Information to Data Subjects
relative to the use of ARIA platform for submission of EASI-Genomics proposals

According to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Policy key definitions:

•    "We", "our", or "us", refers to EASI-Genomics
•    "You", "the user" refer to the person(s) accessing EASI-Genomics services
•    GDPR means the General Data Protection Act, May 2018.


1. Introduction of the EASI-Genomics project 

EASI-Genomics (European Advanced infraStructure for Innovative Genomics) is a European Genomics Infrastructure Horizon 2020 project and coordinated by CNAG-CRG. 
Any information sent to EASI-Genomics through this application system will go only to the personnel responsible for processing it. This includes personnel at the EASI-Genomics WP3 partner institute MDC providing services, and relevant members of the EASI-Genomics working groups. All information will be treated with utmost confidentiality and outsiders have no access to the data. 
In addition to the above mentioned EASI-Genomics participants, user applications will be sent to external reviewers, who have signed a declaration of compliance with EASI-Genomics Conflict of Interest and Non-Disclosure Rules, stating that they will maintain the confidentiality of the proceedings and associated materials. They will not disclose information related to the review, and they will destroy the documentation upon completing the review. 
The EASI-Genomics Transnational Access Call uses ARIA as the application management system. ARIA is a collection of cloud services provided by Instruct-ERIC to research infrastructures, facilities and user communities, and is used for all online forms and surveys related to this EASI-Genomics Transnational Access Call. All information sent through ARIA will remain confidential and secure, with access to it possible only by ARIA system administrators and relevant EASI-Genomics personnel. 
Once a user application has been reviewed and accepted, the user will proceed to start the work with the selected EASI-Genomics Party(ies), and the specific rules and guidelines regulating the access will be agreed upon between the user and the service-providing institute in a Memorandum of Understandingand a material or data transfer agreement. These guidelines will follow the applicable practices, laws and regulations of where the EASI-Genomics partner institutes are located, and experiments will be conducted according to the rules of the partner institute. 
The user agrees that information about his/her application, its review process and post-project feedback are stored in the EASI-Genomics/ARIA database and can be used in an anonymized form for general EASI-Genomics statistics and similar purposes. If you have any questions or concerns regarding the ARIA system please contact aria [at] instruct-eric.eu. 

2. The purpose of the processing of data

The purpose of processing your personal data is to select the scientists who will receive access to services and technologies offered by partners within the EASI-Genomics Parties (via the ARIA service account). Personal data which concern you are categorised in the Section 3 and 4 (‘your personal data’). 
3. ARIA registration
The online proposal system is managed using the ARIA access management system, which was developed and is maintained by Instruct-ERIC. Users are required to register an account at ARIA in order to gain access to our research facilities. Your registration data is processed through ARIA, which is operated by Instruct-ERIC and hosted from webservers in the UK. The legal responsibility for the collected registration information is described in a Data Processing Agreement that has been signed between EASI-Genomics (the Data Controller) and Instruct-ERIC (the Data Processor). The Data Processing Agreement ensures GDPR compliance at every stage of data processing. 
Registering an account with ARIA will also give users the possibility to access technologies from other European Research Infrastructures who also use ARIA as their access management system, if users so desire. 

Instruct-ERIC is based at Oxford House, Parkway Court, John Smith Drive, Oxford, OX4 2JY. It was established in July 2017 according to European ERIC Council regulation number 723/2009, implementation reference 2017/C 230/01.

4. Categories of data subjects:

(1) Scientists (Users) from any country eligible to receive H2020 funding, who apply to receive access to EASI-Genomics technologies and services.
(2) Scientific reviewers of such applications.
(3) Technical reviewers of such applications.
(4) Persons working within the EASI-Genomics consortium and tasked with moderating such applications and providing administrative support to applicants. 

5. Categories of personal data: 

I. Concerning data subjects under (1) to (4) above: 

A. Provided by data subjects when opening an ARIA online account with processor Instruct-ERIC: 
  • first name (mandatory),
  • last name (mandatory),
  • Position (mandatory),
  • Institution (mandatory),
  • Type of institution (mandatory),
  • Country of residence (mandatory),
  • Email address (mandatory),
  • Password (mandatory),
  • Telephone number or Skype name

II. Concerning data subjects under (1) above: 

A. During proposal submission through the ARIA online account
  •  research history (mandatory, provided by data subjects),
  • biography (mandatory, provided by data subjects),
  • application for access to a technology or service (mandatory, provided by data subjects). 
B. During proposals review through the ARIA online account: 
  •  opinion on the scientific merits of the proposal (not provided by the data subjects),
  •  opinion on the technical merits of the proposal (not provided by the data subjects). 
C. After access to a service or technology through the ARIA online account: 
  •  feedback on the experience (optional, provided by the data subjects) 
D. Financial information: 
  • bank name,
  • bank address, 
  • SWIFT/BIC, 
  • bank Code/IBAN Code. 

III. Concerning data subjects under (2) above and during proposals review through the ARIA online account:

A. Opinion on the scientific merits of the proposal (mandatory, provided by the data subjects) 
B. Financial information: 
  • bank name,
  • bank address, 
  • SWIFT/BIC, 
  • bank Code/IBAN Code.

IV. Concerning data subjects under (3) above and during proposals review through the ARIA online account:

  • opinion on the technical merits of the proposal (mandatory, provided by the data subjects) 

V. Concerning data subjects under (4) above: 

A. At any time through the ARIA online account 
  • telephone number or Skype name for project related discussions 

B. During proposal review using the ARIA online account
  • opinion on the general eligibility of the proposal 

VI. Concerning data subjects (1) to (4) above, and during their visits to the ARIA website and use of their ARIA online account, the following data categories are processed by the processor Instruct-ERIC:

  • Server logs (full IP addresses) 

Data processor Instruct–ERIC is collecting anonymized IP addresses, received through HTTP cookies whilst visiting their website. According to recital 26 of the GDPR the principles of data protection do not apply to anonymous information. 

