Privacy policy

This policy explains which personal data the Zurich AI Lab processes through this website, why, and what rights you have. In short: the site sets no cookies, does not track you across websites, and counts visits only as anonymous statistics. We process only what is needed to deliver the pages, and your email address if you subscribe to the AI Strategy Brief or write to us.

1. Who is responsible

University of St.Gallen (HSG)
Zurich AI Lab, Institute of Management and Strategy (IFB-HSG)
Dufourstrasse 40a, 9000 St. Gallen, Switzerland
tomoko.yokoi@unisg.ch

You can also reach the University's data protection office at datenschutz@unisg.ch.

2. Which law applies

The University of St.Gallen is a public-law institution of the Canton of St.Gallen. We process personal data in accordance with the St.Gallen Data Protection Act (DSG SG, sGS 142.1) and, where applicable, the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, the legal basis for each processing is named below.

3. Visiting the website

The site is hosted by Vercel Inc., United States. When you open a page, your browser automatically sends technical data, which Vercel processes to deliver the page and protect the site against attacks:

• your IP address,
• the date and time of the request,
• the page requested and the page you came from,
• your browser and operating system.

Pages are served from the Vercel location nearest to you. The few server functions (the newsletter signup and the live list of Brief issues) run in Frankfurt, Germany. Vercel keeps this log data for a short time only. We do not combine it with other data or use it to identify visitors.

Legal basis: the University's public task and our legitimate interest in a secure, working website (Art. 6(1)(e) and (f) GDPR). Vercel is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, which Switzerland and the EU recognise as providing adequate protection.

4. Visitor statistics, no cookies

The site sets no cookies and uses no advertising or social media plugins. Fonts, images and scripts are served from this domain, so opening a page sends no request to Google Fonts or other third parties.

To see which pages are read, we use Vercel Web Analytics, run by our host Vercel. For each page view it records the time, the page and the page you came from, your approximate location (country, region and city), and your browser, operating system and device type. To count a visit only once, it derives a hash from your request instead of setting a cookie, and discards it after 24 hours. It does not store your IP address, does not follow you across other websites, and gives us only aggregate figures that do not identify you.

Legal basis: our legitimate interest in understanding how the site is used so we can improve it (Art. 6(1)(f) GDPR). You can block it with any common content blocker without affecting the rest of the site.

If you switch between light and dark mode, your choice is saved in your browser's local storage under the key theme-pref. It stays on your device and is never sent to us. You can remove it at any time by clearing your browser's site data.

5. AI Strategy Brief newsletter

When you subscribe, we pass your email address to beehiiv Inc. (228 Park Avenue S. #29976, New York, NY 10003, United States), which sends the Brief on our behalf. We also tell beehiiv that you signed up through this website. beehiiv then emails you a confirmation link, and you are only subscribed once you click it.

Like most newsletter services, beehiiv records when you subscribed and confirmed and whether an issue is opened and which links are clicked. It stores these records with your IP address and device information, and we see them as aggregate figures. Our signup endpoint uses your IP address briefly, in memory only, to block automated abuse, and does not store it.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every issue or by writing to us. We keep your address for as long as you are subscribed. After you unsubscribe, we keep only the record needed to make sure you are not emailed again.

beehiiv processes subscriber data in the United States under a data processing agreement that incorporates the EU Standard Contractual Clauses, which Switzerland also recognises. For some purposes of its own, such as preventing abuse of its service, beehiiv acts as an independent controller under its privacy policy. The Brief's archive at aibrief.vandecatsije.com is hosted by beehiiv, and that policy also applies when you read issues there.

6. Contacting us

If you email us, we use your address and message to reply. We keep the correspondence for as long as the request requires and as the University's archiving rules oblige. Legal basis: the University's public task and our legitimate interest in answering you (Art. 6(1)(e) and (f) GDPR), or steps you ask us to take before entering into an agreement, such as planning a briefing or workshop (Art. 6(1)(b) GDPR).

7. Team profiles

The site presents the lab's members with their name, role, photo and professional links. Team profiles are kept out of search engine indexes. Members can ask for their profile to be corrected or removed at any time.

8. Links to other websites

The site links to other websites, such as partner institutions, LinkedIn and Google Scholar. No data is sent to them until you follow a link. From then on, the other site's privacy policy applies.

9. Security

The whole site is served over an encrypted connection (HTTPS). Access to the systems behind it is limited to the people who run the site.

10. Your rights

You can ask us what personal data we hold about you and have it corrected or deleted. You can also object to its processing or ask us to restrict it. Where the GDPR applies, you can also ask to receive your data in a portable format. Where processing is based on your consent, you can withdraw it at any time with effect for the future. To exercise these rights, write to tomoko.yokoi@unisg.ch or to the University's data protection office.

You can also lodge a complaint with a supervisory authority. In Switzerland, this is the Fachstelle für Datenschutz des Kantons St.Gallen, Klosterhof 7, 9001 St.Gallen (datenschutz@sg.ch). In the European Union, you can contact the data protection authority in your country of residence.

11. Changes to this policy

We update this policy when the website or the law changes. The version on this page is always the current one, and the date at the top shows when it last changed.