Processing of personal data - research project participants
Read about the collecting, processing, storage and transfer of personal data of individually identifiable current, past and future Participants in research projects.
RISE Research Institutes of Sweden AB (RISE), as data controller, processes personal data regarding participants (“Participants”) in research project / collaboration project / research center / research studies (“Research Project”), due to the circumstance that the Participant or its employer or principal participates or has participated in a Research Project (or in an application of such project).
Personal data processed by RISE
The basic personal data of the Participant that RISE processes may include name, address, phone number, e-mail address, picture, personal security number (swe: personnummer), financial information (e.g. salary and bank account number), CV and level of education.
From which sources the personal data is collected
In addition to the personal data transferred to RISE from the Participant itself, RISE may collect personal data from the employer or principal of the Participant, from public records, from other project participants, or from other third parties cooperating with RISE within the framework of the overall mission of RISE.
Purpose and lawful basis
Based on contract or RISE legitimate interest, RISE processes personal data for the following purposes:
- Application for Research Project and its funding.
- Planning, management, implementation and administration of the Research Project and associated communication by telephone, e-mail, text message or other communication channels. This processing is needed for RISE to be able to fulfill its contractual rights and obligations according to the contract entered or negotiated with RISE. If the contract is entered into or negotiated between RISE and the employer or principal of the Participant, the processing will be based on the legitimate interest of RISE, which is to fulfill the contractual rights and obligations towards the contracting employer or principal. The processing is not deemed to significantly infringe the integrity of the Participant, who should reasonably expect the processing by participating to the Research Project.
Based on RISE legitimate interest, RISE processes personal data for the following purposes:
- Fulfill its obligations towards the funding organization (e.g. reporting and presentation) of the Research Project and other parties participating in the Research Project (e.g. distribution of funding).
- Internal and external communication of the Research Project, e.g. at RISE internal network, www.ri.se, social media and other communication channels.
- Meet research ethical principles and guidelines (e.g. archiving of research material, Good Laboratory Practice, Good Manufacturing Practice, etc.)
- Upcoming Research Projects and its associated activities.
- Marketing of RISE business, projects and various events.
- Management, follow-up, evaluations and administration of customer satisfaction surveys.
- Comply with applicable laws, e.g. Bokföringslagen (1999:1078).
- Safeguard and exercise legal rights of RISE.
The processing is based on the legitimate interest of RISE to as a research institute develop competence and collaboration networks to ensure the competitiveness of the Swedish business community on an international level and contribute to a sustainable society.
Based on consent, RISE processes personal data for the following purposes:
- Evaluate the difference in the results between different categories of data subjects, e.g. differences between the different sexes or other sensitive personal data. If such processing is to be made, RISE will collect the consent of the Participant prior to such processing.
To whom the personal data is disclosed
RISE applies appropriate technical and organizational security measures to protect personal data against e.g. loss, misuse and unauthorized access. Only persons within RISE who need to process the personal data in accordance with the above stated purposes will have access to the data.
RISE may transfer personal data to third parties within the RISE company group, for the purpose of RISE being able to use the same IT system (e.g. financial system, customer register etc.) in order to be able to coordinate its assignments in an efficient manner.
RISE may transfer personal data to third parties acting as personal data processors, e.g. supplier of the supply-, support and maintenance of IT- and cloud services, suppliers of market and customer satisfaction surveys, etc.
RISE may transfer personal data to third parties acting as independent data controllers, e.g. third parties cooperating with RISE within the framework of its overall mission, funding organizations, third party participating in the Research Project or for some other reason have interest in the Research Project, insurance companies in the event of insurance matters, governmental authorities if required by applicable law, etc.
Storage and disposal
RISE processes the personal data as long as it is necessary for the purposes for which the personal data was collected.
Personal data processed for Research Project purposes will be processed as long as RISE may have any contractual rights and obligations connected to the agreements regarding the Research Project, as long as the funding organization requires, and as long as there are any legal obligation or research ethical principles or guidelines to process the data, e.g. as long as RISE needs to be able to repeat the experiment and research implementation where relevant for the result and outcome of the Research Project, etc.
Personal data processed in order to comply with applicable laws and regulations and to safeguard and exercise legal rights of RISE, will be processed as long as such laws and regulations requires, and as long as RISE are likely to need to safeguard and exercise any legal rights.
Transfer to third countries
RISE strives to process personal data within the EEA. In cases where RISE is transferring or processing personal data outside the EEA, RISE will ensure an adequate level of protection in accordance with applicable legislation.
Legal rights as a visitor
The Participant has the right to receive information regarding its personal data processed by RISE, and to request for rectification, limitation or deletion of these, by contacting the Data Protection Officer at RISE, at firstname.lastname@example.org. The Participant also has the right to file a complaint to the Swedish Data Protection Authority.
The personal data processor for the processing is RISE Research Institutes of Sweden AB (company registration number 556464-6874), with mailing address: Box 857 501 15 Borås Sweden.