Data Protection & Privacy Policy

Helvetia Education Group SA and its product Helvetia Connect (“HEG”) [1]  is advancing the world of education by transforming workflow systems for education institutes. In doing so, we collect, process and use large quantities of personal information. We collect and use information from customers, suppliers, students, business partners and other external parties (“User”) with whom we interact. HEG takes data privacy seriously and believes that carrying out our business activities in compliance with applicable data protection laws and in accordance with sustainable corporate governance is fundamental to our business success.

HEG’s Data Protection & Privacy Policy (“Notice”) explains our practices as the responsible controller in relation to the collection, processing and use of personal data of individuals at HEG’s customers and prospective customers who are located in the European Economic Area or Switzerland (or to whom EU data protection law otherwise applies).  Such individuals may include academic professionals, procurement staff, technical or support staff and other staff members, students as well as business contacts at schools, companies, institutions, purchasing organizations, distributors, wholesalers, agents, and other intermediaries. If you fall into one of those categories, this Notice will help you understand what data HEG may collect about you, how HEG uses and safeguards that data, and with whom we may share it.

The security of your personal information is important to us. However, the transmission of information via the Internet or email is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data while you are transmitting it to our site; any such transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorized access.

We may change this Notice periodically, so we encourage you to review it from time to time.

What is Personal Data

Personal data is any information about you by which you can be identified. Information such as:

  • Your name, date of birth, email address, postal address, phone number, mobile number;
  • Information about your device (such as the IP address, which is a numerical code to identify your device that can provide information about the country, region or city where you are based);

Information relating to your personal circumstances and how you use our sites, apps and services when you:

  • Buy or use any of our products and services
  • Register for a specific product or service
  • Subscribe to newsletters, alerts, or other services from us
  • Contact us through various channels, or ask for information about a product or service
  • Take part in a competition, prize draw, or survey
  • Visit or browse our website or other Helvetia Group websites
  • Have given permission to other companies to share information about you


  • Which is publicly available
  • Available about you as a customer of a business that we acquire

Categories of Personal Data

HEG may collect, process and use the following categories of personal data about you which have been obtained either from you or from certain third parties (e.g. your employer or the healthcare institution you work for, or other business contacts) (collectively, personal data):

  • Identification data, such as full name, academic title, business contact details.
  • Professional data, such as business name and type (e.g. the academic institution you work for), business website, area of expertise, job title and description, department, professional experience.
  • Product data, such as the types of products and services used or purchased by you or your employer and related data (including user ID);
  • Communication and interaction details, such as customer service requests, correspondence, notes of calls or meetings, and other customer care or technical service interactions.
  • Training data, such as details of product training received; and
  • Financial or payment data (in limited cases only), such as bank account numbers and dates and amounts of payments made or received.


Cookies are small electronic files that are placed on your device during browsing of the Website and are used to provide optimal browsing on this Website.

What data is collected via cookies?

Cookies collect varied anonymous information, such as: the date/hour of access, consulted pages and in which language, location data, and website audience. Cookies provide device and IP recognition, without identifying the person who uses the device. This information does not constitute as Personal Data unless the information collected from cookies is combined with that collected regarding the User as referred to in the Notice.

How can I be informed of the presence of cookies?

The User is informed of cookie storage and these purposes by an informational banner upon the first visit of any page of the Website. The informational banner will link to this Notice and will give the User the option to accept or reject cookies related to the Website.

A User is considered to have accepted cookie storage when: the “Accept” text or button on the banner is clicked, or when browsing of the Website is continued, or when any element on the page or banner is clicked (except the “Decline” text or button).

How can the User reject cookies, and what are the consequences?

The User is entirely at liberty to accept or reject cookie storage on their device. However, rejecting cookies may restrict access to certain services within the Website, such as viewing media content. The User can reject cookie installation on their device by selecting the appropriate settings in their web browser. In this regard, Helvetia recommends following the instructions provided for the specific web browser, generally available under the “Help” menu.

What kind of cookies are used by the Website?

