Declaration of Consent

A.

between
University of St.Gallen
Dufourstrasse 50

CH-9000 St. Gallen

Institute «Executive School of Management, Technology and Law (ES-HSG)»

Program “Executive MBA”
Holzstrasse 15
CH-9010 St. Gallen

+41 71 224 27 02
emba@unisg.ch

and
you, in connection with the implementation of a “Proof of Concept (POC)” for an AI-based chat. The chat is embedded as an iframe in the program website (emba.unisg.ch). For the website itself, its privacy policy applies additionally: https://emba.unisg.ch/datenschutz. According to the information provided there, the program website is hosted by InterNetX GmbH, Johanna-Dachs-Str. 55, 93055 Regensburg, Germany (EU).

B.

I hereby grant my consent to data processing for the purposes specified under C.4. for the period specified under C.6. and, in this context, also give my consent to data transfer to third parties. In this context, I also give my express consent that my personal data may be transferred to a third country that does not have an equivalent level of data protection (FADP country list). I confirm that I am sufficiently informed in this regard, that I understand the risks associated with data transfer to such a third country, and that I knowingly accept them. I am also aware that entering sensitive personal data (e.g. health data, religious or political views) and data of third parties into the chat is prohibited. This declaration of consent has been read and understood. Consent is given electronically by clicking “Agree” in the chat window.

C.1. DPO/ Data Protection Contact Point

C.2. Legal Basis for Data Collection

St.Gallen Data Protection Act (DSG SG; sGS 142.1): Art. 4, Art. 5, Art. 11, Art. 16

In conjunction with:
Swiss Federal Act on Data Protection (FADP CH; SR 235.1): Art. 17 Para. 1 Lit. a
EU General Data Protection Regulation (GDPR): Art. 6, Art. 7, Art. 13

C.3. Type of Data Collection and Processing

Your data is collected exclusively electronically via the chat window, an iframe on the EMBA program website, and no data from other sources concerning your person is used. The following personal data is processed:

a.) Conversation Content
Text inputs in the chat as well as the generated responses. The inputs are transmitted to the AI service provider for response generation. In the technical operation logs, the wording of your inputs is not recorded, but only their length. During the pilot phase, conversation histories are additionally saved as pseudonymized conversation logs (transcripts) in order to evaluate the quality of the responses; assignment occurs exclusively via the pseudonymous session ID (see C.3.b), storage takes place in Germany (Hetzner), and deletion occurs after 30 days. An evaluation of these conversation logs by the AI service provider in the USA does not take place during the pilot phase. For semantic search across public program content, search queries are transmitted to the search service Weaviate (Frankfurt cluster, EU); profile data is not transmitted in this process.

Your data will be passed on to a data processor:
OpenRouter Inc., 169 Madison Avenue, New York, NY 10016, USA (AI service provider). There is no dedicated Data Processing Agreement (DPA); use during the pilot phase is based on the provider’s terms and conditions and your express consent. A DPA or Standard Contractual Clauses (SCC) will be concluded for production operation after the pilot phase.

Your data is thus accessible to the data processor as well as to HSG.

b.) Consultation Profile (session-related)
A pseudonymized session ID is processed, as well as your name if you provide it. Professional and management experience in years, industry/field of activity, interests, program under consideration, desired contact, and language are also processed.

Your data will be passed on to a data processor:
Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany (Hosting). Usage is based on the provider’s General Terms and Conditions (https://www.hetzner.com/de/rechtliches/agb) and a concluded DPA.

Your data is thus accessible to the data processor as well as to HSG.

c.) Technical Logs
System and error messages, timestamps, response times – without the wording of your inputs. IP addresses are processed technically to establish connection; access logging is not activated on the web server, and IP addresses are not saved in the application logs. External monitoring or tracing services (e.g., LangSmith) are deactivated in the production environment. Hosting: Hetzner Online GmbH (see C.3.b).

d.) Usage Statistics (pseudonymous)
Metadata such as session ID, result type, program allocation, error markers, and response times are processed per chat post, but no conversation content (only the character count of the input). Hosting: Hetzner Online GmbH (see C.3.b).

e.) Upon Appointment Booking
If a consultation appointment is booked via the chatbot, name and email address are requested. This information is used by the ES exclusively to conduct the consultation session and enters the regular office and communication infrastructure of the University of St.Gallen (email and calendar system, Microsoft 365). Any evaluation beyond this or merging with other data collected in the chat does not take place.

Your data will be passed on to a data processor if the booking module is actively loaded through your action:
Calendly LLC, 271 17th Street NW, Atlanta, GA 30363, USA (Appointment booking). Data processing takes place in accordance with Calendly’s Data Processing Addendum (part of the terms of use). Calendly is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework (DPF).

Your data is thus accessible to the data processor as well as to HSG.

