Legal
Privacy Policy
Last updated: 4 November 2026
This policy explains what personal data GIPM collects when you visit our website, apply, enrol and study with us, why we need it, who we share it with, and the rights you have. We collect only what we need and we never sell your data.
1. Who is responsible
The controller responsible for your personal data is GIPM, operator of GIPM (Global Institute of Polytechnic and Management), Genève, Switzerland. For any privacy question or request, write to admissions@gipmedu.com.
2. Which laws apply
We are based in Switzerland and follow the Swiss Federal Act on Data Protection (FADP). Where we offer our courses to people in the European Union or the European Economic Area, we also respect the EU General Data Protection Regulation (GDPR). We also take into account the data-protection laws of the countries our students come from — for example Nepal’s Individual Privacy Act, 2075 (2018).
3. What data we collect
Data you give us
- Account and contact details: name, email address, phone or WhatsApp number, password (stored only in encrypted, hashed form).
- Profile details: date of birth, gender (optional), nationality, address, education, work history and an emergency contact.
- Admission documents: such as a passport or national ID, a photo, academic certificates and transcripts, a CV and work references. These can contain sensitive information, so we store them privately and limit who can open them (see section 8).
- Enquiries: what you send us through contact or enquiry forms, email or WhatsApp.
- Payment details: for bank transfers, the payment reference and amount you report. Card payments are processed by Stripe — we never see or store your full card number.
Data created while you study
- Enrolments, payments and invoices; lesson progress, attendance, assessment results and certificates.
- Live classes: your name as shown in the class, your participation, chat messages and — if you switch them on — your camera and microphone. Classes may be recorded for enrolled students to review (see our Terms).
Data collected automatically
- Technical data: IP address, browser and device type, and the time of your visit, recorded in our server logs for security and troubleshooting.
- Usage data: which courses and pages you view, linked to an anonymous ID in a cookie (and to your account if you are logged in). We use it to improve the website and to recommend courses.
4. Why we use it
| Purpose | Legal basis |
|---|---|
| Creating your account, processing applications and enrolments, checking your documents, teaching, assessing and issuing certificates | Performing our contract with you, or steps you asked for before entering into one |
| Taking payments, issuing invoices and keeping accounting records | Contract; legal obligations (Swiss accounting law) |
| Answering enquiries and keeping you informed about your course | Contract; our legitimate interest in answering you |
| Letting anyone verify a certificate you share (name, course, date and certificate ID) | Contract; legitimate interest in preventing certificate fraud |
| Keeping the website and accounts secure, preventing fraud and misuse | Legitimate interest; legal obligations |
| Improving our courses and website, and recommending courses to you | Legitimate interest (you can object — see section 9) |
| Sending news and offers | Your consent, which you can withdraw at any time |
| Sharing your profile with employers for internships or jobs | Only with your consent |
We do not make decisions about you, such as admission, by automated means alone.
5. Who we share it with
We share personal data only where needed for the purposes above, and only with service providers who are bound to protect it and to use it only on our instructions:
- Hosting: our web hosting provider, which stores the website, database and uploaded documents.
- Payments: Stripe (card payments) and our banks (bank transfers and refunds).
- Email: our email delivery provider (Brevo), which sends account, enrolment and course emails.
- Live classes: our video-conferencing provider (for example Zoom).
- Website services: Google Fonts, which displays our fonts and receives your IP address when a page loads; and, where enabled, privacy-friendly website statistics.
- Messaging: if you contact us on WhatsApp, Meta processes those messages under its own privacy policy.
- Professional advisers and authorities: our auditors, lawyers and insurers where needed, and public authorities where we are legally required to disclose data (for example in a visa process you have started, or a criminal investigation).
- Employers and partners: only with your consent, for internships or placement.
6. Data stored outside Switzerland
Some of our providers process data outside Switzerland. Our hosting provider’s servers are located in Singapore. Stripe, Zoom and Google may process data in the United States and the European Union, and Brevo processes data in the European Union.
The EU is recognised by Switzerland as providing adequate protection. For other countries we rely on safeguards such as the standard contractual clauses approved by the Swiss Federal Data Protection and Information Commissioner, or — where those are not available — on the transfer being necessary to perform our contract with you. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | How long |
|---|---|
| Account and profile | While your account is active, and up to 2 years after your last activity |
| Admission documents (passport, ID, certificates, CV) | Until 2 years after your course ends; 12 months if you never enrol |
| Payment, invoice and accounting records | 10 years, as required by Swiss law |
| Certificate records (name, course, date, ID) | Permanently, so your certificate can always be verified |
| Class recordings | Until the end of the course, plus up to 6 months |
| Course views and recommendations data | 12 months |
| Enquiries | 2 years after our last contact |
We may keep data longer where the law requires it or where we need it to establish or defend legal claims.
8. How we protect it
- All connections to our website are encrypted (HTTPS).
- Passwords are stored only in hashed form.
- Admission documents are kept in private storage that cannot be reached by a web address. Only you and authorised admissions staff can open them, and every time staff open, approve or reject a document it is logged.
- Staff access is limited to what each person needs for their role.
No system is completely secure. If a data breach is likely to put your rights at high risk, we will inform you and the authorities as required by law.
9. Your rights
Depending on the law that applies to you, you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected — much of it you can edit yourself in your profile;
- have your data deleted, unless we must keep it (for example accounting records or certificate records);
- object to processing based on our legitimate interests, including course recommendations;
- receive data you gave us in a common electronic format (data portability);
- withdraw consent at any time, without affecting earlier processing.
Email admissions@gipmedu.com to use these rights. We may ask you to confirm your identity, and we reply within 30 days. Using your rights is free of charge.
10. Cookies and similar technologies
Our website uses a small number of cookies and browser storage items. We do not use advertising cookies.
| Name | Purpose | Duration |
|---|---|---|
auth | Keeps you signed in. Essential. | Until you sign out |
XSRF-TOKEN, session cookie | Security for forms and the staff admin area. Essential. | Session |
ihms_sid | A random, anonymous ID used for website statistics and course recommendations. | 12 months |
| Browser storage (cart, enrolment progress) | Remembers your choices while you enrol. Essential. | Until you close the tab or clear it |
| Stripe cookies | Set by Stripe on its own checkout page for fraud prevention. Essential for card payments. | Set by Stripe |
You can block or delete cookies in your browser settings. If you block essential cookies, you will not be able to sign in or enrol.
11. Minors
Our courses are intended for people aged 18 and over. Applicants aged 16 or 17 need the consent of a parent or guardian. We do not knowingly collect personal data from children under 16. If you believe a child has given us data, please contact us and we will delete it.
12. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. If we make important changes, we will tell students by email or in their dashboard.
13. Contact and complaints
For questions or to use your rights: admissions@gipmedu.com, or by post to GIPM, Genève, Switzerland.
If you are not satisfied with our answer, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you live in the EU or EEA, you can also contact the data-protection authority of your country.