Controller
Responsible for processing your personal data on this website and in the portal is:
Wolleraustrasse 9, 8807 Freienbach SZ, Switzerland
Director: Dr. oec. Eva Otzen-Wehmeyer
CH-550.0.128.521-0
info@i-nfbf.ch
For questions about data protection or to exercise your rights, write to the address shown above.
What data we process
Depending on how you contact us, we process different categories of personal data:
When you write to us by email or through a form, we process your name, email address, message, answer about how you heard about the institute and, where present, a campaign tag and the page from which the form was submitted.
When you enrol in a course, we process the information needed for that, such as name, address, profession, prior training and billing details.
For the portal, we create an account with your email address. The password is stored as a secure hash, not in plain text. Technical authentication logs help us protect the account.
When you submit an assignment or case file, we process the filename, content, submission time and association with your account. These files may contain sensitive health data and are restricted to authorised portal users for the training purpose.
We keep cohort membership and training status separately from the portal account. Practice details appear in the public I-NFBF graduate directory only after Diploma graduation is confirmed and publication consent is documented. They can be corrected or removed on request.
When the website is accessed, technical information is generated, such as the IP address, the time and the page requested. It serves secure operation.
Purposes and legal bases
We process personal data to answer enquiries, administer enrolment and training, operate the portal securely and meet legal duties such as accounting. Processing is subject to the revised Swiss Federal Act on Data Protection. Where the GDPR applies, the relevant legal bases may include performance of a contract, consent, legitimate interests and legal obligations, depending on the purpose.
Service providers we use
We use the services listed below to operate the website and portal. Depending on the service and legal relationship, a provider may process data on our behalf or for its own technically necessary operations.
| Service | Purpose | Provider and location |
|---|---|---|
| Cloudflare | Hosting and delivery of the website (CDN) | Cloudflare, Inc., USA |
| Supabase | Portal database and login (authentication) | Supabase, Inc.; data centre in the EU (Ireland, eu-west-1) |
| Cloudflare R2 | Protected storage of course materials, assignments and case files | Cloudflare, Inc., USA |
| Vimeo | Delivery of the embedded lecture videos | Vimeo, Inc., USA |
| Resend | Transactional email, including confirmations and system messages | Plus Five Five, Inc. (Resend); account data, metadata and logs in the USA |
| OpenStreetMap | Map display in the public I-NFBF graduate directory | OpenStreetMap Foundation, United Kingdom |
| Analytics (Google Analytics 4) and advert measurement (Google Ads), only with your consent | Google Ireland Limited, Ireland; transfer to the USA possible |
Some providers may process data outside Switzerland, including in the European Union and the USA. Where required, an adequacy decision, recognised contractual safeguards or another lawful transfer mechanism may apply.
Teaching materials in the portal are confidential
Course documents and recordings are intended only for enrolled participants and must not be passed on or published. Submitted assignments and case files, which may contain sensitive health data, are accessible only to authorised portal users for the training purpose. Access is tied to your personal account; keep your login details confidential.
Analytics and cookies
This site uses Google Analytics 4 and Google Ads to measure how it is used and which advert or post led to an enquiry. These services take effect only after you agree in the cookie banner: without your agreement no analytics or advertising cookie is set, no identifier is stored, and Google receives only a signal without an identifier, which allows no recognition. Google Analytics 4 uses the IP address for approximate location and does not store it. Your choice is kept in the local storage of your browser and can be changed at any time through the Cookies link in the footer. The portal also keeps the login in local storage so that the session can remain active; this is technically necessary and is not used for tracking. We do not sell personal data.
| Name | Purpose | Duration |
|---|---|---|
| inbf_consent_v1 | Stores your cookie choice so we do not ask again. | Browser local storage, until you clear it |
| _ga, _ga_* | Google Analytics: distinguishes visitors without identifying them. | 2 years |
| _gcl_au | Google Ads: records which advert led to an enquiry. | 90 days |
Retention
We keep personal data only for as long as required for the stated purpose or an applicable legal duty. Accounting records and their supporting documents are generally retained for ten years. We delete or anonymise portal accounts, assignments and associated files when they are no longer needed, subject to any applicable retention duty. Contact enquiries are retained only as long as needed to handle the request or related legal claims.
Security
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse. Access to the portal is password-protected and transmission is encrypted.
Changes to this policy
We may adapt this privacy policy if our offering or the legal requirements change. The version published on this page applies.
Your rights
Within the applicable law, you have the following rights towards the institute:
- Access to the data we process about you
- Rectification of inaccurate or incomplete data
- Erasure of data we no longer need to keep
- Restriction of certain processing and withdrawal of consent with effect for the future, where applicable
To exercise one of these rights, write to info@i-nfbf.ch. If you disagree with our processing, you can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). Where your processing falls under the GDPR, you also have the right to lodge a complaint with the competent European supervisory authority.