Overview of Data Processors (DPA Status and Third-Country Transfer):

• OpenRouter Inc. (USA) — Usage C.3.a — no dedicated DPA (provider terms; DPA/SCC after pilot phase) — no DPF certificate; pilot phase: express consent; production operation: SCC required or switch to EU provider
• Weaviate B.V., Prinsengracht 769a, 1017 JZ Amsterdam, Netherlands — Usage C.3.a (search queries only); cluster in Frankfurt, Germany (EU) — usage based on provider terms; production operation: standard DPA is available and will be countersigned — third-country transfer not applicable (EU)
• Hetzner Online GmbH (Germany) — Usage C.3.a–d — usage based on provider terms; DPA concluded on this basis — third-country transfer not applicable
• Calendly LLC (USA) — Usage C.3.e — DPA is part of the terms of use — EU-U.S. and Swiss-U.S. DPF certified
• InterNetX GmbH, Johanna-Dachs-Str. 55, 93055 Regensburg, Germany (EU) — Hosting of the program website (outside the chat); the details in the privacy policy of the program website apply: https://emba.unisg.ch/datenschutz — third-country transfer not applicable (EU)

Where no dedicated data processing agreement yet exists for individual providers, usage during the pilot phase takes place on the basis of the respective provider terms and your express consent; corresponding contracts for production operation after the pilot phase are in progress.

C.4. Purpose of Data Processing

Your personal data is processed by the ES to provide information and advice on HSG programs (EMBA HSG, International EMBA HSG, emba X) based on the content entered in the chat and the derived details regarding your professional situation. Specifically, this includes:

• Answering your questions about the Executive MBA programs (study counseling)
• Tailoring responses and program recommendations to your professional situation
• Arranging a personal consultation appointment with the responsible program advisor, if desired

The purpose of data processing also includes ensuring the technical operation of the solution, error analysis, and evaluating response quality during the pilot phase.

Your data will not be used for advertising purposes, sold to third parties, or used to train AI models.

C.5. Location of Storage

Data storage takes place:

C.6. Duration of Storage

Your data will be retained by HSG as part of conducting the POC for as long as necessary to gain insights, and the personal reference of your data will be completely removed promptly at the end of the POC implementation through deletion or anonymization. In addition, early deletion routines apply:

C.7. Information on the Rights of Data Subjects

At any time during which personal data is processed, you have the right, without stating reasons, to:

• Right of access
• Right to rectification or correction
• Right to erasure of data
• Right to restriction of processing
• Right to data portability
• Right to revoke previously granted consent for processing

A revocation of granted consent, a request for erasure, or a request for restriction of processing will organizationally always be treated as a request for erasure and takes place promptly upon receipt of the request.

Please address your request in writing to: emba@unisg.ch

Specifying the approximate time of use is required, as HSG only knows the pseudonymous session ID. The original declaration of consent for prior agreement will also be deleted.

If rights are exercised in the aforementioned sense, consultation via the chatbot is not possible. Consultation via regular contact channels (email, phone, personal meeting) remains fully available to you without restriction.

Further exercise of data subject rights against third parties can be supported by the ES to the extent that this is objectively possible for it.

C.8. Right to Complain to Supervisory Authorities

You have the right to lodge a complaint with the supervisory authority:

Data Protection Competence Center Canton St.Gallen
Regierungsgebäude
9001 St. Gallen
+41 58 229 14 14
datenschutz@sg.ch

For persons residing in the EU, if the GDPR applies, there is additionally a right to lodge a complaint with the data protection supervisory authority of the state of residence or domicile.

C.9. Automated Decision-Making and Profiling

The ES does not carry out automated decision-making or profiling in the sense of behavioral prediction; in particular, the chatbot does not decide on admission or suitability of a person.

For consultation, a session-related profile is created, which specifically means that the AI language model derives non-binding program recommendations from your details:

Logic: Comparison of your stated work experience, language, and interests with published program characteristics

Scope: The recommendation exclusively influences the content of the chat responses; it has no effect outside the conversation

C.10. Cookies and Web Tracking

The chatbot itself does not use cookies for tracking or analytical purposes and does not use web analytics services (no Google Analytics or similar).

Exclusively a technically necessary session-related identifier is used to keep your conversation together during the session.

The booking service, according to point C.3.e, is loaded only after your active action and may set its own technically necessary cookies. The provider informs about this here: calendly.com/legal/privacy-notice

Regarding the website infrastructure on which the POC is conducted, the details regarding cookies and web tracking apply here: www.unisg.ch/de/datenschutz (English version: www.unisg.ch/en/data-protection-declaration)

C.11. Further Information

The execution of the POC takes place in the period of:

Start: 01.08.2026
End: 31.08.2026

Please note that responses are generated by an AI language model and may be incorrect or incomplete in individual cases. Only the official details of the University of St.Gallen or information provided by the program advisors are binding.