Privacy policy

1. Background

   Anna-Greta Crafoord´s Foundation for rheumatological research respect your privacy. This Privacy Policy (the "Privacy Policy") describes how we obtain and process your personal data. The Privacy Policy also describes your rights in relation to us and how you can assert these rights.

   All our processing of your personal data is in accordance with our Privacy Policy and current data protection legislation, such as the General Data Protection Regulation (EU) 2016/679 (“GDPR”). We ask you to carefully read this Privacy Policy before you share any personal data with us.

2. Controller

   Anna-Greta Crafoord´s Foundation for rheumatological research, reg.no 845001-7283, Malmövägen 8, 222 25 Lund, info@annagretacrafoord.se, +46 (0)46-38 58 80, is the controller for the processing of your personal data as described in this Privacy Policy.

   If you have any questions concerning integrity or data protection, please feel free to contact us. The easiest way to do that is to send an e-mail to info@annagretacrafoord.se.

3. Who is this Privacy Policy for?

   This Privacy Policy addresses how we process personal data regarding

   1. the applicant for grants from the foundation and contact persons for applicants that are not natural persons as well as other persons connected to such applications,
   2. the foundation´s existing and potential contracting parties, such as suppliers and business partners, as well as contact persons for non-natural contractual parties,
   3. visitors to our website,
   4. subscribers to our marketing information, and
   5. others who interact with us in any way.

4. How do we collect personal data?

   1. Information from you

      In general, we collect personal data directly or indirectly from you in a variety of ways, both online and offline, such as

      1. when you or an organisation, for which you are a contact person, apply for grants from the foundation,
      2. when we otherwise enter into, administer or perform agreements,
      3. when we meet at meetings, events, seminars, fairs, etc.,
      4. when you sign up for our newsletter subscription service,
      5. when you participate and sign up to participate in our events,
      6. when you interact on our social medias or visit our website,
      7. when you participate in our surveys,
      8. when you contact us by e-mail, letter or phone or face-to-face, or
      9. when you in any other way interact with us.

   2. Information from other sources

      We may also collect personal data from the following sources:

      1. applicants for grants from the foundation,
      2. other persons connected to the party for which you are a contact person, and
      3. from websites owned by the party for which you are a contact person.

5. What personal data do we process?

   The categories of personal data that we may process about you may be:

   1. Identity information, such as national identification number, date of birth, name, initials, signature, copy of passport or other identity document, etc.
   2. Contact information, both personal and professional, such as postal address, phone number, mobile phone number, e-mail address, principal, employer, job title, job role, workplace, information about contact person, contact details for the principal or employer etc.
   3. Application and project information, i.e. Information about grants and project matters, such as academic title, university affiliation, occupation, employments and research stays, published scientific publications, degrees, education and other qualifications, projects and budget, participation in additional project application, reference number, managing principal, costs, request for extension of right of disposal (sick leave, parental leave and impediments to recruit), income statement, etc.
   4. Images, that you share with us or that we use with your consent, e.g. of beneficiary.
   5. Billing information, such as billing address, reference person and other billing information, billing history, payment reminders, costs and cost specifications, account information and other payment information, payment history, etc.
   6. System and device information, such as IP address, language settings, browser type, browser settings, time zone, operating system, platform, screen resolution, response time, download error, your geographical location, etc.
   7. Traffic and usage information, such as which links you click and when, the address of the website you arrived from, what marketing information you received and opened, etc

   In addition, we may treat other categories of personal data provided by you or the party for which you are a contact person.

   We will only process your national identification number if and to the extent that it is clearly motivated by the purpose of the treatment, the importance of a secure identification or other relevant reason.

6. What do we do with your information and for how long do we store it?

   1. 6.1 The purposes of and legal basis for our processing of your personal data

      Below we have compiled our various purposes with our processing of your personal data, the categories of personal data pertaining to the respective process, the legal basis for the processing and how long we store your personal data:

      Purpose	Personal data	Legal basis	Storage period
      Grant procedure
      Administer, review and make decisions in grant procedures and exercise our rights and obligations in connection therewith E.g. to (i) receive and administer the grant application, (ii) assess, review and evaluate the grant application, (iii) make decisions and justify decisions to approve or not to approve grants, (iv) confirm your identity and verify your information you have provided us, (v) review previous applications in connection with a new application from the same applicant or other person concerned by the matter, (vi) review, verify and follow up on our decision and handle any remarks on our decision and (vii) communicate with you.	Identity information Contact information Application and project information Billing information Other categories of personal data submitted by you or an applicant	Legitimate interest	The information is stored until further notice during the application process. If the application is not approved, the information is stored for a maximum of six months from our decision in the case, for the purpose that we shall be able to review, verify and follow up our decision and handle any remarks on it. Both approved and not approved applications together with our decisions and our decision motivations are stored for a maximum of five years from our decision in the case, for the purpose that we shall be able to carry out professional reviews of grant procedures and to review previous cases in connection with a new application from the same applicant or another who is affected by the case. Limited identity information, contact information and application and project information are also stored until further notice, for further processing, for scientific and historical research purposes as well as statistical purposes.
      Administration, payment, verify and follow up of approved grants and exercise our rights and obligations in connection therewith E.g. (i) administer decisions and other matters relating to approved grants, (ii) pay approved grants, (iii) review, verify and follow up decisions on approved grants and paid grants, (iv) request, review and follow up accounting of paid grants and (v) communicating with you.	Identity information Contact information Application and project information Billing information Other categories of personal data submitted by you or an applicant	Legitimate interest	The information is stored as long as there is an accounting obligation regarding an approved grant or as long as the grant procedures otherwise proceeds, or the longer period required by the nature of the case and thereafter for a maximum of three months. Limited identity information, contact information and application and project information are also stored until further notice, for further processing for scientific and historical research purposes as well as statistical purposes.
      Other processes
      Interact with you or a party for which you are a contact person E.g. to establish, administer, maintain and develop our relationship with you or a party for which you are a contact person, to answer questions or other correspondence from you or take actions in response to your correspondence.	Identity information Contact information Other categories of personal data provided by you or the party for which you are a contact person	If we are in a contractual relationship with you: Perform our contract with you Otherwise: Legitimate interest	If we are in a contractual relationship with you: During our contractual relationship with you and thereafter as long as there are any outstanding rights or obligations deriving from our contractual relationship. Otherwise: Until we have performed necessary actions in response to your correspondence. Thereafter your correspondence might be stored for additional time, depending on the content of the correspondence.
      Manage our contractual relationship, perform our contract and exercise our rights E.g. to fulfil our obligations and exercise our rights arising from any contract with you or a party for which you are a contact person and to administrate our relationship to you or such party, etc.	Identity information Contact information Billing information Information regarding our contractual relationship Other categories of personal data provided by you or the party for which you are a contact person	If we are in a contractual relationship with you: Perform our contract with you If you are a contact person for someone we are in a contractual relationship with you: Legitimate interest	During our contractual relationship with you and thereafter as long as there are any outstanding rights or obligations deriving from our contractual relationship. Thereafter, the information is stored for up to one year in order to be able to handle any claims or other legal measures due to the contractual relationship or for such a longer period as a possible longer complaint period applies according to our agreement.
      Provide, optimize and collect visitor statistics from our website www.annagretacrafoord.se E.g. to manage the website and your access to it, optimize your use and experience of the website and ensure that content is presented effectively to you and collect statistics, e.g. using Google Analytics in order to improve our website	-	Necessary cookies Legitimate interest	Generally See the section on cookies and our cookie policy for more information on storage period. If the legal basis is your consent As long as we have your consent. We will continuously renew your consent after a reasonable time.
      Inform about our business and approved grants Inform about our business and approved grants E.g. to inform about our business and approved grants on our website, in marketing information and in other contexts, to manage your subscription to our marketing information and invitations to events, to maintain a register of persons who unsubscribed from our marketing information, to send marketing information to you, to follow up sent marketing information through statistical processing, and otherwise communicate relevant information about us, administer events (including arranging relevant food and drink) with you as a participant.	Identity information Contact information Application and project information Images Information about participation in events Information about special food preferences Other categories of personal data submitted by you or an applicant	Legitimate interest	Generally Personal data processed for this purpose will be saved as long as it is necessary for the purposes for which the data is processed. Information about the register for marketing information Necessary information is saved until you have informed us that you no longer want to receive information from us, such as by unsubscribing from our marketing information. Information about special food preferences Such data will be deleted as soon as the current event has been completed. Data in registers of persons who unsubscribed from our marketing information Necessary information (name and e-mail address) to maintain such a register is stored without limitation in time.
      Accounting and book-keeping purposes	Identity information Contact information Application and project information Billing information Information regarding our contractual relationship (if applicable) Other categories of personal data provided by you or the party for which you are a contact person	Legal obligation	Necessary information is stored for a period of seven years in order to comply with statutory storage time regarding accounting.
      Invoicing purposes and debt collection	Identity information Contact information Application and project information Billing information	If we are in a contractual relationship with you: Perform our contract with you. If you are a contact person for someone we are in a contractual relationship with you: Legitimate interest	During our contractual relationship with you and thereafter as long as there are any outstanding rights or obligations deriving from our contractual relationship. Thereafter the information is stored for up to one year in order to be able to handle any claims or other legal measures due to the contractual relationship or for such a longer period as a possible longer complaint period applies according to our agreement.
      Development and analysis of our business E.g. to carry out business and method development, industry and market analysis, and provide statistics and manage risk management.	Application and project information Billing information	Legitimate interest	If there is a grant procedure During the application process and thereafter as long as there is an accountability regarding approved grants or that the grant procedure otherwise is ongoing. If we are in a contractual relationship with you Until further notice during our contractual relationship. Thereafter Thereafter, the data is stored for a period of up to one year from the date of termination of the grant procedure or termination of the contract.
      To comply with applicable legislation and other legal obligations E.g. to comply with obligations arising from legal requirements, judicial decisions or governmental decisions (such as anti-money laundry laws, accounting laws, tax legislation, etc.)	Identity information Contact information Application and project information Billing information Information regarding our contractual relationship (if applicable) Other categories of personal data provided by you or the party for which you are a contact person	Legal obligation	During the retention period enacted in each applicable legal obligation.

