Protection of personal data is a high priority at the Carlsberg Foundation. We have therefore drawn up a policy for how the Foundation (“we” or “us”) processes your personal data. The Carlsberg Foundation is the data controller The data controller is the Carlsberg Foundation, CVR no. 60223513, located at H.C. Andersens Boulevard 35, 1553 Copenhagen V, Denmark. If you wish to exercise your rights – as set out below – or if you have any questions, please do not hesitate to contact Rasmus Enevoldsen by telephoning +45 33435363 or e-mailing email@example.com. Our processing activities You can read more about the categories of data that we process and the purposes and basis of the processing in the following sections. 1. Purposes: Applicants for grants The Carlsberg Foundation collects and processes your personal data – including your application – for use in: Assessing whether the Foundation will award a grant to you or your project. Publicly disclosing and discussing your project – including personal data such as your name and, where relevant, job title – on our website in the event that you are awarded a grant by us. Sharing the submitted application, in its entirety, with specialists who are connected with the Foundation or consulted as part of the application processing. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Budgeting and accounting. It is the Carlsberg Foundation’s mission to support outstanding basic research at the highest international level within the natural sciences, social sciences and humanities. Categories of personal data that the Carlsberg Foundation processes and basis for processing The Carlsberg Foundation processes the following personal data collected from you or third parties, including public authorities: General Data Protection Regulation, hereinafter “GDPR”. Categories Data Basis for processing General personal data: Basic data such as name, address, e-mail, telephone number. Details and description of the project, budget for the project, bank details, job title. * If the application covers more than one category of personal data, all the data provided is processed to the same extent. The Carlsberg Foundation processes your personal data with your consent, cf. GDPR art. 9, para. 2, in order to process your application, including assessing whether we will award a grant to your project. If you are awarded a grant, the Carlsberg Foundation processes – including publicly disclosing – your general personal data in order to fulfil a legitimate interest in e.g. discussing what the Foundation supports, discussing your specific project and assessing whether we will award a grant to your project, cf. GDPR art. 6, para. 1(f). If you are awarded a grant, the Carlsberg Foundation also processes – including publicly disclosing – your general personal data where necessary for fulfilling a contract/agreement, cf. GDPR art. 6, para. 1(b). Once your application has been fully processed, your general personal data may also be stored on the understanding that it is only processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, cf. GDPR art. 5, para. 1(e). Given the Carlsberg Foundation’s position and importance in Danish history, it has a legitimate interest in such ongoing storage that allows processing solely for the above purposes, cf. GDPR art. 6, para. 1(f). The Carlsberg Foundation processes personal data where necessary to comply with a legal obligation to which the Foundation is subject, cf. GDPR art. 6, para. 1(c). It is mandatory for you to give your consent for processing of the above data if you want your application to be processed and assessed. If you do not give your consent for processing, we cannot process your application for a grant. If you receive a grant from us, you should be aware that certain general data can be publicly disclosed without your consent. Specifically, we can publicly disclose general personal data such as name and job title, as well as the amount of the grant and other details of the project. Sensitive personal data: Details of marital status (sexual orientation), health-related data and photos. Relevant data that you may otherwise provide in your attached application. The Carlsberg Foundation has no need to process sensitive personal data. We therefore ask you not to provide such data to the Foundation. If we receive sensitive data in your application that can be separated out and is not relevant, this data will be erased immediately after receipt and before your application is processed. The Carlsberg Foundation also processes the personal data that you have provided in your application if we have received explicit consent to do so, cf. GDPR art. 9, para. 2(a). Concerning your consent – withdrawal of consent When you submit your application, we obtain consent to process your personal data for the purposes described above. In the declaration of consent, we inform you of our basis for and legitimate interest in processing your personal data. In providing your consent, you also give your permission for us to share the submitted application, in its entirety, with specialists who are connected with the Foundation or consulted as part of the application processing. Your consent is voluntary and you may withdraw it at any time by contacting us using the details provided above. If consent is not given, or if it is withdrawn, the application is rejected. If you choose to withdraw your consent, it will not affect the legality of our processing of your personal data based on your previously given consent up to the time that consent