privacy policy

This Data Protection Policy describes how we, FOREUM Foundation for Research in Rheumatology (“FOREUM” or “we”) process and use your personal data.

This privacy notice may be modified at any time, in particular to comply with any regulatory, legal, editorial or technical developments. We therefore recommend that you regularly refer to the latest version of the privacy policy.

1 Controller and contact details

The controller of the processing is

FOREUM Foundation for Research in Rheumatology (CHE-234.786.368)
Seestrasse 240
8802 Kilchberg

info@foreum.org

2 Purpose of the processing and legal basis

2.1 For the provision of the website

In connection with the provision of the website, we process your personal data for the following purposes:

• Administer and display our website

on the basis of our legitimate interests (art. 31 sec. 2 Swiss DPA, art. 6 sec. 1 lit. f GDPR)

• Contact you and communicate with you

on the basis of performing an agreement with you or taking steps prior to entering into a contract, art. 31 sec. 2 Swiss DPA, art. 6 sec. 1 lit. b GDPR or on the basis of our legitimate interests, art. 31 sec. 2 Swiss DPA, art. 6 sec. 1 lit. f GDPR

• Send you newsletters and other information about FOREUM

on the basis of our legitimate interests, art. 31 sec. 2 Swiss DPA, art. 6 sec. 1 lit. f GDPR or on the basis of your consent, art. 31 sec. 1 Swiss DPA, art. 6 sec. 1 lit. a GDPR

• For the purposes described in our cookie banner

on the basis of our legitimate interests, art. 31 sec. 2 Swiss DPA, art. 6 sec. 1 lit. f GDPR or on the basis of your consent, art. 31 sec. 1 Swiss DPA, art. 6 sec. 1 lit. a GDPR

2.2 To fulfil our statutes

In connection with the fulfilment of our statutes, we process your personal data for the following purposes:

• Contact and communicate with our (potential) donors, grantees, partners, suppliers

on the basis of our legitimate interests art. 31 sec. 2 Swiss DPA, art. 6 sec. 1 lit. f GDPR

• Perform an agreement with you or steps to entering into one

on the basis of art. 31 sec. 2 lit. a Swiss DPA, art. 6 sec. 1 lit. b GDPR

• Fulfil our legal obligations such as storage obligations, etc.

on the basis of art. 31 sec. 1 Swiss DPA, art. 6 sec. 1 lit. c GDPR

• Advertise our grants and funded researches

on the basis of our legitimate interests art. 31 sec. 1 Swiss DPA, art. 6 sec. 1 lit. f GDPR

• Send you newsletters and other information about FOREUM

on the basis of our legitimate interests, art. 31 sec. 1 Swiss DPA, art. 6 sec. 1 lit. f GDPR or on the basis of your consent, art. 31 sec. 1 Swiss DPA, art. 6 sec. 1 lit. a GDPR

• Protect our interests in a legal dispute

on the basis of our legitimate interests, art. 31 sec. 2 Swiss DPA, art. 6 sec. 1 lit. f GDPR

3 Category of Personal Data

3.1 For the provision of the website

In connection with the provision of the website, we process the following category of personal data:

• Online and communication data

such as IP addresses, date, time, browser inquiry, traffic information, metadata, websites clicks and general information transmitted to the operating system or browser.

• All personal data that we collect via cookies

Further information can be found in the Cookie Policy

3.2 To fulfil our statutes

In connection with the fulfilment of our statutes, we process the following category of personal data:

• General personal data

such as title, first and last name, address, telephone number, e-mail address, date of birth,

• Education and work-related data

such as title, function, role, field of activity, education, employer, researches

• Health data for Patient as Research Partners
• Any other personal data that you spontaneously share with us

4 Data recipient

4.1 For the provision of the website

In connection with the provision of the website, we might transfer your personal data to the following categories of data recipients as controllers:

• Provider of cookies as disclosed in our cookie banner
• Provider of website services and social media
• Journal publishers
• Advisors, auditors and attorneys
• Authorities and courts

We have no influence on the processing of personal data by these responsible parties. The data protection declarations of these third parties must be observed.

