Privacy Policy

This document describes and explains the privacy practices of National Bioinformatics Infrastructure Sweden (NBIS). This privacy policy applies to the NBIS web site service, the project management system and other services offered by NBIS, including mailing-lists for announcements and discussion.

National Bioinformatics Infrastructure Sweden (hereinafter called NBIS) is a national research infrastructure in bioinformatics hosted by Uppsala University. NBIS constitutes the bioinformatics platform of Science for Life Laboratory (SciLifeLab), and coordinates the Swedish membership in ELIXIR - a distributed infrastructure for life-science information. Technically, the data controller is Uppsala universitet.

This Privacy Policy explains what personal data is collected by the NBIS website and other services. It tells you why we collect your data, how it is processed, and how we keep it secure. It also gives you the contact details you need if you have any queries or requests concerning your data.

We also use partners to provide our services. This policy also explains how and why we use those services and reference their policies to let you know how they collect, use and disclose data.

We also use third-party service providers that collect and store personal data.

Some services may use cookies.

Your rights concerning this data

How to contact us

The public website (nbis.se)

What data is collected: If you browse the public website our server logs your browser, operating system, IP address it communicates with, the date and time of your visit, path of the pages visited, and the amount of data transferred.
Why we collect the data: Browsing data is used to monitor for suspicious activities (e.g. attempts to hack the site), to diagnose problems on the site, and to create anonymous usage statistics. We do not attempt to identify or profile people based on this data.
Legal basis for processing the data: Processing this data is necessary for our legitimate interest of allowing the website to remain secure and robust.
Who has access to the data: The personal data is only accessible to staff in NBIS who work on the website.
Data transfer: This data is located on a server in Stockholm, Sweden, and is not transferred to any other country.

The project management system

What data is collected: If you request support through the support request forms on the public web site, we will keep records of your name, the name of the Principal Investigator of your research group, your email address, your affiliation, and information regarding your research that you submit in your support request.
Why we collect the data: To be able to interact with you regarding your research support, and to provide reports to our funders on how our services are used.
Legal basis for processing the data: Processing your name and e-mail as part of a support request is necessary to fulfill our contractual obligations with you. Processing affiliation and additional information about you and your research is necessary for our legitimate interest in providing our funding agencies with reports on the services we’ve provided. Once collected, keeping these are necessary because of legal obligations.
Who has access to the data: NBIS staff (persons affiliated with NBIS) can access this data.
Data transfer: This data is located on a server in Stockholm, Sweden, and is not transferred to any other country.

The learning management system Studium

What data is collected: If you take part in a course offered by us through our learning management system, details such as your name and e-mail address will be collected. Likewise, any details related to your progress will be processed.
Why we collect the data: Processing this data is necessary to be able to offer our training services.
Legal basis for processing the data: This processing is necessary to fulfill our contractual obligations with you. Once collected, processing may additionally be necessary to comply with our legal obligations.
Who has access to the data: Course management, Studium administrators at Uppsala University as well as Instructure and any of their sub processors may have access to this data.
Data transfer: This data may possibly be transferred to third countries where it may be legally processed. The basis for this transfer are the standard contractual clauses in the data processing addendum (see the Instructure GDPR page)

Sensitive data archive

What data is collected: If you submit data to us we will store your email and Elixir ID, information about all the files submitted through that account, such as time, date and the originating IP address. We also keep track of who requests and gets access to data and when and to where it is transferred.
Why we collect the data: Processing this data is necessary to be able to offer a secure data archive and fulfill contractual obligations to data depositors.
Legal basis for processing the data: Processing this data is necessary for our legitimate interest of operating the secure archive and to ensure it remains secure and robust.
Who has access to the data: NBIS Staff that is operating the services. Submissions and requests may be synced with third parties in case the submitter chooses to engage them.
Data transfer: This data is located on servers in Sweden. The data will only be transferred to third parties in case the controller of a dataset that is deposited wants it to be discoverable in external databases, such as the European Genome-Phenome Archive.

Third-party services

For login to some of our systems we use a federated login service called Elixir AAI. It is based within the EU in the Czech Republic, see here for their privacy policy.

