Which sources and data are used?
We process personal data (Art. 4, no. 2 GDPR) that we receive from you directly, through networking activities, the exchange of information with project partners (project consortium) or via a search in publicly available sources. Relevant personal data are:
- Organisation/institution,
- First name, last name,
- Sex,
- Telephone number,
- E-mail address.
The actual extent and the type of data may differ depending on the nature and extent of newsletter/informative mailings.
Why do we process your data (purpose of processing) and what is the legal basis?
We process personal data in accordance with the provisions under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)).
We process your personal data for the purpose of sending general messages and information about activities in the area of European research and innovation funding programmes as well as other activities in the area of science, research and innovation that might be of interest for you. These activities are considered external communication activities which include informative mailings within the scope of the funded projects to which we are obliged to by a public institution. Your first and last name as well as your sex will be processed to address you directly within the scope of newsletter/informative mailings which are individually produced for a certain group of recipients.
Based on your consent (Art. 6, para. 1, letter A GDPR)
To the extent that you provided your consent to the processing of your personal data for certain purposes (e.g. newsletter distribution), such processing is considered lawful pursuant to Art. 6, para. 1, letter A GDPR on the basis of your consent. A consent that has been given can be revoked at any time. This also applies to any revocation of consent that was given prior to the coming into force of the GDPR, i.e. prior to May 25, 2018.
Please note that any revocation is only applicable to the future use of your personal data. Processing of data that has been performed before your revocation is not affected.
To perform a task that is of public interest or is carried out in the exercise of official authority (Art. 6, para. 1, letter E GDPR)
To the extent that your personal data is processed to perform one of our tasks to which we are contractually obliged, which is of public interest and has been assigned to us by an official authority (e.g. public presentation of the funded project in accordance with the compulsory rules provided by the public funding authorities, e.g. H2020 programme, Art. 38 General Model Grant Agreement) the lawfulness of such processing is based on Art. 6, para. 1, letter E GDPR.
To protect our legitimate interest (Art. 6, para. 1, letter F GDPR
To the extent that we contact you within the scope of our external communication activities to provide to you general messages and information about activities in the area of European research and innovation funding programmes and other activities in the area of science, research and innovation that might be of interest for you, and you have not given your consent pursuant to Art. 6, para. 1, letter A GDPR and we do not act for the purpose of performing a task that is of public interest or is carried out in the exercise of an official authority, the processing of your data is legally based on the existence of a legitimate interest in accordance with Art. 6, para. 1, letter F GDPR. Of course, you have the right to inform us anytime that you do not wish to receive such mailings in the future (withdrawal option).
Who will receive my data?
Within the European Research and Project Office GmbH, your data will be transferred to those persons that need them to carry out their external communication activities as, for instance, the preparation and sending of informative mailings.
We sometimes use Sendinblue as a service provider for the sending of mailings and newsletters. For this purpose, your data will be transmitted to Sendinblue GmbH. Sendinblue is prohibited from selling your data and using it for other purposes than the sending of newsletters. Sendinblue is a certified German service provider which has been chosen in conformity with the General Data Protection Regulation and the German Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)).
Further information is provided here: https://www.sendinblue.com/legal/termsofuse
How long will my data be stored?
We store your master data for the purpose of informative mailings to which we are obliged by a public institution within the scope of the funded projects for the duration of the project and beyond pursuant to the contractually agreed retention periods of the respective funding body. In general, the retention period is five years after the receipt of the project’s final payment.
Within the scope of activities relating to direct marketing, we store your data for five years after the last interaction for our own marketing purposes, for the mailing of promotional material relating to own activities and funding programmes and for the purposes of initiating business relating to these offers unless you object to the use of your data for this purpose beforehand. Accordingly, your data will be erased after five years since your last interaction with us or earlier in case of an objection.
Your e-mail address will be erased for these purposes as soon as you have revoked your consent to the use of your data for the purpose of sending you mailings.
Will my data be transmitted to a third country or international organisation?
Your data will only be transmitted to third countries (countries outside the European Economic Area (EEA)) if this is done in order to perform one of our tasks to which we are contractually obliged, which is of public interest and has been assigned to us by an official authority (e.g. public presentation of the funded project in accordance with the compulsory rules provided by the public funding bodies, e.g. H2020 programme, Art. 38 General Model Grant Agreement).
In this case, we may transfer to and store the information we collect about you in countries other than the country in which the information was originally collected, including the United States, Canada or other destinations outside the European Economic Area (“EEA”). Those countries may not have the same data protection laws as the country in which you provided the information. When we transfer your information to other countries, we will protect the information as described in this Privacy Policy and comply with applicable legal requirements providing adequate protection for the transfer of information to countries outside the EEA.
If you are located in the EEA, we will only transfer your personal data if:
- The country to which the personal data will be transferred has been granted a European Commission adequacy decision (Art. 45 (1) GDPR); or
- The recipient of the personal data is located in the US and has certified to the US-EU Privacy Shield Framework; or
- We have put in place appropriate safeguards in respect of the transfer according to Art. 46 GDPR, we entered into EU standard contractual clauses with the recipient (data importer).
You have the right to obtain confirmation as to whether or not which personal data concerning him or her is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards according to Art. 46 GDPR regarding the transfer.