6. Legal basis for processing activities

6.1 ARIA Membership

We use the personal data you provide us with when registering as an ARIA user for the purpose of servicing your ARIA membership. It is provided as legitimate interest. It includes, but is not limited to: administering your membership, ensuring the security of our website and services. The accuracy of your information is important to us. If you change your email address, or if any of the other information we hold is inaccurate or out of date, please update your online profile, by visiting the profile management page in ARIA. If you have difficulties, contact us admin@instruct-eric.eu.

6.2 Proposal Submission and Management

The legal basis for data processing relating to proposal submission and management is the need to take steps at your request prior to entering into a contract (agreeing to the Terms of submission) and the performance of this contract under Article 6(1)(b) of the Regulation (EU) 2016/679 (hereinafter GDPR).  This includes contacting you by email about the status of ongoing proposals as well as the logistics and other project-related discussions after acceptance of a proposal.

6.3 Contact about EASI-Genomics events and calls

The legal basis for contacting you about other EASI-Genomics-related activities, future calls, surveys and meeting announcements is consent. You consent to receive these emails by ticking the respective opt-in box during the application process. You may unsubscribe any time by contacting EASI-Genomics@crg.eu.

7. Where do we get your data from

Some data are volunteered by you when opening an account through the ARIA web portal, when using ARIA to submit proposals for projects and when sharing your experience with us after having received EASI-Genomics services and technologies. Other data are produced through server logs. 

8. Recipients of your data

We will disclose your personal data to the following recipients, who will process them under our instructions: 

  • Instruct-ERIC, operator of the ARIA access management software, subject to GDPR, so that it may enable you to:
    • open ARIA web portal accounts,
    • submit EASI-Genomics proposals,
    • arrange for some of you to scientifically review EASI-Genomics proposals and for others to technically review EASI-Genomics proposals,
    • submit feedback on the access to EASI-Genomics facilities. 
  • external reviewers, so that they may evaluate the scientific merits of the proposals, 
  • EASI-Genomics Parties (Participating Institutes), so that they may evaluate the technical merits of the proposals, 
  • persons working within the EASI-Genomics consortium and tasked with moderating such proposals and providing administrative support to applicants, 
  • our IT departments, which provide us with information and communication technology services, 
  • (Microsoft, which provides data storage and sharing services (OneDrive), having recognized adequate protection under EU-US Privacy Shield.)

9. Retention period of your data 

If you have not submitted an EASI-Genomics application, review or evaluation, nor any application, review or evaluation elsewhere using the ARIA system, your ARIA account and all associated personal data will be deleted upon your request. We will maintain indefinitely some minimal personal data detailing your request for deletion. 
If you have submitted an application (EASI-Genomics or any other access route) using ARIA, your personal data will be maintained as a consequence of the contract that you have entered into whilst submitting the application. These data are required for reporting demand and usage of our services both internally and to our funders. 
Personal data associated with EASI-Genomics proposals (Category (2), (3), (4) and (5) of personal data, detailed in the Section 4) will be stored for minimum of 5 years after the payment of the final balance according to the EASI-Genomics grant agreement. Afterwards they will be deleted. 
Main webserver logs will be stored for 2 years and gateway server logs will be stored for 1 month, both for the purpose of ensuring overall system security of ARIA. 

10. Controllers of your data and your rights 

This personal data processing activity is controlled by the Max Delbrück Center for Molecular Medicine (MDC).
At MDC, the officer in charge is currently the Head of Genomics Research, Dr. Sascha Sauer. You may address to him a request to exercise your rights according to GDPR, e.g. to access (right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, Article 15), to rectify (Article 16), to erase your personal data (Article 17), to restrict the processing (Article 18), to object to their processing (Article 21) and to data portability (to receive in a structured, commonly used and machine-readable format the personal data concerning you, Article 20). You can do so by email at sascha.sauer(at)mdc-berlin.de, by telephone at +49 30 9406 2995 or by post at: 

Max Delbrück Center for Molecular Medicine 
BIMSB/BIH Genomics 
Robert-Rössle-Str. 10 
13125 Berlin 
Germany

11. Data protection officer 

Advice regarding your rights can also be obtained from the Data protection officer of MDC, Mrs. Ulrike Ohnesorge, under Article 39(1)(a) of GDPR. She can be reached by email Datenschutz(at)mdc-berlin.de, by telephone at +49 30 9406 4252 or by post at: 

Max Delbrück Center for Molecular Medicine 
Robert-Rössle-Str. 10 
13125 Berlin 
Germany 

12. Supervisory authority 

If you wish to complain under Article 77(1) of the GDPR, you may do so with the Berliner Beauftragte für Datenschutz und Informationsfreiheit. It can be reached by email at: mailbox(at)datenschutz-berlin.de, by telephone at + 49(0)30 13889-0, or by post at: 

Berliner Beauftragte für Datenschutz und Informationsfreiheit 
Friedrichstr. 219 
Besuchereingang: Puttkamerstr. 16 – 18 (5. Etage) 
10969 Berlin 

13. Miscellaneous 

When contacting us, please quote the title ‘EASI-Genomics User Projects Selection’ of this personal data processing activity. 

14. Amendments

We may update this policy from time to time by publishing a new version on our website. You should check this page occasionally to ensure you are happy with changes to this policy. We may notify you of significant changes to this policy by email.