The cookies that may be used on the Website have been classified into the following categories:

  • Session cookies – These cookies are essential in order to browse and use certain functions within the Website, such as the purchase basket or the account.
  • Tracking cookies – In order to provide optimal browsing, Helvetia installs cookies which track the User’s preferences and choices, such as your preferred browsing language, or the memorization of your account username and password. Tracking cookies are also used to gather statistical data about the Website and connection to the Website.
  • Third-party cookies – The Website proposes media content (e.g. YouTube) and can be used to share content through social media (e.g. Facebook, LinkedIn, etc.). Viewing and sharing such content through social media websites requires cookie storage set by the website editor responsible for such content. These cookies are neither edited nor updated by Helvetia, which declines all responsibility for their storage or use. These cookies are capable of building up a User browsing history of other websites to create a profile of their interests. These cookies can therefore influence the content of other visited websites. If the User does not authorize these cookies, they may not view the media content nor share it through social media.

How long are cookies saved for?

Cookies are stored on the User’s device for twelve (12) months, starting from the date on which the browser received the cookies. Cookie expiration is not prolonged during new visits to the Website.

How can the User get rid of cookies saved on their device?

The User may delete cookies stored on their device at any time. To do so, they can use the functions specific to their web browser (Internet Explorer, Firefox, Safari, etc.), or configure their browser to reject cookie installation. The means to proceed should be indicated in the browser’s “Help” menu. For any issues, the company in charge of the web browser should be contacted.


HEG does not engage in spamming defined as the sending of a large number of unwanted promotional e-mails in a repeated manner to people with whom the sender has not had any previous contact, or who have stated that they do not wish to receive such communications.

On the other hand, HEG periodically informs the user via e-mail if products and services may be of interest to them, leaving them the possibility to opt out of receiving this information.

Processing purposes and legal grounds for processing

Personal data is collected, processed, and used for the following purposes (collectively, processing purposes). Furthermore, HEG relies on the following legal grounds for the collection, processing, and use of personal data:

Processing purposes Categories of Personal Data Involved Legal Basis
Delivering products and services, including technical support and maintenance services. Identification data; product data; communication details. The processing is necessary for the purposes of the legitimate interests pursued by HEG (Art. 6(1)(f) GDPR) – legitimate interests are stated in the first column.
Providing customer service and engaging in other communication with the Customer. Identification data; product data; communication details. The processing is necessary for the purposes of the legitimate interests pursued by HEG (Art. 6(1)(f) GDPR) – legitimate interests are stated in the first column.
Marketing and customer relationship activities, which may include profiling or categorization of your potential interests in HEG products and services for tailored marketing. Identification data; professional data; product data; communication details. The data subject has given consent to the processing of his or her personal data (Art. 6(1)(a) GDPR).

The processing is necessary for the purposes of the legitimate interests pursued by HEG (Art. 6(1)(f) GDPR) – legitimate interests are stated in the first column.

Product/service development and improvement of quality and functionality of products and services. Product data. The processing is necessary for the purposes of the legitimate interests pursued by HEG (Art. 6(1)(f) GDPR) – legitimate interests are stated in the first column.
Training records of staff Identification data; professional data;

training data.

The processing is necessary for the purposes of the legitimate interests pursued by HEG (Art. 6(1)(f) GDPR) – legitimate interests are stated in the first column.
Security and fraud prevention activities such as prevention of fraud, misuse of IT systems, or money laundering, physical security, IT and network security, or internal investigations. Identification data; professional data; communication details; product data; financial or payment data. The processing is necessary for compliance with a legal obligation to which HEG is subject (Art. 6(1)(c) GDPR).

The processing is necessary for the purposes of the legitimate interests pursued by HEG (Art. 6(1)(f) GDPR) – legitimate interests are stated in the first column.

Complying with legal obligations or standards, responding to and complying with requests and legal demands from regulators or other authorities in or outside of your home country, compliance with transparency laws and equivalent laws and regulations, industry standards and codes, details of training given to distributors and other intermediaries relating to compliance. Identification data; professional data; product data; communication details; financial or payment data. The processing is necessary for the purposes of the legitimate interests pursued by HEG (Art. 6(1)(f) GDPR) – as stated in the first column.

The processing is necessary for compliance with a legal obligation to which HEG is subject (Art. 6(1)(c) GDPR).



The provision of personal data as described in this Notice is necessary for the processing purposes described above. While the provision of your personal data is generally voluntary, you may not be able to benefit from the processing purposes if you do not provide the personal data.

