Privacy policy

Updated on September 14, 2026

This is a translation of the original statement in German. The translation is provided for information purposes only and has no legal bearing. Only the German document is legally binding.

Welcome to www.klicker.uzh.ch "KLICKERUZH", the Classroom Response System of the Teaching Center of the Institute of Finance (DF) at the University of Zurich (UZH).

In this statement we explain which user data is collected, processed and shared for which purpose, and which measures are taken to ensure the security of this data. All measures are in accordance with the applicable data protection regulations. This statement refers to details that are specific to "KLICKERUZH". You can find the data protection provisions of UZH at http://www.uzh.ch/de/privacy.html.

We also point out that you should read the "KLICKERUZH" Terms of Service, which set out the terms and agreement under which we provide "KLICKERUZH" and all associated services, and under which you may use these offerings.

1. Principles

All data is collected and processed only for the intended purpose and in accordance with the statutory requirements, and is under no circumstances used for purposes other than those intended. We strictly adhere to the following principles:

• We do not want to make money with your data. Under no circumstances will your user data be sold to third parties or used for advertising.
• We handle user data sparingly (Privacy by Design). We ensure that no unnecessary data is collected in order to protect the privacy of each user as effectively as possible.
• We store and process your data in Switzerland and the European Union. Our partners comply with Swiss and European data protection regulations and have accepted the data protection requirements of the University of Zurich.

2. Scope and purpose of the processing of personal data

We refer to our users as VISITORS, PARTICIPANTS, or ADMINISTRATORS. If you visit our website without registering (e.g., to participate anonymously in a survey), you are a VISITOR. If you register for an account (e.g., to use the KlickerUZH app or to take part in a gamified challenge), you are a PARTICIPANT. If you create content for your teaching yourself and/or conduct it with PARTICIPANTS, you are an ADMINISTRATOR.

Description	Designation
Users without an account who visit KLICKERUZH or participate in activities	VISITORS
Users with an account who visit KLICKERUZH or participate in activities	PARTICIPANTS
Users with an account who create and/or conduct activities with KLICKERUZH	ADMINISTRATORS

From VISITORS we generally collect and store as little data as possible. While data such as IP addresses is unavoidably collected during transfer, it is not stored as part of KLICKERUZH or further evaluated, but may, as explained in Section 13, become part of reach analyses in pseudonymized form. The interactions of VISITORS with activities in KLICKERUZH are recorded and stored only in aggregated (e.g., selection of an answer option in quizzes) and anonymized form (e.g., text entries in live Q&A) and are passed on in this form to the ADMINISTRATORS of the respective courses.

From PARTICIPANTS we collect and store, in addition to the data collected from VISITORS, the profile information of the participant account created (e.g., e-mail, pseudonym, password) as well as the data that arises from the interaction with courses (e.g., groups created) and completed activities (e.g., answers to questions asked) within KLICKERUZH and that is necessary to provide these activities. If PARTICIPANTS decide to take part in the optional leaderboard within a course, the points and achievements collected are additionally displayed in the public profile and on the leaderboard.

For the purpose of gamifying activities within a course, certain data collected and stored by VISITORS and PARTICIPANTS in the context of the available activities may be made accessible to VISITORS and PARTICIPANTS: the anonymized and/or aggregated answers of other VISITORS and PARTICIPANTS (e.g., as a histogram or word cloud); the pseudonyms and the points and achievements collected by other PARTICIPANTS and groups that also take part in the leaderboard of a course.

For the purpose of assessing activities and analyzing course progress, certain data collected and stored by PARTICIPANTS in the context of the available activities in their courses is made accessible to ADMINISTRATORS: individual profile information (e-mail and pseudonym, where provided) of PARTICIPANTS; information on the type, frequency and success of PARTICIPANTS' participation in the available activities; and the points collected (optionally) by PARTICIPANTS in the context of these activities and over the course of the course.

