How we process personal data (Privacy policy)

Registration to our events

• When you register to attend any of our courses, seminars, or other events that we arrange we will collect the following information: name, e-mail address, title/role and company and, if applicable, telephone number, invoice reference and invoice address.
• The personal data we collect for seminars, courses and other events are needed in order for us to be able to administrate the event, and sometimes to send information or handouts before or after the event, as well as inform you about other events in the same research area.
• For events that is free of charge we base our processing on your consent.
• If the event is subject to a fee, we will process your personal data to administrate your participation, collect payment and inform you about the event and other events in the same research area, based on our legitimate interest in fulfilling our contractual commitment with your organisation (see more in our booking conditions).
  
• For events that are co-organised we may share the information with the co-organiser(s).

Participation in our events

• We photograph and film during our events. These photographs may be considered personal data. We sometimes publish photographs on our website or in social media channels, from events we arrange or participate in.
• Before publishing photographs and films, we always examine them and assess if publishing may be sensitive to anyone’s privacy. If we find that this is not the case, we publish the photograph, for the purpose of informing about the event or other circumstances under which the photograph was taken.
• We base our processing of the photographs and films on our legitimate interest in informing about our operations and research projects that are being carried out.

Sending newsletters

• IVL collects your e-mail address and organisation (optional) when you register for our newsletters.
• The processing is based on your consent.
• If you no longer want to receive our newsletters, the easiest way to unsubscribe is by following the link in the email.

Whom do we share your personal data with

External suppliers and systems are a natural part of and an important support for our business. We may share your personal data within the processing described above, with the following recipients:

• Suppliers of analytic tools for our website, and
• IT- and system suppliers.

Suppliers then process your personal data under our instruction and management, whose terms and limits are regulated and secured through data processing agreements. Through these agreements we require that the suppliers, as a minimum, meet the same strict requirements that we place on ourselves in our processing of your personal data.

IVL is part of a Company group, in which IVL is the parent company. The group also consists of BASTAonline AB External link, opens in new window. (”BASTA”), EDP International External link, opens in new window. ("EPD") and eBVD i Norden AB External link. (”eBVD”) . IVL, BASTA, EDP and eBVD may in some cases be joint controllers for the processing of personal data conducted within the company group. This means that in the specific cases when this is relevant, your personal data will be shared and stored jointly. Note, this does not apply to newsletters and other mailings that you have signed up for. You can enforce your rights (described below) against any of the companies within the group. You can assert your rights listed below against all companies. You can find information about each group company's processing of personal data on their website (linked above).

2.3. If you want to know what personal data IVL processes about you, you have the right to request access to these personal data. You also have the right to request rectification or erasure of incorrect personal data. If you are of the opinion that IVL’s processing of your personal data is incorrect, you may request restriction of our processing of the personal data or object to the processing. You may also have the right to so called ‘data portability’. If you want to use any of your granted rights, please contact us on the information given below in section 2.5.

Transfer or personal data to a third country

We always strive for your personal data to be processed within the EU/EEA, but sometimes this is not possible. For certain IT services, the data may be transferred to a country outside the EU/EES (third country). In cases where the data is transferred to third countries, we have taken additional protective measures to ensure that the EU level of protection for personal data is maintained, e.g. by including the European Commission's standard contractual clauses (SCCs) for data transfer (which are available on the European Commission's website) in the agreement with the parties accessing personal data.

Your rights

Below is a summary of the rights you have under the GDPR. It is free for you to exercise these rights and you can exercise them by contacting us, see our contact information at the end of this privacy policy. Do not hesitate to contact us if you have any questions regarding your rights.

Please note that IVL will always check your identity to ensure that information about you is provided to you and no one else.

Not all rights listed below are absolute. There are exceptions and we have tried to describe them as well as possible. If your request can not be fully met, we will clearly inform you of why.

• Right of access. You are upon your request entitled to receive confirmation about whether IVL process your personal data, and if that is the case you have the right to receive a copy of your personal data as well as to obtain supplementary information about IVL’s processing of your personal data.
• Right to rectification. You have the right to have your personal data corrected and/or completed if it is inaccurate and/or incomplete.
• Right to erasure. In some cases, you have the right to request that IVL delete your personal data, without undue delay. It is possible for us to meet such a request in full or in part in the following situations:
  • the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you make a valid objection to the processing of your personal data
  • the personal data has to be erased for compliance with a legal obligation.
    
  • the personal data has been unlawfully processed; or
  • you withdraw your consent to a processing activity and there is no other legal basis for the processing
• Right to restrict processing. You have the right to request restriction of the processing of your personal data under the following circumstances:
  • the accuracy of the personal data is under examination
  • IVL no longer needs the personal data but you need the personal data for the establishment, exercise or defence of legal claims; or
    
  • you have objected to the processing of your personal data and such objection is under verification.
  • the processing is unlawful or is no longer needed for the purposes of the processing but you oppose the erasure of personal data and request restriction instead.
• Right to data portability. If the personal data is received from you, our processing is based upon your consent or the performance of a contract, and the information is processed digitally, you have the right to receive this personal information from us in a machine-readable format and transmit the data to another data controller.
• General right to object. You have the general right to, at any time, object to the processing of your personal data that is based on IVL’s legitimate interest. If you object, we have to demonstrate that we have compelling legitimate grounds for such processing or that we need the personal data for the establishment, exercise or defence of legal claims. Otherwise, we will cease to process your personal data for that purpose.
• Right to object to direct marketing. You have a right to, at any time, object to the processing of your personal data for direct marketing purposes. If you do this, IVL may no longer process your personal data for such purposes.
• Right to lodge a complaint with a Supervisory Authority. You have the right to contact the supervisory authority, which in Sweden is The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten). Their contact information is found on their website, https://www.imy.se/en/ External link, opens in new window. Each EU and EEA Member State has its own supervisory authority, and you can find all supervisory authorities and their contact information here External link, opens in new window.. However, if you have comments or questions about our processings, we would like you to contact us first, so that we have a chance to help you and answer your questions.