Typeform (form submission service)

What data is collected: Your browser, IP address, type of device and date and time of your visit can be collected by Typeform. Any respondent data in the corresponding form.
Why data is collected: The submitted data is collected for the purpose specified for each consented form, such as registration or feedback.
Legal basis for processing the data: When you submit personal data in a form, you consent to our processing the corresponding data. Once submitted, we may optionally store and use that information to comply with our legal obligations.
Who has access to the data: Typeform and any of its sub processors may have access to this data as well as NBIS staff.
Data transfer: Data can possibly be transferred to any third country where it may legally be processed. The legal basis for these transfers are the standard contractual clauses offered by Typeform (see here).

Cookie usage when using NBIS services

NBIS services that require login will use a session cookie to keep track of your logged in state.

Public newsletters

NBIS offers various mailing lists it’s possible to subscribe to.

What data is collected: Your name, your e-mail address and various technical details about mail delivery (e.g. failed delivery attempts). Additionally, if you send mails to these mailing lists, additional details such as the mail contents and delivery details will be collected and stored.
Why we collect the data: To be able to interact with you and offer a forum for user to user contact through our mailing lists. If you send mails we keep required information due to legal reasons (see e-mail).
Legal basis for processing the data: When subscribing to these e-mail lists, you consent to our processing of your name and e-mail in order to support us delivering mails to you. If you send e-mail to these list, we collect and store information about that to comply with our legal obligations.
Who has access to the data: NBIS staff (persons affiliated with NBIS) can access this data. Sending e-mails will lead to those being sent to all subscribers. Certain mailing lists may have public archives and sending e-mails to such lists will lead to those mails being publicly available.
Data transfer: This data is located on a server in Stockholm, Sweden, and is not transferred to any other country with the exception of any information connected to sent e-mails.

Other services

Different projects may have different public newsletters that are possible to subscribe to. Please see the respective project or newsletter for information on what data is processed and how it is used.

E-mail (and physical mail)

NBIS is legally part of Uppsala universitet which is a government entity. One consequence of this is that Offentlighets- och sekretesslag (SFS 2009:400) and Tryckfrihetsförordning (SFS 1949:105) govern what happens with documents created at or sent to NBIS.

If you send mail to NBIS staff, we will collect and store it to comply with our legal obligations. Similarly we will store any mail sent to you from NBIS staff. Any such data is eligible to be disclosed (excluding details with legal grounds for secrecy).

Data retention

Any data collected will be kept as long as it’s necessary for the stated purpose they are collected for.

Your rights

You have the right to:

Not be subject to decisions based solely on an automated processing of data (i.e. without human intervention) without being able to having your views taken into consideration.
Request at reasonable intervals and without excessive delay or expense, information about the personal data processed about you and the data processed.
Request information to understand data processing activities when the results of these activities are applied to you (e.g. why is information collected, how do you object etc.).
Request rectification of your personal data. You are also entitled to request limitation of processing your personal until rectified.
Object to the processing of your personal data.
Request the erasure of your personal data.

It must be clarified that we are only able to take the requested action regarding rights 5 and 6 whenever the processing of your personal data is not necessary to:

Comply with a legal obligation.
Perform a task carried out in the public interest.
Carry out a contractual obligation to you.
Perform processing based on our legitimate interest where our interest of continued processing outweighs your interest in the desired action.

General concerning your rights

For any request, you have the right to a response as soon as possible and your request shall be handled at the latest a month after being submitted.

You are entitled to exercise your rights without charge. For repeated requests we may charge an administrative fee, but it must not be so high that it deters valid requests. As a last resort may also turn down abusive requests.

Since our host Uppsala University is a government entity you are also entitled to have your request tried in administrative court.

If you want to exercise these rights then please contact the Data Protection Officer (see How to contact us).

How to contact us

Legally NBIS is part of the Uppsala University and therefore uses Uppsala University’s legal personality.

Jacob Håkansson, Data Protection Officer at Uppsala University Email: dataskyddsombud@uu.se