Privacy Policy

This policy explains what personal data Swiss Private Schools collects, why we collect it, who we share it with, and the choices you have. It is written to be read, not to be survived.

FADP & GDPROur frameworkAES-256At restNoAd tracking

Last updated: 1 September 2026

Who We Are

The controller

Swiss Private Schools is an online directory and admissions platform for private schools in Switzerland. It is run as a Swiss sole proprietorship by Lucien Pochon, Avenue de Maria-Belgia 1, 1006 Lausanne, Switzerland, who is the controller of the personal data described here — meaning the person who decides why and how it is processed, and who answers for it. Where this policy says “we”, “us” or “the platform”, it means that business. The one exception is set out in the section on schools below.

How to reach us about data protection

Write to privacy@swissprivate-schools.ch, or by post to the address above marked “Data Protection”. We answer data-protection enquiries ourselves; we have not appointed a formal Data Protection Officer under Article 37 GDPR, and we do not claim to have one. If that assessment changes, we will name the person here.

If you are in the European Economic Area

We are established in Switzerland and have no office in the EEA. That does not narrow your rights: where the GDPR applies to what we do, we apply it, and you can raise anything in this policy with us directly at privacy@swissprivate-schools.ch. You keep the right to complain to your own national supervisory authority as well as to the Swiss authority named at the end.

What this policy covers

This policy covers www.swissprivate-schools.ch, the family account area, the school dashboard, and the emails we send. It does not cover the websites of the schools listed in our directory, nor what a school does with information after we pass it to them — each school is an independent controller of the data it receives, under its own privacy policy.

What We Collect

Information families give us

When you enquire about a school, book a visit, save a shortlist, request a call, register for an open day, or create an account, we collect what you enter: your name, email address, and — where you provide them — your telephone number, country, preferred language, the schools and programmes you are interested in, your intended start date, an indicative budget range, and any message you write. Some of these fields are optional; the form tells you which are not.

Information about a child

If you are enquiring or applying on behalf of a child, we collect the information you choose to give about them: their name or first name, year of birth, current school year, languages spoken and desired, boarding preference, and any interests or notes you add. In an admission application, the questions themselves are set by the school you are applying to, so the exact fields vary. We do not knowingly collect information directly from a child; these forms are intended to be completed by a parent, guardian, or an adult applicant.

Sensitive information

Some fields can attract information about health — a free-text “special educational needs” field on a student profile, and any medical, dietary or support questions a school adds to its own application form, together with documents you upload. Under the GDPR this is special-category data, and under the Swiss FADP it is particularly sensitive personal data. We do not require it: provide it only if you want the school to have it. Where you do, we rely on your explicit consent, recorded at the point of submission.

Information school staff give us

For school users we collect account details (name, work email address, role, telephone number where given), the content you publish about your school, your team and invitation records, your booking and admissions configuration, your billing and VAT details, and — for schools that take application fees through the platform — the identifiers your payment provider needs. Passwords are never visible to us; they are stored as salted hashes by our authentication provider.

Information collected automatically

When you visit a school profile we record the page viewed, the referring page, the date and time, an approximate country, region and city derived from your connection, your browser's user-agent string, and a device category. Your IP address is used in the moment — to derive that approximate location, to apply rate limits, and as an input to a daily-rotating one-way hash — and is not stored. See “Measurement and cookies” below for the identifiers involved and how to switch them off.

Information from public sources

Our directory includes schools that have never registered with us. Their profiles are compiled from publicly available sources — principally the school's own website and public registers — and may include the name and job title of a head of school or other senior staff member. If you are named on a profile and want that changed or removed, write to privacy@swissprivate-schools.ch; we will act on it, and you do not need to give a reason.

Why We Are Allowed To

To do what you asked

Sending your enquiry to a school, confirming a visit, running an admission application, operating your account, and taking payment are all necessary to perform a contract with you or to take steps at your request before entering into one (Article 6(1)(b) GDPR; Article 31(2)(a) FADP).

With your consent

We rely on consent for our newsletter and other marketing email, for cookies and similar technologies that are not strictly necessary, and for any sensitive information you choose to share. You can withdraw consent at any time — this does not affect processing that already took place. Every marketing email carries a one-click unsubscribe link.

Our legitimate interests

We rely on legitimate interests to keep the platform secure and free from abuse, to measure how our own pages perform, to give schools aggregate statistics about their listing, to compile and publish factual directory profiles of Swiss private schools, and to improve the service. We have weighed each of these against your interests and rights; you can object at any time using the contact details below, and we will stop unless we have compelling grounds not to.

Legal obligations

Accounting and tax law requires us to keep invoices and related business records for ten years under Article 958f of the Swiss Code of Obligations. We may also process data to answer a lawful request from a court or authority.

