Privacy policy for research project’s website

IVL Svenska Miljöinstitutet (”IVL”) is the controller for processing your personal data as described in this policy. We want to explain, in a transparent and clear way, how we handle personal data within the research project and what activities require us to collect personal data as well as what is optional.

Since a research project generally includes several different organisations, such as cooperation partners, project partners and funders, we may share your personal data with them and process them for joint purposes. We always strive to publish information about the he funders and partners for the specific research project on the website, contact us if you want additional information.

Scope of this privacy policy

This policy aims to inform you about how, why and when we process your personal data, as you are entitled to in accordance with Article 12-14 of the EU General Data Protection Regulation ("GDPR"). We have included information about the processing of your personal data that is most invasive, most surprising, and most common. So that you will understand our processing of your data in the very best way possible without risking information fatigue. If you are interested in knowing more, you are most welcome to contact us via our contact details below.

For information about how we use cookies, please read our cookie policy.

Information to you that participate in a research project (“research person”)

If you are a participant of this research study, there is separate information about the processing of your personal data. Kindly contact the responsible project manager for more information.

How we process your personal data

Member of the research project’s follower group (community group)

• When you show interest in, or sign up for the research project’s follower group, we collect: name, e-mail address, phone number, title, organisation (employer), research area, country and any other information that is necessary for the specific research project, in order to connect contact in the best possible way and promote information exchange within the network.
• As a member of the project’s follower group, you will receive information about the research project (newsletter) and invitations to events.
• The processing of your personal data for this purpose is based you’re your consent. You can withdraw your consent at any time, if you no longer wish to be a part of the follower group.
• If the research project is carried out together with collaboration partners, project partners and funders, the personal data may be shared with them to fulfil the purpose stated above..
  

Registration to research project’s events

• When you register to attend any of our courses, seminars, or other events that the research project arrange, we will collect the following information: name, e-mail address, title, organisation and, if applicable, telephone number, invoice reference and invoice address.
• We need the personal data we collect to administer the event, and, to send out information or sometimes handouts before or after the event. We store your personal data until this is done.
• For events that is free of charge we base our processing on your consent.· For events that are co-organised we may share the information with the co-organiser(s).
• If the event is subject to a fee, we will process your personal data to administrate your participation, collect payment and inform you about the event, based on our legitimate interest in fulfilling our contractual commitment with your organization (see more in our booking conditions).
• For events that are co-organised we may share the information with the co-organiser(s).

Participation in research project’s events

• We photograph and film during our events. These photographs may be considered personal data. We sometimes publish photographs on our website or in social media channels, from events we arrange or participate in.
• Before publishing photographs and films, we always examine them and assess if publishing may be sensitive to anyone’s privacy. If we find that this is not the case, we publish the photograph, for the purpose of informing about the event or other circumstances under which the photograph was taken.
• We base our processing of the photographs and films on our legitimate interest in informing about our business and research projects that are being carried out.

Sending newsletters and information about events and research projects

• IVL collects your e-mail address and organisation (optional) when you register for newsletter within the scope of the reaserach project.
• The processing is based on your consent.
• We will send you newsletters as long as you wish to receive them. If you no longer want to receive our newsletters, the easiest way to unsubscribe is by following the link in the email you have received. If you have not opened the newsletters or if you have in other ways been passive regarding them for a continuous period of one year, we reserve the right to delete your personal data from our systems and cease the sending of newsletters. However, you are always welcome to register for our newsletters again.
  

Whom do we share your personal data with

Processors
External suppliers and systems are a natural part of and an important support for our business. When we use external services, such as a cloud service or a customer management system, the system providers get access to your personal data, but they never use it for their own purposes.
The suppliers then process your data under our instructions, the terms and limits of which are regulated and secured through a data processing agreement. Through these agreements, we demand that the suppliers at least meet the same strict requirements that we set for ourselves in our processing of your personal data.
For the processing of your personal data, as described above, we use suppliers in the following areas:

• Suppliers of analytic tools for our website, and
• IT- and system suppliers.
  

Joint controllers
As we initially mentioned, there may be a reason to share your contact details with other organisations involved in the research project. In such a case, you have the right to contact either us or the other organisation, about who is responsible for the processing and also receive information about how and why your personal data is being processed. If you want to know which organisations have gained access to your data, please contact us.

Transfer of personal data to third countries

We always strive for your personal data to be processed within the EU/EEA, but sometimes this is not possible. For certain IT services, the data may be transferred to a country outside the EU/EES (third country). In cases where the data is transferred to third countries, we have taken additional protective measures to ensure that the EU level of protection for personal data is maintained, e.g. by including the European Commission's standard contractual clauses (SCCs) for data transfer (which are available on the European Commission's website) in the agreement with the parties accessing personal data.

Your rights
Below is a summary of the rights you have under the GDPR. It is free for you to exercise these rights and you can exercise them by contacting us, see our contact information at the end of this privacy policy. Do not hesitate to contact us if you have any questions regarding your rights.

Please note that IVL will always check your identity to ensure that information about you is provided to you and no one else.

Not all rights listed below are absolute. There are exceptions and we have tried to describe them as well as possible. If your request can not be fully met, we will clearly inform you of why.

Right of access. You are upon your request entitled to receive confirmation about whether IVL process your personal data, and if that is the case you have the right to receive a copy of your personal data as well as to obtain supplementary information about IVL’s processing of your personal data.

Right to rectification. You have the right to have your personal data corrected and/or completed if it is inaccurate and/or incomplete.

Right to erasure. In some cases, you have the right to request that IVL delete your personal data, without undue delay. It is possible for us to meet such a request in full or in part in the following situations:

• the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw your consent to a processing activity and there is no other legal basis for the processing;
• you make a valid objection to the processing of your personal data
• the personal data has been unlawfully processed; or
• the personal data has to be erased for compliance with a legal obligation.

Right to restrict processing. You have the right to request restriction of the processing of your personal data under the following circumstances:

• the accuracy of the personal data is under examination;
• the processing is unlawful or is no longer needed for the purposes of the processing but you oppose the erasure of personal data and request restriction instead;
• IVL no longer needs the personal data but you need the personal data for the establishment, exercise or defence of legal claims; or
• you have objected to the processing of your personal data and such objection is under verification.

Right to data portability. If the personal data is received from you, our processing is based upon your consent or the performance of a contract, and the information is processed digitally, you have the right to receive this personal information from us in a machine-readable format and transmit the data to another data controller.

General right to object. You have the general right to, at any time, object to the processing of your personal data that is based on IVL’s legitimate interest. If you object, we have to demonstrate that we have compelling legitimate grounds for such processing or that we need the personal data for the establishment, exercise or defence of legal claims. Otherwise, we will cease to process your personal data for that purpose.

Right to object to direct marketing. You have a right to, at any time, object to the processing of your personal data for direct marketing purposes. If you do this, IVL may no longer process your personal data for such purposes.

Right to lodge a complaint with a Supervisory Authority. You have the right to contact the supervisory authority, which in Sweden is The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten). Their contact information is found on their website, https://www.imy.se/en/ Länk till annan webbplats, öppnas i nytt fönster.. Each EU and EEA Member State has its own supervisory authority, and you can find all supervisory authorities and their contact information here Länk till annan webbplats, öppnas i nytt fönster..

• However, if you have comments or questions about our processings, we would like you to contact us first, so that we have a chance to help you and answer your questions.