In the dedicated assessment mode, PARTICIPANTS' answer details (e.g., answer content, points achieved) are additionally made available to the ADMINISTRATORS for the purpose of assessment, in identifiable form (including e-mail address and matriculation number). Furthermore, for the purpose of legal safeguarding, detailed data on answer attempts and on the interaction with KlickerUZH during participation in activities in assessment mode is collected ("audit logs").

From ADMINISTRATORS we collect and store, in addition to the data collected from VISITORS, the profile information of the account created, as well as necessary usage data such as the content of all courses, questions and related activities created. ADMINISTRATORS may, if they wish, share the content they have created with other ADMINISTRATORS via the functionalities available within KLICKERUZH, or authorize other ADMINISTRATORS to access their account.

PARTICIPANTS and ADMINISTRATORS may at any time request access to their data or request the deletion of the data that goes beyond the data collected from VISITORS, or exercise this option directly via the functionalities provided within KLICKERUZH.

The data collected through the use of KLICKERUZH may be evaluated by researchers and teachers in de-identified form and exclusively in the service of science and teaching within the framework of research and teaching projects of the University of Zurich. ADMINISTRATORS may use the data made available to them within the framework of KLICKERUZH only for research and teaching purposes and may further evaluate it only in de-identified form. PARTICIPANTS may object to the use of their data for research at any time in their profile settings.

Data elements collected

Data element	Who	Purpose	Note
IP addresses	All users	Data transfer	Unavoidable for data transfer; used and stored in anonymized form only for reach analysis
Selection of an answer option or entries in activities (incl. chatbots)	VISITORS and PARTICIPANTS	Storing the interactions	Stored for the lifetime of the participant account
Profile information of the participant account (e-mail, pseudonym, password), of the administrator account (e-mail, password), or of the group (pseudonym)	PARTICIPANTS and ADMINISTRATORS	Identification and sending of e-mail messages	Stored for the lifetime of the participant account
Matriculation number	PARTICIPANTS in assessment mode	Identification	Only when participating via the assessment application (assessment.klicker.uzh.ch)
Points and achievements collected in the context of all activities	PARTICIPANTS	Display in the leaderboard and awarding of awards	Shown to ADMINISTRATORS. Shown to other PARTICIPANTS only as long as they take part in the leaderboard.
Type, frequency and success of participation in available activities	PARTICIPANTS	Improvement of teaching and research purposes	Shown to ADMINISTRATORS. Stored for the lifetime of the participant account. Only collected if Learning Analytics is activated by the PARTICIPANTS.
Content of all courses, questions and related activities created	ADMINISTRATORS	Use of KLICKERUZH with PARTICIPANTS	May be displayed to PARTICIPANTS as part of the publication of activities

Handling of special personal data

All users are prohibited from sharing special personal data in the context of using KLICKERUZH or from asking PARTICIPANTS for such data. Particularly sensitive personal data is information in respect of which, because of its significance, the way it is processed or the possibility of linking it with other information, there is a particular risk of an infringement of personal rights. This includes the following categories of information:

1. data on religious, ideological, political or trade union views or activities
2. data on health, the intimate sphere and ethnic origin
3. genetic data
4. biometric data
5. data on administrative or criminal prosecutions and sanctions
6. data on social assistance measures

3. Contact addresses

If you have any questions about data protection, would like to request information or request the deletion of your data, please contact:

Responsibility for the processing of personal data:

University of Zurich, Teaching Center of the Institute of Finance
Institute of Finance
Teaching Center, KlickerUZH
Plattenstrasse 14
8032 Zurich
klicker@df.uzh.ch

We will point out if, in an individual case, other controllers are responsible for the processing of personal data.

4. Legal bases

We process personal data based on the legal bases applicable to UZH, in particular the University Act, and in accordance with the applicable data protection law, in particular the Act on Information and Data Protection of the Canton of Zurich (IDG).

5. Personal data abroad

We generally process personal data in Switzerland and the European Union. However, we may also disclose or export personal data to other countries, in particular in order to process it or have it processed there, provided that the law there ensures an adequate level of data protection.