Explicit consent for sensitive information

Where you provide health-related or other particularly sensitive information, we rely on your explicit consent under Article 9(2)(a) GDPR and Article 6(7) FADP. Withdrawing it means we can no longer pass that information to a school, which may prevent an application from being assessed.

How We Use It

Connecting you with schools

We use what you tell us to route your enquiry to the school you selected, to show you schools and programmes that fit what you described, and to keep a record in your account of what you have sent and to whom.

Bookings and admissions

We use your details to schedule visits, open days and interviews, to send reminders and calendar invitations, to carry an application through the school's form, to collect an application fee where the school charges one, and to keep both sides informed of its progress.

Communication

We send transactional messages you cannot opt out of while you hold an account or an active enquiry — confirmations, security alerts, and notices about changes to this policy or our terms. Newsletters and other marketing go only to people who asked for them.

Measurement and improvement

We count page views and link clicks on school profiles so that schools can see how their listing performs and so we can find broken pages and slow ones. These are reported as aggregate statistics. We do not build advertising profiles, we run no advertising network tags, and we do not combine this data with anything from another company.

Security, fraud prevention and compliance

We use technical data to rate-limit abusive traffic, to detect fraudulent payments, to keep an audit trail of administrative actions on accounts, and to meet our legal obligations.

Who We Share It With

The school you contact

When you enquire, book a visit, register for an open day or submit an application, we pass the relevant information to that school so it can respond. From that point the school is an independent controller and handles your data under its own privacy policy — including how long it keeps it. We share your details only with the schools you chose. We never send them to a school you did not select, and we do not operate a shared lead pool.

Our service providers

We use a small set of specialist providers, and share with each only what it needs: Supabase (database, accounts and file storage, hosted in the European Union); Vercel (application hosting, and — only if you accept non-essential cookies — its first-party page-performance analytics); Stripe (payments and invoicing); Resend (email delivery); Twilio (SMS verification, only if you choose to verify a number); DeepL (machine translation of text schools write about themselves); Google (address suggestions, embedded maps, and Google sign-in — the last two only if you accept non-essential cookies); and Sentry (error monitoring, so we can diagnose faults). Each acts on our documented instructions under a written data-processing agreement. No artificial-intelligence provider receives your data: we do not send applications, enquiries or messages to any language model.

International transfers

Our database, file storage and backups are held in the European Union. Some providers above are established in the United States and receive data there: Stripe, Google, Twilio, Resend, Vercel and Sentry. Those transfers are covered by the European Commission's Standard Contractual Clauses together with the Swiss addendum recognised by the FDPIC, and, where the provider is certified, by the EU–US and Swiss–US Data Privacy Frameworks. Write to us and we will send you the safeguards that apply to any specific provider.

Legal disclosures and business transfers

We disclose personal data where the law requires it or in response to a valid order from a court or competent authority, and we will tell you unless we are legally barred from doing so. If the business is ever sold or merged, personal data may transfer with it; you will be told before it happens and this policy will continue to apply until you are given a new one.

We do not sell your data

We do not sell personal data, we do not rent or trade contact lists, and we do not share your data with advertising networks or data brokers. Schools pay us for a subscription; they do not pay us for personal data, and no fee a school pays changes who receives your details.

Ranking, Matching and AI

How schools are ordered — and where money comes in

Default listing order is set by a score recalculated daily from the completeness of a school's profile, how quickly it answers enquiries, how recently it has been updated, third-party credibility signals such as accreditations, and engagement on its listing. That score is then multiplied by a factor tied to the school's subscription: 1.00 on the free listing, 1.05 on Pro, 1.25 on Premium and 1.35 on Enterprise. So a paid subscription does move a school up the default order. It never invents facts about a school, never changes filtered or explicitly sorted results, and never affects which schools receive your enquiry.

Matching and recommendations

Where you tell us what you are looking for, we score schools against those criteria to suggest ones that fit. This is a ranking aid, not a decision about you: it produces no legal or similarly significant effect, we take no automated decision about you within the meaning of Article 22 GDPR, and you can ignore it and browse or filter the full directory at any time.

Measurement and Cookies

Strictly necessary cookies

Some cookies are required for the site to work and are set without asking: your sign-in session, your record of the cookie choice itself, your language, which school dashboard you are working in, and a small number of interface preferences. Blocking them means you cannot sign in.

Audience measurement — on by default, off in one click

We set one first-party cookie, sps_vid, holding a random identifier and nothing else, so that a repeat visit is not counted twice. It lasts twelve months and is not readable by scripts. It is first-party, never combined with any other service, and used only for aggregate counts, which is why it does not require your prior consent — but you can turn it off under “Cookie preferences” in the footer, and we then delete it.

