Ikea Foundation Switzerland Privacy Policy, including information on the use of AI (as of 11 November 2026)

 

The Ikea Foundation Switzerland respects your privacy.

Data security and the protection of your personal details (hereinafter also referred to as «personal data») are important to the Ikea Foundation Switzerland (hereinafter also referred to as «we» or «us»). This Privacy Policy explains how we collect data, what information about you we process, what we need these data for, and how you can object to data processing. Where necessary, we may also notify you about additional processing activity not mentioned in this Privacy Policy.

 

Personal data are information that relates to specific or identifiable people, i.e. data that enable conclusions to be drawn about someone’s identity based either solely on these data or in conjunction with other relevant data. «Processing» refers to any handling of personal data, e.g. the collection, storage, use, modification, publication or deletion of such information.

 

If you send or notify us about information about other people, such as members of your family, colleagues, etc., we assume that you are authorised to do so and that these data are correct. Sending data about third parties constitutes your tacit confirmation thereof. Please also ensure that these third parties are informed about this Privacy Policy.

 

We only collect, process and store personal data (including IP addresses) in accordance with the legal regulations, namely the Swiss Federal Act on Data Protection («FADP»). Other legislation may also apply on a case-by-case basis. This Privacy Policy applies to our website, our AI-powered web application, and the other interactions and services described below.

 

 

What personal data do we collect?

Firstly, we collect personal data via the application form that you complete in conjunction with your application to us and therefore our relationship with you. The data collected in this way primarily include information such as your contact details, for instance, your name, phone number, postal and e-mail address, especially in relation to funding applications (e.g. your age, qualifications, bank details, etc.). We also process personal data if we are in contact with you aside from processing your application. And finally, we process personal data if we commission surveys in which you participate, if we organise events to which we invite you (e.g. your name, gender and age) or in connection with newsletters that we send out.

 

Please note that photographs of individuals uploaded by you will be transmitted to the hosting provider we use. To the extent contractually possible, any use of these photographs for purposes other than hosting has been excluded. By uploading photographs, you consent to their transmission and, where third parties are depicted, confirm that you have obtained their consent.

 

 

 

What happens when someone uses our web pages?

In general, you can use our web pages without providing any information about yourself. Our servers temporarily record all access to our web pages in a log file. The following technical data are recorded as part of this and then stored until they are automatically deleted after no more than six months:

 

  • The IP address of the requesting computer
  • The date and time of the access
  • The web page from which the page was accessed or the search term used
  • The name and URL of the file accessed
  • The searches conducted
  • Your computer’s operating system (provided by the user agent)
  • The browser you are using (provided by the user agent)
  • The device type if you are accessing the page on a mobile phone
  • The transfer protocol used

 

This data are collected and processed for the purpose of ensuring system security and stability, for fault and performance analysis and for internal statistical purposes. They enable us to optimise our online content. The IP address is also used to preconfigure the language of the web page.

 

Last, but not least, we set cookies when you visit our web pages and also use applications and tools based on the use of cookies. Cookies are small text files that are stored on your computer when you visit our website. If you access the site again in the future, your browser resends the content of the cookies to us to enable our systems to recognise your device. Reading cookies enables us to set up our website optimally for you and facilitate your use thereof.

 

When you visit our web pages, you are notified that our site sets these cookies and that you consent to this if you use the site.

 

Should you decide not to permit the use of cookies, you can set your browser to deactivate and delete all cookies at any time. Information about this can be found in the help section of your browser. However, if you deactivate cookies, some of the functions on our web pages may no longer be available. If you use another browser or a different device, you must deactivate and delete cookies again.

 

We require statistical information about the use of our online content (especially the website and newsletters) in order to make them more user friendly and measure our reach. We use web analysis tools for this, in particular Google Analytics. The user profiles created with the aid of analysis cookies are not combined with personal data. The tools either shorten user IP addresses immediately after collection or do not use them at all.

 

We also receive the following information in addition to the aforementioned data (see list above):

 

  • The path that a visitor used to navigate to our web page
  • The time spent on the web page or sub-page
  • The sub-page visited after leaving the web page
  • The country, region or town/city from which the page is accessed
  • The device (type, version, colour depth, resolution, width and height of the browser window)
  • Whether this is a first-time or repeat visit

 

This information is used to analyse the use of the web pages. You can change your preferences for analytics and tracking technologies whenever you visit our website. To do so, click on «Change Settings» in the cookie banner instead of «Accept All». If you would like to deactivate Google Analytics, you can find the relevant browser add-on at the following address: http://tools.google.com/dlpage/gaoptout?hl=en. As described in the previous section, you can prevent any creation of user profiles by deactivating the use of cookies in general.