As part of the operation of KlickerUZH, data is processed and stored in Switzerland (including the University of Zurich, SWITCH, Microsoft Azure) and in the European Union (Microsoft Azure).

6. Rights of data subjects

We grant data subjects all rights under applicable data protection law. In particular, data subjects have the following rights:

• Information: Data subjects may request information as to whether we process personal data about them and, if so, which personal data is involved. Data subjects also receive the information required to assert their data protection rights and to ensure transparency. This includes the personal data processed as such, but also, among other things, information on the purpose of processing, the duration of storage, any disclosure or export of data to other countries and the origin of the personal data.
• Rectification and restriction: Data subjects may have inaccurate personal data rectified, incomplete data completed and the processing of their data restricted.

We may postpone, restrict or refuse the exercise of data subjects' rights within the legally permissible framework. We may inform data subjects of any requirements that must be met in order to exercise their rights under data protection law. For example, we may refuse to provide information in whole or in part with reference to private or public confidentiality interests. We may refuse to delete personal data in whole or in part with reference to statutory retention obligations.

We may exceptionally charge costs for the exercise of rights. We will inform data subjects in advance of any costs.

We are obliged to identify data subjects who request information or assert other rights using appropriate measures. Data subjects are obliged to cooperate.

The competent supervisory authority is the Data Protection Commissioner of the Canton of Zurich.

7. Data security

We take appropriate technical and organizational measures to ensure data security appropriate to the respective risk. However, we cannot guarantee absolute data security.

Our website is accessed using transport encryption (SSL / TLS, in particular the Hypertext Transfer Protocol Secure, abbreviated HTTPS). Most browsers indicate transport encryption with a padlock in the address bar.

8. Use of the website

8.1 Cookies

We may use cookies. Cookies – both our own cookies (first-party cookies) and cookies from third parties whose services we use (third-party cookies) – are data that is stored in the browser. Such stored data need not be limited to traditional cookies in text form.

Cookies can be stored in the browser temporarily as "session cookies" or for a certain period as so-called permanent cookies. "Session cookies" are deleted automatically when the browser is closed. Permanent cookies have a specific storage duration. In particular, cookies make it possible to recognize a browser the next time it visits our website and thus, for example, to measure the reach of our website. However, permanent cookies may also be used for online marketing, for example.

Cookies can be fully or partially deactivated and deleted at any time in the browser settings. Without cookies, our website may no longer be available in full.

8.2 Server log files

For every access to our website, we may record the following information, provided that it is transmitted to our server infrastructure by your browser or can be determined by our web server: date and time including time zone, Internet Protocol (IP) address, access status (HTTP status code), operating system including user interface and version, browser including language and version, individual subpage of our website accessed including the amount of data transferred, website last accessed in the same browser window (referer or referrer).

We store such information, which may also constitute personal data, in server log files. The information is necessary in order to provide our website permanently, in a user-friendly and reliable manner and to ensure data security and thus in particular the protection of personal data – also by third parties or with the help of third parties.

9. Consent and objection

9.1 Collection of research data

We provide ADMINISTRATORS with a research and teaching data export. This export contains de-identified data of VISITORS and PARTICIPANTS from the courses of the ADMINISTRATORS.

PARTICIPANTS may object to the use of their data for research at any time in their profile settings. If consent is withdrawn, the data will not be included in future research data exports.

9.2 Learning Analytics

As part of Learning Analytics, we provide PARTICIPANTS with an individual insight into their personal learning behavior and individual learning success. ADMINISTRATORS additionally receive a de-identified and aggregated insight into this same information for PARTICIPANTS in their courses.

The use of Learning Analytics is voluntary both for ADMINISTRATORS (at the level of their courses) and for PARTICIPANTS (at the level of their account) and can be controlled via the profile setting. Data in the area of Learning Analytics is only collected as long as this functionality is active for an account and a course, and is deleted automatically if this function is deactivated.

