Processing of personal data - research project participants

Based on contract or RISE legitimate interest, RISE processes personal data for the following purposes:

• Application for Research Project and its funding.
• Planning, management, implementation and administration of the Research Project and associated communication by telephone, e-mail, text message or other communication channels. This processing is needed for RISE to be able to fulfill its contractual rights and obligations according to the contract entered or negotiated with RISE. If the contract is entered into or negotiated between RISE and the employer or principal of the Participant, the processing will be based on the legitimate interest of RISE, which is to fulfill the contractual rights and obligations towards the contracting employer or principal. The processing is not deemed to significantly infringe the integrity of the Participant, who should reasonably expect the processing by participating to the Research Project.

Based on RISE legitimate interest, RISE processes personal data for the following purposes:

• Fulfill its obligations towards the funding organization (e.g. reporting and presentation) of the Research Project and other parties participating in the Research Project (e.g. distribution of funding).
• Internal and external communication of the Research Project, e.g. at RISE internal network, www.ri.se, social media and other communication channels.
• Meet research ethical principles and guidelines (e.g. archiving of research material, Good Laboratory Practice, Good Manufacturing Practice, etc.)
• Upcoming Research Projects and its associated activities.
• Marketing of RISE business, projects and various events. 
• Management, follow-up, evaluations and administration of customer satisfaction surveys. 
• Comply with applicable laws, e.g. Bokföringslagen (1999:1078). 
• Safeguard and exercise legal rights of RISE. 

The processing is based on the legitimate interest of RISE to as a research institute develop competence and collaboration networks to ensure the competitiveness of the Swedish business community on an international level and contribute to a sustainable society. 

 Based on consent, RISE processes personal data for the following purposes:

• Evaluate the difference in the results between different categories of data subjects, e.g. differences between the different sexes or other sensitive personal data. If such processing is to be made, RISE will collect the consent of the Participant prior to such processing.

RISE applies appropriate technical and organizational security measures to protect personal data against e.g. loss, misuse and unauthorized access. Only persons within RISE who need to process the personal data in accordance with the above stated purposes will have access to the data.

RISE may transfer personal data to third parties within the RISE company group, for the purpose of RISE being able to use the same IT system (e.g. financial system, customer register etc.) in order to be able to coordinate its assignments in an efficient manner.

RISE may transfer personal data to third parties acting as personal data processors, e.g. supplier of the supply-, support and maintenance of IT- and cloud services, suppliers of market and customer satisfaction surveys, etc.

RISE may transfer personal data to third parties acting as independent data controllers, e.g. third parties cooperating with RISE within the framework of its overall mission, funding organizations, third party participating in the Research Project or for some other reason have interest in the Research Project, insurance companies in the event of insurance matters, governmental authorities if required by applicable law, etc.

RISE processes the personal data as long as it is necessary for the purposes for which the personal data was collected.

Personal data processed for Research Project purposes will be processed as long as RISE may have any contractual rights and obligations connected to the agreements regarding the Research Project, as long as the funding organization requires, and as long as there are any legal obligation or research ethical principles or guidelines to process the data, e.g. as long as RISE needs to be able to repeat the experiment and research implementation where relevant for the result and outcome of the Research Project, etc.

Personal data processed in order to comply with applicable laws and regulations and to safeguard and exercise legal rights of RISE, will be processed as long as such laws and regulations requires, and as long as RISE are likely to need to safeguard and exercise any legal rights.

RISE strives to process personal data within the EEA. In cases where RISE is transferring or processing personal data outside the EEA, RISE will ensure an adequate level of protection in accordance with applicable legislation.

The Participant has the right to receive information regarding its personal data processed by RISE, and to request for rectification, limitation or deletion of these, by contacting the Data Protection Officer at RISE, at dpo@ri.se. The Participant also has the right to file a complaint to the Swedish Data Protection Authority.