   2. If you choose not to provide certain personal information to us?

      You are not required to provide personal information to us except when provided by law. But please note, if you choose not to provide us with certain personal data or limit our right to process your personal data, that may result in that we cannot manage or approve your application for grants, process your job application or fail to meet an agreement we have with you.

   3. How have we carried out our balancing test regarding our legitimate interest?

      We process some of your personal data based on the legal basis of legitimate interest. This means that we, after a balancing test, have considered that our processing is necessary for the purpose in question and that we have a legitimate interest in carrying out the processing that prevail your interests, rights and freedoms. Our “legitimate interest” corresponds to the purpose for which we perform each processing based on our interest.

      We do not consider that our processing disadvantages you in any way. We use your information only in ways you would understand and reasonably expect, and which have a minimal privacy impact, or where there is a compelling justification for the processing. You have a right to object to processing that is based on our legitimate interests. If you wish to do so, please send an e-mail to info@annagretacrafoord.se.

   4. How to revoke your consent

      A limited part of our processing of your personal data may be based on your consent.

      You have the right, whenever you want, to revoke your consent to our processing of your personal data, if our processing is based on your consent. If you would like to make use of this right and revoke your consent, please contact us at info@annagretacrafoord.se.

      If you revoke your consent, it does not affect the legality of the processing we have performed based on your consent before it was revoked.

   5. If you do not want to receive information about our activities and approved grants from us

      As shown in the list above under section 6.1, we may process your personal data to invite you to our events and communicate relevant information to you about our activities and approved grants, etc. If you do not want to receive such invitations or such information, please contact us by sending an email to info@annagretacrafoord.se.

   6. Cookies

      We may, with your consent, use cookies when you use our website www.crafoord.se in order to optimize your experience. We will inform you about what cookies we use from time to time when we collect your consent on our site.

      A cookie is a text-only string of information consisting of letters and numbers sent from our web server and stored on your browser or device.

      You can control the use of cookies yourself. Your browser or device allows you to change the settings for the usage and extent of cookies. Go to the settings of your browser or device to learn more about adjusting the settings for cookies. Examples of things you can adjust are blocking all cookies, accepting first-party cookies, or deleting cookies when you close your browser. Keep in mind that some of our services and features on the site may not work if you block or delete cookies. You can read more about cookies on the Post and Telecom Agency website, www.pts.se.

7. To whom do we disclose your information?

   We may disclose your personal information to chosen third parties in accordance with the provisions below. All such disclosure will be made within the framework of the respective purpose specified in section 6 above and on the legal basis specified for the respective purpose.

   In the event of such sharing or transfer we will take every reasonable legal-, technical- and organizational action in order to make sure that your personal data is handled in a safe manner and that the level of security is adequate. Any third party that process your information on our behalf are bound by processor contracts which includes a provision that such third party shall follow our instructions, take the measures that we find necessary, observe confidentiality and respect this Privacy Policy.

   We may disclose your personal data to the following categories of recipients:

   1. our personnel;
   2. external auditors who, on behalf of us, examine applications for grants within the Foundation's various areas of inquiry;
   3. third parties performing services for us, e.g. IT-services, banking services, legal services, accounting services, technical support, testing, surveys, etc., and other suppliers, subcontractors and partners;
   4. other foundations with which we cooperate;
   5. our liability insurer, our liability insurance broker, counsels engaged by us or such liability insurers, the Swedish Enforcement Authority, debt collection companies, courts, arbitration tribunals or our counterparty or its counsels or other to the extent necessary to exercise our legal interests;
   6. another third party, if this is otherwise necessary for us to fulfil a statutory obligation or comply with a government decision or a court decision;
   7. researchers or other third parties who carry out research or statistical activities for scientific or historical research purpose or statistical purposes; or
   8. another third party as specifically agreed between us and you or the party for whom you are the contact person

8. How do we protect your information?

   You should always feel secure when you provide us with your personal data. Therefore, we have taken the suitable legal, technical and organisational precautions to prevent unauthorized access, use, change and deletion of your personal information. We have adopted an IT policy which applies to all our employees that set up the provisions for how we use our information systems. All our processing of your personal data is in accordance with current applicable data protection legislation.

