top of page

 

Privacy Policy
 

A) INFORMATION ABOUT THE WEBSITE PRIVACY POLICY

 

GICAM Foundation, a foundation with its registered office at Via Lavizzari 4 – 6900 Lugano (hereinafter, the “Controller”), in its capacity

as data controller, informs you that your data, in connection with your browsing of our website, will be processed in the manner and for the purposes set out below:

 

B) DATA PROCESSING

 

1) Subject matter of the processing

The Controller processes the personal data provided by you (hereinafter referred to as the “Data Subject”) solely to respond to your requests. Such data may be disclosed to third parties only where necessary for this purpose.

 

2) Purposes of the processing

Your personal data are processed:

A) without your express consent for the following purposes:

  • to manage client relationships and coordinate accounting, orders, invoicing and any disputes;

  • to enter into contracts for the services provided by the Controller;

  • to manage and maintain the Website;

  • to process a contact request;

  • to prevent or detect fraudulent activity or misuse that may harm the Website;

  • to exercise the Controller’s rights, for example, to pursue a legal claim.

B) Only with your prior specific and separate consent, for the following marketing purposes:

  • to send you email newsletters about the Organisation’s activities, communications and/or advertising material concerning services offered or events organised by the Controller, and to assess satisfaction with the quality of those services and events; to send you fundraising communications by email, post, SMS and/or telephone

 

In the cases described above, the legal basis for processing your personal data is the performance of a contract with you, the provision of a service that you have specifically requested, compliance with a legal obligation or the protection of our legitimate interests.

 

3) Methods of processing

We process your personal data in accordance with Swiss data protection legislation and, to the extent applicable to us, other relevant legislation, such as the European Union’s General Data Protection Regulation (GDPR).

We do not make decisions based solely on automated processing that produce legal effects concerning you or significantly affect you (automated individual decision-making). However, we may use your data to create a profile of you, for example, to analyse your philanthropic potential or to segment our database.

You may have the right to object to such activities to the extent provided for by law.

We may combine your personal data with other information (aggregation) or remove any data that would enable you to be identified (anonymisation), so that the data are no longer considered personal data under applicable data protection legislation. In such cases, this notice will no longer apply, and we may use those data for purposes not specified in this notice, for example, for statistical or analytical purposes. You may object at any time to the anonymisation or aggregation of your personal data for these purposes.

 

4) Retention period for the data processed

Data are processed and retained for as long as required for the purposes for which they were collected.

Accordingly:

  • Personal Data collected for purposes relating to the performance of a contract between the Controller and the User will be retained until that contract has been fully performed.

  • Personal Data collected for purposes relating to the Controller’s legitimate interests will be retained until those interests have been fulfilled. The User may obtain further information about the legitimate interests pursued by the Controller in the relevant sections of this document or by contacting the Controller.

Where processing is based on the User’s consent, the Controller may retain Personal Data for a longer period, until that consent is withdrawn. In addition, the Controller may be required to retain Personal Data for a longer period to comply with a legal obligation or an order issued by an authority.
At the end of the retention period, Personal Data will be erased. Accordingly, once that period has expired, the rights of access, erasure, rectification and data portability can no longer be exercised.

 

5) Processing of browsing data

During their normal operation, the IT systems and software procedures used to operate this website acquire certain personal data whose transmission is inherent in the use of Internet communication protocols.
This information is not collected to be associated with identified data subjects, but, by its very nature, could allow users to be identified through processing and association with data held by third parties.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file returned in response, the numerical code indicating the status of the server’s response (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.
These data are used solely to obtain anonymous statistical information about use of the website and to check that it is functioning correctly. The data may also be used to establish liability in the event of suspected cybercrime against the website.

 

6) Security measures

We are committed to ensuring the security of your personal data and have implemented physical, technical and organisational measures to protect it and prevent unauthorised access.

We restrict access to your personal data to those who need it for the purposes described in this notice.