is withdrawn. If you withdraw your consent, it will only therefore take effect from that time. This will also not affect processing of personal data carried out on another basis, cf. above table. Who has access to your data? Your data may be shared, including disclosure and making available, within the Carlsberg Foundation. Furthermore, we may disclose or make available your personal data as follows: The Carlsberg Foundation discloses personal data to public authorities in order to comply with its legal obligations or exercise its rights pursuant to other legislation or if required to do so by an authority. The Carlsberg Foundation may share your personal data with external professional advisers, specialists, etc., to assess your application and project. The Carlsberg Foundation may disclose your personal data to researchers and others to be used for scientific or historical research purposes or statistical purposes. Given the Foundation’s position and importance in Danish history, it has a legitimate interest in such disclosure solely for the above purposes, cf. GDPR art. 6, para. 1(f). To auditors and, where necessary, lawyers and other advisers. For accounting purposes. To IT suppliers in connection with the operation and maintenance of IT systems, as well as user administration and support. Your personal data is stored within the European Union (EU) and the European Economic Area (EEA). If we transfer your data to processors in third countries, this will be done within the framework of the personal data rules safeguarding the protection of privacy. Storage and erasure Once you have given us your consent, the Carlsberg Foundation will initially process your personal data throughout the application process, which usually extends over six months. You can read more below about your rights once you have provided personal data in accordance with your consent. If we decide to award a grant, your application will in all cases be stored at least until completion of the project and for up to five years plus the remainder of the financial year upon completion of the project, unless circumstances require a shorter or longer period of processing. When we award a grant to a project, we will publicly disclose and discuss your project on our website. This may involve general personal data such as name and job title, as well as the amount of the grant and other details of the project. The purpose of storage and public disclosure is to discuss what the Foundation supports and your specific project, cf. GDPR art. 6, paras 1(f) and 1(b). Once your application has been fully processed, your general personal data – including the application – may also be stored and processed on the understanding that it is only processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, cf. GDPR art. 5, para. 1(e). Given the Carlsberg Foundation’s position and importance in Danish history, it has a legitimate interest in such ongoing storage that allows processing solely for the above purposes, GDPR Regulation’s art. 6, para. 1(f). Security We have high security standards to protect your data. A number of internal procedures and policies help ensure that we meet these standards. Your rights Right of access: You have the right to access the personal data concerning you that we keep. Right to have your data rectified: You have the right to request that your personal data is rectified if it is inaccurate, including the right to have incomplete data completed. Once you have applied for a grant via the Carlsberg Foundation’s application system, you have the option to rectify your personal data yourself. You can access your applications and thus rectify your personal data on Webfond via the following link: https://ansogning.carlsbergfondet.dk. Right to have your data erased: In certain cases, you have the right to have the personal data concerning you that we process erased. If you ask to have personal data erased that links you to an ongoing application, you should be aware that we will not have the opportunity to process the application. The same applies if you withdraw your consent. Right to restriction of processing You have the right to request that we restrict processing of your personal data. The Carlsberg Foundation does not carry out automated processing of personal data (profiling). Right to object to our processing of data You have the right to object to use of your personal data based on the Carlsberg Foundation’s legitimate interests. We will not continue to use your personal data unless we can demonstrate objective grounds for its use that override your interests and rights and/or the usage is based on legal requirements. You also have the right to object to our processing of your personal data carried out on the basis of the balancing of interests rule. Right to have data transferred You can also contact us if you want to know about your options for data portability. Right to withdraw your consent If you have given your consent for processing, you may withdraw it at any time by contacting the Carlsberg Foundation. Complaints If you wish to complain about our processing of personal data, you can contact us by e-mailing firstname.lastname@example.org. You may also lodge a complaint with the Danish Data Protection Agency, Borgergade 28, 5th floor, 1300 Copenhagen K., tel. +45 3319 3200, e-mail: email@example.com. Updating of our Data Protection Policy We want to take the best possible care of your personal data, so there may be a need for us to update this Data Protection Policy. 8 August 2018, version 2.5.