. You can request information about those safeguards, including a copy where applicable, at office@sgept.org. We may also disclose information when required by law or necessary to establish, exercise or defend legal claims.
8. How long we keep information
We keep personal information only while it is needed for the purposes described in this policy. We assess that need by the type of record, whether the service or enquiry is still active, the age and relevance of the information, and any applicable legal obligation. We review retained information and delete or anonymise it when that need ends. An ongoing account or a new visit does not, by itself, justify keeping every earlier record.
| Information | How we determine retention |
|---|---|
| Enquiries and correspondence | Until the enquiry and related follow-up are concluded, or while the information remains necessary for an ongoing professional relationship. We remove outdated contact details and records that no longer serve that purpose |
| Google Analytics information | Google Analytics is configured to retain event-level data for two months and user-level data for 14 months. New activity restarts the user-level period. Google's scheduled deletion process applies. These controls do not govern browser cookies or standard aggregate reports; identifying information must still be removed when no longer needed |
| Server and security logs | While needed to deliver the website or investigate a specific fault, abuse report or security incident. Request details needed for troubleshooting are removed when that case is resolved and no further justified need remains. We use anonymous totals where individual records are no longer necessary |
| Backup copies | Until replaced through the backup cycle needed for disaster recovery. Deleted information in backups is kept beyond ordinary use, and its deletion is reapplied if a backup is restored |
9. Your rights
Contact office@sgept.org to request access, correction or deletion, to withdraw consent, or to object to a use of your information. Depending on the law that applies, you can also request restriction of processing and a portable copy of information. We may ask for proportionate information to verify your identity. You do not need to know the technical time or location of a visit before making a request.
For processing based on legitimate interests, you can object on grounds relating to your situation. Where GDPR applies, we normally respond within one month; if a lawful extension is necessary, we tell you within that month and explain why.
You can complain to the Swiss Federal Data Protection and Information Commissioner, an appropriate EU/EEA supervisory authority or the UK Information Commissioner's Office, as applicable. Contacting us first is optional.
10. Security and changes
We use technical and organisational measures appropriate to the information and risks, including access restrictions and encrypted connections. No system can guarantee complete security.
We update this policy when our processing changes and identify the current version on this page. For material changes, we provide an appropriate notice. If a new purpose requires your consent, we ask before using your information for that purpose.