ÅBO AKADEMI UNIVERSITY
PRIVACY NOTICE
According to the EU General Data Protection Regulation GDPR (EU 679/2016), Art. 13-14
The notice concerns a long-term register, system, or tool:
Chronoshub – tool for APC management
__________________________________________________________________________
Data controller
Åbo Akademi University
Tuomiokirkontori 3
20500 Turku
Finland
Åbo Akademi University is controller for the personal data collected and processed in the university’s activities – in teaching, guidance, research, administration, and cooperation, internally and externally.
Responsible unit for the processing that is described in this document:
ÅAU Library
Contact person: Yrsa Neuman, yrsa.neuman@abo.fi, +358 504701043
Data Protection Officer at Åbo Akademi University: dataskydd@abo.fi, +358 2 215 31 (switchboard)
__________________________________________________________________________
Why do we treat your personal data?
Information about affiliation (names, institutional e-mail addresses, ORCID optional) is needed to ensure only authorized users (ÅAU affiliated researchers) have access to apply for funding from the ÅAU APC pool. Authentication through haka login before verifying the information provided in the APC application. The users’ information and information about the publication is needed to monitor APC costs at ÅAU. When using the journal guide (the public portal), no authentication is needed.
According to GDPR there must always be a legal basis for processing personal data. The legal basis for processing your personal data is:
Legitimate interest: It is necessary to process personal data for a purpose that concerns the legitimate interest of Åbo Akademi University or another party. Your personal data can then only be processed if a balancing test shows that the protection of your personal data does not outweigh the legitimate interest. Legitimate interest cannot be a legal basis when Åbo Akademi University performs its statutory university tasks.
Applying for APC funding is not associated with any risks for the applicant (corresponding author). The basic information about the applicant (name, email address) is needed to make sure all applicants are affiliated and are eligible to use this funding instrument.
Which personal data is processed and by whom?
First name, last name, ÅAU institutional e-mail address, ORCID (optional). The applicant may add names and e-mail addresses of co-authors. Chronoshub generates a user ID for each user.
Applications to the APC pool are confidential and the access is restricted to admin users at the ÅAU library for whom it is necessary to access to the information to evaluate applications. Admin users at the ÅAU library processes the data. All users (both ÅAU library admin users and ÅAU affiliated researchers) are authenticated by ÅAU authentication service haka login.
The public portal gathers cookies on users visiting the portal. The portal user will accept the cooking policy when visiting the portal for the first time. See more details in the Chronoshub cookie policy.
Åbo Akademi University Library has entered into a contract with the service supplier Chronoshub. In the contract the supplier has committed to comply with all GDPR regulations and other European data protection legislation.
From where do we collect your personal data and how is the data processed?
Institutional e-mail address is added to the user profile because of the ÅAU haka login. The users may add their first name and last name in their user dashboard. Other personal information (names of co-authors, ORCID ID) is optional and may be added by the applicant. Chronoshub generates a user ID for each user. Information about the publication (which typically do not contain any personal information) is added by the applicant.
Personal data is kept in Chronoshub as long as needed for monitoring the APC costs, but maximum 3 years after publishing.
Publication information is kept for monitoring APC costs.
The publication information (names of author, ORCID, article title etc) are openly available as a result of the publication process (outside the Chronoshub tool). Publication data is used for statistical reporting purposes.
Is your personal data transferred to a third party (outside Åbo Akademi University) for processing?
Yes, personal data will be transferred for processing outside Åbo Akademi University.
The personal data (names, institutional e-mail address, ORCID optional) is available in the Chronoshub tool. Åbo Akademi University Library has entered into a contract with the service supplier Chronoshub. In the contract the supplier has committed to comply with all GDPR regulations and other European data protection legislation.
Is your personal data transferred to a third party (outside Åbo Akademi University) for the needs of the third party?
Yes, personal data will be transferred outside Åbo Akademi University.
Åbo Akademi University Library has entered into a contract with the service supplier Chronoshub.
Is your personal data transferred outside EU/EEA?
Personal data may be transferred temporarily outside EU/EEA due to the tool being used.
All data communication is encrypted. Authentication via haka login is used, no passwords are transferred. The personal data will be stored on the Data Processor’s contracted cloud hosting partner with data centres based within the EU.
Personal data may be processed outside of the EU/EEA under the following:
-The European Commission’s decision on an adequate level of protection for personal data in a country located ouside of the EU
-Standard Contractual Clauses
-Clear and explicit consent of the data subject.
__________________________________________________________________________
Additional information about how the register, system, or tool is handled at Åbo Akademi University
Principles for how the data is protected:
In the Chronoshub tool, all data communication is encrypted. For APC funding management (applying and processing APC applications) authentication via haka login is used.
List of regular data sources:
–
Principles and regulations for storage and storage time:
Personal data is kept in Chronoshub as long as needed for monitoring the APC costs, but maximum 3 years after publishing. Rejected applications are deleted from the tool after each calendar year.
At least after each calendar year, a publication report is exported from the tool to monitor APC costs. The report is stored at the ÅAU servers for internal use and development.
Public information about the publication is reported to the service OpenAPC to contribute to the transparency of APC costs.
Information on automated decision-making (when applicable):
No automated decision-making.
__________________________________________________________________________
What rights do you have when Åbo Akademi University processes your personal data?
Åbo Akademi University is responsible for taking appropriate technical and organisational measures to protect personal data against unauthorized or illegal processing and against damage to or loss of personal data. Personal data must always be processed in a fair and transparent manner in accordance with applicable data protection regulations
According to the EU General Data Protection Regulation GDPR, you have the right to
– get transparent information on how your personal data is processed and how you can exercise your rights (Art. 12)
– get access to your personal data at Åbo Akademi University and information on the processing of data (Art. 15)
– have your personal data corrected (Art. 16). Note that employees and students at Åbo Akademi University can in most cases correct their own data according to the instructions on the intranet.
– have your data erased (“the right to be forgotten”) in certain situations (Art. 17)
– restrict the processing of your personal data in certain situations (Art. 18)
– have your personal data transferred between systems in certain situations (Art. 20)
– object to the processing of your personal data in certain situations (Art. 21)
– not be subject to automated decision-making, with certain exceptions (Art. 22)
You have also the right to be informed of a personal data breach involving a high risk for your personal data (Art. 34).
When the purpose of the processing is scientific research, statistics or archival purposes, the rights may be restricted by the Data Protection Act (1050/2018). Restrictions on rights always require special protective measures.
If you have questions about your rights, you can contact the responsible contact person (see above) or the ÅAU Data Protection Officer (dataskydd@abo.fi). See also the overall information on the processing of personal data on the ÅAU website (www.abo.fi/en/processing-of-personal-data-at-abo-akademi-university).
You have the right to lodge a complaint with the data protection authority if you believe that the processing of your personal data is an infringement of the General Data Protection Regulation (GDPR).
Contact information to the data protection authority
Office of the Data Protection Ombudsman
PL 800
00531 Helsinki
+358 29 566 6700 (switchboard)
tietosuoja@om.fi
tietosuoja.fi