 

Our web site contains a link to Instagram. This link can be recognised by the use of the provider’s logo/name. Clicking on the link opens the corresponding social media site, to which this Privacy Policy does not apply. Details of the provisions that apply there can be found in the relevant privacy policies on the provider’s web site.

 

No personal information is transferred to the provider before the link or plug-in is accessed. Loading the linked page also forms the basis for data processing by the relevant provider. We neither have any influence over the data processing procedures there, nor are we aware of the full scope of data collection, the purpose of data processing or how long data are stored. In addition, we do not have any information about the deletion of data by plug-in providers.

 

 

Use of our AI-powered web application (submission and evaluation of funding applications)

Funding applications are submitted through an AI-powered web application. Clicking on the link on our website (https://applications.ikea-stiftung.ch) opens the application. It operates on a separate infrastructure from our website (https://ikea-stiftung.ch/). When you access the application, technically necessary data is processed, in particular your IP address, the time of access and browser information. This data is used to establish the connection, protect the application against attacks and resolve technical errors. We use technically necessary cookies for authentication. Our web application does not use any tracking, analytics or monitoring tools, nor do we use analytics or advertising cookies.

 

We process the information provided in the application form and the uploaded dossiers, including, for example, contact details (such as email addresses and telephone numbers), dates of birth, information about the proposed project, budgets, supporting documents and information about third parties mentioned in the submitted information and documents (name, role and contact details). Every uploaded file is scanned for malware before being stored. No data is processed during this scan. We send emails to the address provided for authentication and to acknowledge receipt of applications. Applications may contain sensitive personal data. Please only provide such information if it is necessary for the assessment of your application. We process this data to review and assess your application, communicate with you and document our decision.

 

To support our administrative office, the application uses a large language model provided by Infomaniak, a Swiss cloud service provider, to generate draft application summaries, overviews and correspondence. Only the answers you enter in the online application form are transmitted for this purpose. Email addresses, telephone numbers and dates of birth are removed before transmission. The names of applicants and reference persons are replaced with placeholders and only reinserted within the application. This applies to the designated form fields; names or contact details entered in free-text fields may be transmitted. PDF dossiers and other files uploaded by you are not forwarded to Infomaniak. Under its contractual obligations, Infomaniak does not use the transmitted data to train its AI models.

 

The drafts generated by the AI serve solely as working aids. They are reviewed and, where necessary, revised by our staff before being used. Every application is read in full by a member of our staff and/or members of the Foundation Board. Funding decisions are made by the Foundation Board. No automated individual decision-making takes place within the meaning of Article 21 of the Swiss Federal Act on Data Protection (FADP).

 

Further information on recipients, countries in which data is processed and applicable safeguards can be found in the section on the disclosure of personal data («Do we disclose your personal data to third parties?»). The retention of submitted information, documents, responses and log data is governed by the periods specified in the section on data retention («How long do we process your personal data?»).

 

 

Newsletter

You can subscribe to a newsletter within the framework of our online content. If, at a later date, you decide that you no longer wish to receive the newsletter, you may cancel your subscription at any time by withdrawing your consent with effect in the future. In the case of e-mail newsletters, consent is withdrawn using a link printed in the newsletter. Alternatively, you can contact us using the details in the Contact section.

 

 

For what purpose do we process your personal data?

We need the information in the applications that you send us so that we can process your application. This also applies to the personal data that you subsequently provide us with or which are included in any communication between us (including for managing the contact). The information that you give us within the framework of surveys or in the run-up to events is required to enable us to conduct surveys or run events, process them or improve our offers.

 

Where we use AI in the processing of funding applications, it serves, as mentioned above, to generate draft application summaries and correspondence. Details of the data used for this purpose, the service providers involved and the human review procedures can be found in the section on our AI-powered web application («Use of our AI-powered web application (submission and evaluation of funding applications)») and in the following section («Do we disclose your personal data to third parties?»).

 

Do we pass on your personal data?

Within the framework of our business activities and the processing of data in accordance with this Privacy Policy, where legally permissible and necessary, we may pass data on to trustworthy third parties (hereinafter referred to as «third-party recipients») who then process your data on our behalf. In particular, these may be our service partners (e.g. IT service providers for our website and AI-powered web application, third parties involved in conducting or organising surveys and events, and providers of support services). A service partner may also be involved under certain circumstances when you send us an application (including all the data contained therein), so that we can process your application and forward it within the Ikea Foundation Switzerland.