We also might transfer your personal data to the following categories of data recipients:

• IT providers and IT service companies
• Marketing companies
• Congress service providers
• Service provider of website functions and online platforms with newsletter and marketing services

4.2 To fulfil our statutes

To fulfil our statutes, we might transfer your personal data to the following categories of data recipients as controllers:

• European Alliance of Associations for Rheumatology
• Banks and providers of payment systems
• Provider of website services and social media
• Journal publishers
• Advisors, auditors and attorneys
• Authorities and courts

We have no influence on the processing of personal data by these responsible parties. The data protection declarations of these third parties must be observed.

We also might transfer your personal data to the following categories of data recipients:

• European Alliance of Associations for Rheumatology
• Our valuation experts
• IT providers and usual service providers
• Marketing and advertising companies
• Congress service providers
• Service provider of website functions and online platforms with newsletter and marketing services

5 Disclosure of personal data abroad

5.1 For the provision of the website

In connection with the provision of the website, we process the personal data in the following countries:

• In Switzerland, in the member states of the EU and the EEA and in the UK. The Swiss Federal Council and the European Commission have issued an adequacy decision according to which these countries offer an adequate level of data protection.
• Data recipients acting as controller might process the data in other countries.

5.2 To fulfil our statutes

To fulfil our statutes, we process the personal data in the following countries:

• In Switzerland, in the member states of the EU and the EEA and in the UK. The Swiss Federal Council and the European Commission have issued an adequacy decision according to which these countries offer an adequate level of data protection (art. 16 sec. 1 Swiss DPA, art. 45 GDPR).
• Because we work with specialists and board members from all countries that are members of the European Alliance of Associations for Rheumatology your data could also be disclosed in Albania, Armenia, Belarus, Bulgaria, Georgia, Israel, Latvia, Lebanon, Macedonia, Moldova, Montenegro, Russia, Serbia, Turkey, Ukraine, United Kingdom. The transfer abroad is necessary for the evaluation and the performance of the grant (art. 17 sec. 1 lit. b Swiss DPA, art. 49 sec. 1 lit. b GDPR).
• The personal data of the grantees are published worldwide on the Internet. The publication is based on the public interest, as it is important that the public is informed about the researches funded by FOREUM (art. 17 sec. 1 lit. c Swiss DPA, art. 49 sec. 1 lit. d GDPR).

6 Duration of retention period

The personal data processed by us will be stored by us for as long as is necessary for the respective purpose in compliance with the statutory retention periods. Storage beyond the statutory retention periods is possible if you have consented to this or the purpose of the data processing has not yet ceased.

We process the personal data of grantees for at least 10 years based on public interests, as it is important that the public is informed about the researches funded by FOREUM and thereafter based on your consent as long as you do not revoke its.

When we process your personal data bases on a contractual relationship, we keep your personal data for as long as we have a contractual relationship and ten years thereafter in order to comply with the legal retention obligations and based on our legitimate interests.

We process your personal data used for communication purposes as long as you do not revoke your consent.

Log files and metadata are stored for two years.

7 Your rights

You have the following rights:

• Right of access: the right to request if your personal data is or is not being processed and, where applicable, access to said personal data and information relating to its processing
• Right to portability (under certain conditions): the right to receive certain personal data that we have collected directly from you and to transmit them on to another data controller
• Right of rectification: the right to request rectification of any errors in your personal data
• Right to object (under certain conditions): the right to object to our processing of your personal data for reasons relating to your particular situation
• Right to erasure (under certain conditions): the right to request the erasure of your personal data
• Right to restrict processing (under certain conditions): the right to request that we restrict the processing of your personal data
• You also have the right to withdraw any consent that you have given to us

If you wish to exercise these rights, you can contact us at the above-mentioned address (section 1).

If you have a complaint, you may contact the supervisory authority as follows:

• In Switzerland: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Feldeggweg 1, 3003 Bern;
• In the EU the supervisory authority of your country