Although we take appropriate measures to protect your data, no IT infrastructure is completely secure. We therefore cannot guarantee that the data you provide is entirely protected against unauthorised access or theft by third parties.

When you send us information electronically, it may be transferred internationally over the Internet. The Internet is not a secure environment, and this notice applies to the use of your personal data only once it is under our control. Owing to the nature of the Internet, any transmission of data is at your own risk.

If we have reasonable grounds to believe that your personal data have been obtained by an unauthorised person and notification is required by law, we will promptly inform you of the breach through an appropriate communication channel (including email or notices on our website).

 

7) Access to data

Your data may be made accessible for the purposes set out in sections 2.A) and 2.B):

  • to the Controller’s employees and collaborators, in their capacity as authorised persons and/or internal data processing managers;

  • to third-party companies or other parties carrying out outsourced activities on behalf of the Controller

 

8) Disclosure of data

Without your express consent, the Controller may disclose your data to supervisory bodies, judicial authorities and any other parties to whom disclosure is required by law for the purposes stated above. Your data will not be made public.

 

9) Data transfers

We store your personal data on servers located in Switzerland, the EU and outside the EU.

In certain circumstances, your personal data may be made available to recipients located abroad, including our subcontractors, other business partners or authorities/courts. In particular, we use services provided by suppliers based in various countries within and outside the European Union, such as the United Kingdom, the United States and Israel, from which some of your personal data may be accessible.

In such cases, we ensure that appropriate safeguards are in place in accordance with applicable data protection legislation, for example, by relying on standard contractual clauses adopted by the European Commission and Switzerland, or on a statutory exception such as consent, the performance of a contract, the establishment, exercise or defence of legal claims, an overriding public interest or the protection of life or physical integrity.

If you provide us with data, you are deemed to have consented to such transfers. You may request further information and obtain a copy of the applicable safeguards by sending a request to info@gicamfoundation.org

 

10) Nature of the provision of data and consequences of refusal

The provision of data for the purposes set out in section 2A is mandatory, as it is necessary to respond to requests for information.

By contrast, consent for the purposes set out in section 2B is optional. You may therefore decide not to provide any data or subsequently refuse permission for data already provided to be processed. In that case, you will not receive newsletters or communications about events offered by the Controller. You will, however, remain entitled to the Services referred to in section 2A.

 

11) Rights of the Data Subject

Right of access - To obtain confirmation as to whether personal data concerning you are being processed and, if so, to receive information, in particular, about the purposes of processing, the categories of personal data processed and the retention period, and the recipients to whom the data may be disclosed;

Right to rectification - To obtain, without undue delay, the rectification of inaccurate personal data concerning you and the completion of incomplete personal data;

Right to erasure - To obtain, without undue delay, the erasure of personal data concerning you in certain circumstances;

Right to restriction - To obtain restriction of processing from the Controller in certain circumstances;

Right to data portability - To receive the personal data concerning you that you have provided to the Controller in a structured, commonly used and machine-readable format, and to have those data transmitted to another controller without hindrance;

Right to object - To object to the processing of personal data concerning you, unless the Joint Controllers have legitimate grounds to continue processing.

 

12) How to exercise your rights

If you believe that your personal data have been used in a manner inconsistent with this notice, or if you have any questions about the collection or processing of your personal data, you may contact our Data Protection Officer (DPO):

  • Email: info@gicamfoundation.org

  • Post: Fondazione GICAM - Group International Chirurgiens Amis de la Main – For the attention of the Data Protection Officer (DPO), Via Lavizzari 4, 6900 Lugano, Switzerland

 

13) Changes to this Privacy Notice

This Privacy Notice may be amended. You are therefore advised to check it regularly and refer to the most up-to-date version. The updated version of the privacy policy will, in any event, be published on this page, together with the date on which it was last updated.

 

Last updated on 25 September 2026.

bottom of page