 

Such third-party recipients may be located in Switzerland or abroad. For example, this may apply to the providers of certain IT tools in the United States who simplify the sending of newsletters, invitations or surveys. Some of the service providers we use to operate our AI-powered web application are also based in the USA (Render, Cloudflare, Resend). Funding applications and documents are stored and reviewed in Frankfurt (Germany), while data backups are stored in Switzerland (Infomaniak). System notifications (emails) are sent via Ireland. Cloudflare routes data traffic through its global network, which means that connection data, such as IP addresses, may be processed worldwide, including in countries that do not provide an adequate level of data protection. AI processing by Infomaniak takes place in Switzerland.

 

The USA is considered a country providing an adequate level of data protection for companies certified under the Swiss–U.S. Data Privacy Framework. This applies to Google, Render and Cloudflare. For service providers that are not certified (e.g. Resend), we safeguard data transfers through the European Commission’s Standard Contractual Clauses, recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), with the necessary adaptations for Switzerland. These safeguards also require service providers to impose equivalent data protection obligations on their subprocessors in other countries. Germany and Ireland provide an adequate level of data protection.

 

 

For how long do we process your personal data?

We process your data for as long as required for the purpose of processing, for the legal retention periods and for our legitimate interests in processing for documentation or proof or as required on technical grounds (e.g. if, due to statutory retention periods, we are obliged to store certain documents, such as contracts, application forms, requests, project documentation, minutes of meetings and invoices, for a period of ten years). Unless we are prevented from doing so due to legal or contractual obligations, we delete or anonymise your data within the framework of our regular procedures at the end of the storage or processing period.

 

The following retention periods and criteria apply:

  • Approved funding applications and related documents: 10 years after completion of the funded project.
  • Rejected or withdrawn applications: Immediately.
  • Access logs of the AI-powered web application hosted by Render: 14 days.
  • Data backups stored with Infomaniak: 30 days.
  • Requests to Infomaniak: Data transmitted to Infomaniak’s AI is temporarily stored only for the duration of the respective request and is not retained thereafter. This excludes data required for billing and technical operation.
  • Email communication via cyon: Incoming and outgoing emails are stored on cyon’s servers in Switzerland for as long as they remain in our email accounts. cyon creates daily backups, which are retained for a maximum of 14 days. Technical delivery and connection logs are temporarily stored for operational purposes and troubleshooting.
  • Access logs of our website (https://ikea-stiftung.ch/): Our hosting provider cyon stores these logs for a maximum of 24 hours by default, after which they are deleted. Website statistics generated from these logs may be retained for longer.
  • Data backups are generally overwritten after 30 days. Any remaining backup data is retained solely for recovery purposes, with restricted access.

 

You may discard draft applications at any time. The draft and any uploaded files will then be deleted from the server.

 

How do we protect your personal data?

We take appropriate technical and organisational security measures to preserve the confidentiality, integrity and availability of your data, protect them against unauthorised or unlawful processing, and to counter the risk of loss, unintentional modification, unwanted disclosure and unauthorised access.

 

 

What rights do you have in relation to your personal data?

Within the context of the applicable data protection legislation and where envisaged therein, you have the right to information, rectification and deletion, the right to restrict data processing, and object to data processing by us and to the release of certain data for the purpose of transmission to another body (known as «data portability»). You also have the right to withdraw consent if our processing is based on your consent.

 

When exercising your rights, please note that we reserve the right to assert the legally envisaged restrictions ourselves, for instance if we are obliged to store or process certain data, have an overriding interest in this (insofar as we are permitted to do so) or require it to assert our rights. Should you incur any charges, we will notify you of this in advance. Please note that exercising these rights may conflict with contractual agreements and may have consequences, e.g. premature termination of contract or costs. In this case, we will notify you thereof in advance if this has not already been agreed contractually.

 

Exercising such rights generally requires you to provide clear proof of identity (e.g. a copy of your ID card if your identity is not clear or cannot otherwise be verified). If you wish to assert your rights, you can also contact us via the address shown in «contact».

 

All data subjects also have the right to enforce their rights judicially or complain to the responsible data protection authority. In Switzerland, the responsible data protection authority is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

 

 

Data security

We use suitable technical and organisational security measures to protect personal data stored by us against tampering, partial or complete loss and unauthorised access by third parties. Our security measures are constantly improved in line with technological advances.

 

 

Amendments to this Privacy Policy

We reserve the right to change or add to this Privacy Policy at any time as we see fit and in line with the data protection legislation. Please consult this Policy at regular intervals.

 

 

Contact

Should you have any questions about your rights in relation to your personal data or any other related questions, please contact us at the following address:

 

Ikea Foundation Switzerland
Raphaël Rossel
Obere Zäune 12
CH-8001 Zurich
info@ikea-stiftung.ch

 

 

Cookie Settings