UNC Privacy Policy

1. Controller

The controller responsible for data processing on this platform is:

2. Scope of this Policy

This Privacy Policy applies to all use of the UNC platform by students and clubs. It explains what data we collect, how we use it, and what rights you have under Swiss data protection law (DSG) and the EU General Data Protection Regulation (GDPR).

3. Data We Collect

We process the following categories of personal data:

4. Purposes of Processing

We process personal data for the following purposes:

• Providing and improving our platform and services.
• Authenticating users and securing access (including via university OAuth).
• Managing club memberships, events, and related activities.
• Communicating with users (transactional messages, notifications).
• Processing and documenting payments through third-party providers.
• Security, troubleshooting, error monitoring, and usage analytics.
• Processing user and application data, including profile information, event and membership activity, and application history, to operate, maintain, and continuously improve the platform, build and refine internal models used to surface relevant content, opportunities, and matches to users, develop new features, and provide comparative academic and career-related insights and benchmarking.
• Providing clubs with anonymized, aggregated statistics about event attendance, membership trends, and engagement to help them improve their offerings.

5. Service Providers and Data Transfers

We use external service providers to operate our platform. These include:

Some providers may process data outside Switzerland and the EU. In such cases, we ensure an adequate level of protection, for example through standard contractual clauses.

6. Retention

We store personal data only as long as necessary for the purposes set out above or as required by law. Some data may remain in backups or logs for a limited time. Clubs may have additional obligations to retain certain records. Usage logs and application metadata are stored in identifiable form for no longer than 24 months and are subsequently anonymized. Such anonymized data may be retained indefinitely for historical analysis, benchmarking, and the improvement of our internal algorithms and services.

7. Legal Basis

We process personal data on the following bases:

• Contract performance (Art. 6(1)(b) GDPR / Art. 31 DSG)
• Legitimate interests in providing and improving our services (Art. 6(1)(f) GDPR)
• Compliance with legal obligations (Art. 6(1)(c) GDPR)
• Consent, where required (Art. 6(1)(a) GDPR)

8. Rights of Users

Under GDPR and DSG, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing based on legitimate interests, including the use of your data for internal model development. You may object at any time by contacting [email protected]. Objection will not affect your ability to use the platform.
• Request data portability
• Withdraw consent at any time

To exercise these rights, contact us at [email protected].

9. Security

We implement technical and organizational measures to protect data against loss, misuse, and unauthorized access. No system is completely secure, but we continuously update our measures in line with industry standards.

10. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes in an appropriate manner. For material changes to how we process your data, we will seek your active reacceptance upon next login. If you do not object to other changes within 30 days of notification, the updated policy will apply.