9.3 Notifications and communications

We send notifications and communications by e-mail and via other communication channels such as instant messaging or SMS.

In principle, you may object to receiving notifications and communications such as newsletters at any time. With such an objection, you may at the same time object to the statistical recording of usage for performance and reach measurement. Necessary notifications and communications in connection with our activities and operations remain reserved.

10. Service providers for notifications and communications

We send notifications and communications with the help of specialized service providers.

In particular, we use:

• CleverReach: e-mail marketing platform; provider: CleverReach GmbH & Co. KG (Germany)

11. Social Media

We are present on social media platforms and other online platforms in order to communicate with interested persons and to provide information about our activities and operations. In connection with such platforms, personal data may also be processed outside Switzerland.

The general terms and conditions (GTC) and terms of use as well as data protection statements and other provisions of the individual operators of such platforms also apply in each case. These provisions inform in particular about the rights of data subjects directly vis-à-vis the respective platform, which includes, for example, the right to information.

12. Third-party services

We use services of specialized third parties in order to carry out our activities and operations in a permanent, user-friendly, secure and reliable manner. With such services we can, among other things, embed functions and content in our website. In the case of such embedding, the services used record the Internet Protocol (IP) addresses of the users at least temporarily for technically compelling reasons.

For necessary security-related, statistical and technical purposes, third parties whose services we use may process data in connection with our activities and operations in aggregated, anonymized or pseudonymized form. This is, for example, performance or usage data in order to be able to offer the respective service.

In particular, we use:

• Services of Microsoft: providers: Microsoft Corporation (USA) / Microsoft Ireland Operations Limited (Ireland) for users in the European Economic Area (EEA), the United Kingdom and Switzerland

12.1 Digital infrastructure

We use services of specialized third parties in order to be able to use required digital infrastructure in connection with our activities and operations. This includes, for example, hosting and storage services from selected providers as well as services for the automation and integration of apps and services.

In particular, we use:

• Microsoft Azure: storage and other infrastructure; provider: Microsoft
• Microsoft Power Automate including Microsoft Power Platform: integrated application platform; provider: Microsoft
• Microsoft Teams: platform for, among other things, audio and video conferencing; provider: Microsoft
• Kaltura MediaSpace: video platform; providers: Kaltura Inc. (USA) / Kaltura Europe Limited (Ireland)

13. Performance and reach measurement

We try to determine how our online offering is used. In this context, we may, for example, measure the success and reach of our activities and operations as well as the effect of third-party links to our website. We may also, for example, try out and compare how different parts or versions of our online offering are used ("A/B test" method). Based on the results of performance and reach measurement, we may in particular correct errors, strengthen popular content or make improvements to our online offering.

In most cases, the Internet Protocol (IP) addresses of individual users are stored for performance and reach measurement. In this case, IP addresses are generally shortened ("IP masking") in order to follow the principle of data economy through the corresponding pseudonymization.

Cookies may be used and user profiles created for performance and reach measurement. Any user profiles created include, for example, the individual pages visited or content viewed on our website, information on the size of the screen or browser window and the – at least approximate – location. In principle, any user profiles are created exclusively in pseudonymized form and are not used to identify individual users.

Notifications and communications may contain web links or tracking pixels that record whether an individual communication was opened and which web links were clicked. Such web links and tracking pixels may also record the use of notifications and communications on a personal basis. We need this statistical recording of usage for performance and reach measurement in order to be able to send notifications and communications effectively and in a user-friendly manner as well as permanently, securely and reliably based on the needs and reading habits of the recipients.

Individual services of third parties with which users are logged in may, if applicable, assign the use of our online offering to the user account or user profile with the respective service.

In particular, we use:

• Matomo: performance and reach measurement; provider: Matomo (free open-source software)
• CleverReach: e-mail marketing platform; provider: CleverReach GmbH & Co. KG (Germany)

14. Final provisions

We may amend and supplement this privacy policy at any time. We will inform about such amendments and additions in an appropriate form, in particular by publishing the respective current privacy policy on our website.