Non-essential cookies — only if you accept

Embedded Google Maps, Google sign-in and our host's page-performance measurement load only after you accept non-essential cookies. Decline and they are never requested, so those providers receive nothing from your visit.

Changing your mind

“Cookie preferences” in the footer reopens the choices at any time. Our full Cookie Policy lists every cookie we set, what it holds and how long it lasts.

How Long We Keep It

Your account and what you sent

We keep your account, your enquiries, your bookings and your applications for as long as your account is open, because they are the record of what you sent and to whom. We do not delete them on a fixed timetable: you can delete individual items or close your account at any time, and closing the account removes them. If you want us to set an expiry for you instead, ask and we will.

Closing your account

When you ask us to delete your account we schedule it thirty days out and email you to confirm. You can cancel within that window; after it, the account and the personal data attached to it are deleted. Records we are legally required to keep — chiefly invoices, for ten years under Swiss accounting law — survive deletion, and so does anything a school has already received, which is that school's to erase.

Technical and operational records

Measurement events are deleted after twenty-four months. Delivery records for emails we sent are kept for six months, API request logs and webhook payloads for three months, and per-attempt delivery logs and job-run records for one month. A photo a school deletes is removed from storage thirty days later. An address that hard-bounced is suppressed for ninety days so that mail can resume if the mailbox comes back; an unsubscribe or a spam complaint is honoured permanently.

Backups

Our database provider keeps encrypted backups on a rolling schedule. Deleted data can persist in a backup until it rotates out. Backups are only ever used to restore the service after a failure, never to bring back data someone asked us to delete.

How We Protect It

Technical measures

All traffic runs over TLS. Data is encrypted at rest by our infrastructure providers. Access to each school's data is enforced in the database itself by row-level security, so one school cannot read another's records even if application code is wrong. Sign-in supports two-factor authentication, which is mandatory for our own administrators. Sensitive operations are recorded in an audit log.

Access by our staff

We have no standing access to a school's dashboard. Where support requires it, an administrator must request access, a school owner must approve it, and the resulting session is time-limited and written to an audit log the school can read. Access to production systems is limited to the people who operate the platform.

Breaches, and your part

If a breach occurs that is likely to result in a risk to your rights, we will notify the competent authority within 72 hours and tell you directly where the risk is high. No online service can promise perfect security; keep your password to yourself, turn on two-factor authentication, and tell us at once if you think your account has been used by someone else.

Your Rights

Access and portability

You can ask what we hold about you and get a copy. If you have an account you do not have to ask: “Export my data” in your account settings returns a machine-readable file covering your profile, student profiles, enquiries, bookings, applications, school memberships, the emails we sent you, and your activity log.

Correction and deletion

You can correct anything inaccurate — most of it directly in your account — and ask us to delete your data. Where a school has already received your details, we will pass the request on, but the school decides on its own copy as an independent controller, so ask them too.

Objection and restriction

You can object to processing we base on legitimate interests, including profile-building of any kind, and you can ask us to restrict processing while a dispute about accuracy or lawfulness is resolved.

Withdrawing consent

Where we rely on consent you can withdraw it at any time: unsubscribe from any marketing email, change cookie preferences in the footer, or write to us. Withdrawal is as easy as giving consent was, and does not affect what was already lawfully done.

How to exercise them, and how to complain

Write to privacy@swissprivate-schools.ch. We answer within thirty days and will not charge you unless a request is manifestly excessive. If you are not satisfied you can complain to the Swiss Federal Data Protection and Information Commissioner, or — if you are in the EEA — to your national supervisory authority. We would rather you came to us first, but you are not obliged to.

Contact and Changes

Contact us

For anything in this policy, write to privacy@swissprivate-schools.ch or to Lucien Pochon, Swiss Private Schools, Avenue de Maria-Belgia 1, 1006 Lausanne, Switzerland, marked “Data Protection”.

Changes to this policy

We update this policy when what we do changes. The date at the top always reflects the current version. If a change materially affects your rights we will tell you by email or through the site before it takes effect, and where the law requires consent for the change, we will ask for it rather than assume it.

Swiss and European data protection law

We are subject to the Swiss Federal Act on Data Protection (FADP), and to the EU General Data Protection Regulation (GDPR) in respect of the families and school staff we serve in the European Economic Area. Where the two differ, we apply whichever gives you the stronger protection. Switzerland is recognised by the European Commission as offering an adequate level of protection, so data may move between Switzerland and the EEA without further safeguards.

The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), which publishes guidance for individuals at www.edoeb.admin.ch