Categories of Recipients

You should expect that we will transfer your personal data to third parties for the processing purposes as follows:

  • Within HEG: Helvetia Education Group SA, in Switzerland.
  • With certain acquiring or acquired entities: If HEG is sold or transferred in whole or in part, or if another entity is being acquired by or integrated into HEG (or any similar transaction is being contemplated), your personal data may be transferred to the other entity prior to or after the transaction, subject to any rights provided by applicable law, including in jurisdictions where the other entity is located.
  • With data processors: Certain service providers such as IT support, logistics and marketing providers, will receive your personal data to process such data under appropriate instructions (processors) as necessary for the processing purposes, in particular to provide IT and other administrative support, to assist with compliance with applicable laws, and for other activities. The processors will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard your personal data, and to process the personal data only as instructed.
  • With certain other third parties: Your personal data may need to be shared with professional advisors, regulators, governmental authorities and other similar bodies, for example where we have an obligation to be transparent about interactions we have with healthcare professionals or government officials in connection with our business.

Access to your personal data is generally restricted to those individuals that have a need to know or use that data to fulfill their job responsibilities.

International Data Transfers

Data we collect may be transferred to, stored and processed in any country or territory where one or more of our HEG group companies or service providers are based or have facilities. While other countries or territories may not have the same standards of data protection as those in your home country, we will continue to protect personal data that we transfer in line with this Privacy Policy.

Retention Period

Your personal data is stored for as long as is necessary to achieve the processing purposes for which the personal data is collected, in accordance with applicable data protection laws. When HEG no longer needs to use your personal data for the purposes identified above, we will remove it from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it (unless we need to keep your information to comply with legal or regulatory obligations). If we anonymize data, they no longer qualify as personal data and can no longer be attributed to you in which case we may use such data without further notice to you.

To determine the appropriate retention periods for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and the applicable legal requirements.

Your Rights

Right to withdraw your consent: If, in accordance with applicable law, you have declared your consent regarding certain types of processing activities (in particular regarding the receipt of direct marketing communication via email, SMS/MMS, fax, and telephone), you can withdraw this consent at any time with respect to future processing by using the methods mentioned in the original or any related communication. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. You can also withdraw your consent by contacting us as set out below.

Additional data privacy rights: Pursuant to applicable data protection law, you have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of processing of your personal data; (v) request data portability; and/or (vi) object to the processing of your personal data. Below please find further information on your rights to the extent that the GDPR applies. Please note that these rights might be limited under the applicable local data protection law.

  • Right to request access to your personal data: As provided by applicable data protection law, you have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access.

You have the right to obtain a copy of the personal data undergoing processing free of charge. For further copies requested by you, we may charge a reasonable fee based on administrative costs.

  • Right to request rectification: As provided by applicable data protection law, you have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
  • Right to request erasure (right to be forgotten): As provided by applicable data protection law, you have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data.
  • Right to request restriction of processing: As provided by applicable data protection law, you may have the right to obtain from us restrictions on the processing of your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes.
  • Right to request data portability: As provided by applicable data protection law, you may – in cases where processing is based on consent or the performance of a contract, and the processing is carried out through automated means – have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us.
  • Right to object: Under certain circumstances, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and in such circumstances we are required to cease processing your personal data. If you have a right to object and if you exercise this right, your personal data will no longer be processed for such purposes by us.

You may submit your request to exercise your rights under GDPR by filling out the attached form and sending it to

You may exercise this right by contacting us as stated below. Such a right to object may, in particular, not exist if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded. If you have given your consent to receive direct marketing via email, SMS/MMS, fax, and telephone, you may withdraw your consent as explained above.

To exercise your rights please contact us as described below. You also have the right to lodge a complaint with the competent data protection supervisory authority in the relevant Member State (for example, the place where you live or work – contact details can be found here:

Questions and Contact Information

If you have any questions about this Notice, wish to contact HEG’s Data Protection Officer, or if you wish to exercise your rights as mentioned above, please contact us at:

  • By email:
  • By mail:
    • Attn: Data Protection Officer
    • Helvetia Education Group SA | Place de la Gare 9 | 1260 Nyon | Switzerland

Changes to this Notice

We may update this Notice from time to time in response to changing legal, regulatory or operational requirements. We will notify you of any such changes, including when they will take effect, by updating the « Last revised » date above or as otherwise required by applicable law.

Last revised: 2nd October 2020

Data Subject Rights

General Data Protection Regulation (GDPR) provides individuals with a range of rights in relation to their personal data. This online request form enables you to submit a request to exercise your rights under GDPR.

Please complete the form below and send it back to and we will address your request.

    I am a (an):

    Select request type:

    [1] In this Notice, HEG or « we » means Helvetia Education Group SA and all its eventual subsidiaries and affiliates, each of which is referred to in this Notice as an HEG Affiliate.