   We have taken special measures to ensure that the principle of data minimization is observed when we process your personal data for scientific or historical research purposes or statistical purposes. We may use pseudonymization, provided that these purposes can be fulfilled in that way. When these purposes can be fulfilled through further processing of information that does not allow or no longer allows identification of you, we will fulfill these in that way.

9. Where are we processing your information?

   It is our objective to process all your personal data within the EU/EEA. In some situations, however, your personal data may be transferred to and processed by a supplier, a subcontractor or another business partner with registered office in a country outside the EU/EEA.

   If we intend to make such a transfer to a third country, we will inform you of the transfer before it is made. If you have any questions regarding a transfer, please contact us via the contact details in our policy.

   All such sharing and processing of information will be in accordance with current applicable data protection legislation and we will take all reasonable legal, technical and organisational actions to make sure that your personal data will be processed securely and with an adequate level of protection comparable with, and at the same level as, the protection that is provided within the EU/ EEA.

10. Your rights

    1. Right of access and to information

       You have the right to obtain a confirmation from us as to whether or not personal data concerning you are being processed by us, and, where that is the case, you have the right to access that personal data.

       We will provide a copy of your personal data undergoing processing. For any further copies requested, we may charge a reasonable fee based on administrative costs. If you make the request by electronic means, and unless otherwise requested by you, the information will be provided in a commonly used electronic form.

    2. Right to rectification

       You have the right to obtain from us, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed.

    3. Right to erasure (”right to be forgotten”)

       You have the right to obtain from us, the erasure of personal data concerning you and we have the obligation to erase your personal data in some situations, for example

       1. if the personal data is no longer necessary in relation to the purposes for which they were collected,
       2. if the processing is based on your consent and you withdraw that consent (and there is no other legal basis for the treatment),
       3. if the processing is based on our legitimate interests and you object to the processing and there are no overriding legitimate grounds for the processing,
       4. if the personal data have been unlawfully processed, or
       5. if the personal data have to be erased for compliance with a legal obligation, etc.

       There might be reasons as to why we cannot immediately erase all your personal data. Our continuous processing of your personal data might for example be necessary in order for us to fulfil a legal obligation that requires processing of your personal data, for example bookkeeping and tax legislation, or to establish, exercise or defend a legal claim. In that case we will block the information that could not be immediately erased from use for any other purposes than the ones that hindered the information from being erased immediately.

    4. Right to restriction of processing

       You have the right, under certain conditions, to obtain from us restriction of processing of your personal data. Restriction of processing means that your stored personal data will be marked so that in the future it may only be processed for certain limited purposes.

       The right to restriction applies for example when you have contested the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data, and when you have objected to our processing based on our legitimate interests, pending the verification whether our legitimate grounds override yours.

    5. Right to data portability

       You have the right, under certain conditions, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from us.

       If the conditions for data portability are otherwise met, then you have the right to have your personal data transmitted directly from us to another controller, where technically feasible.

    6. Right to object

       In some cases, you have the right to object to our processing of your personal data, for reasons relating to your specific situation.

       You have the right to object at any time to our processing of your personal data which is made on the legal basis legitimate interests. You also have the right to object at any time to our processing of your personal data that is made for scientific or historical research purposes or statistical purposes.

       If you make an objection, we may no longer process your personal data unless we can demonstrate compelling legitimate reasons for the processing that prevail your interests, right and freedoms or if it is for determination, exercise or defense of legal claims.

       You always have the right to object to your personal data being used for direct marketing. If you make such an objection, we may no longer process your information for such purposes.

    7. 10.7 Right to object to automated individual decision-making (including profiling)

       You have the right, with certain exemptions, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

    8. Right to lodge a complaint

       If you consider that our processing of your personal data infringes the GDPR you have the right to lodge a complaint with the Datainspektionen, which is the supervisory authority in Sweden.

    9. Exercise your rights

       If you wish to exercise any of your rights, you can easily do that by contacting us through email at info@annagretacrafoord.se. In order to protect your integrity and your personal data we might require that you identify yourself when you require our assistance.

Our Privacy Policy was updated February 22, 2020.