At SWISSUbase (we, our or SWISSUbase), we recognize the importance of your privacy and of transparency. This privacy notice (Privacy Notice) describes how we process your personal data when you interact with our platform accessible at https://swissubase.ch/ (the Platform), and the services we provide through the Platform (together with the provision of the Platform, our Services).
By using our Services, you expressly acknowledge that we may process your personal data in accordance with this Privacy Notice.
This Privacy Notice is incorporated into and forms an integral part of our Terms of Use for the Platform (ToU). All capitalized terms not defined in this document have the meaning given to them in the ToU.
Summary
The following is a summary of (but not a replacement for) this Privacy Notice. We recommend all users read the notice fully.
→ Our role. We, SWISSUbase, are responsible for the processing, as controller, of your personal data (but only for our own activities and not those of third-party providers) (see section 2);
However, if we process your personal data because they are included in the projects and datasets uploaded by a researcher (the depositor), we will generally act as data processor for that organization to which such researcher is affiliated (and this Privacy Notice shall not apply). You must refer to the concerned researcher or organization for information about their processing activities (see section 3.4).
→ Data we collect. We collect the information which is provided to us by you or our other users. We also collect some information automatically when you interact with the Services (see section 3);
→ How we use it. We process your personal data in compliance with Swiss laws and other data protection laws applicable to us. This means that we will only process your information where we have a legal basis to do so, and only for certain reasons (mainly for providing our Services, operating our Platform, and for the other legitimate purposes indicated in this Privacy Notice) (see section 4);
→ Control and Access. Your personal data is stored in Switzerland. We do not share it with third parties or transfer it abroad unless this is both necessary for the operation of our Services and permitted by applicable laws. This may for instance be the case when we use service providers or must interact with third parties to conduct our professional activities. However, some information on the Platform is available publicly, and thus worldwide (see sections 6 – 8);
→ Your rights. You may contact us (support@swissubase.ch) to exercise your rights pertaining to your personal data (see sections 10 and 11).
The SWISSUbase Consortium (a “Simple Society” consisting of FORS and the Universities of Lausanne, Neuchâtel and Zurich), Bâtiment Géopolis, 5th floor, CH-1015 Lausanne, Switzerland, is responsible for the processing, as controller, of your personal data. You will find our contact details below in section 11.
This Privacy Notice only applies to data processing undertaken by or on behalf of us. Whilst we may provide links to third party websites, contents, or services, we are not responsible for their policies in relation to personal data. In such circumstances, the collection and use of your personal data are governed by the privacy policy of those third-party providers, which you should carefully review to learn more about their personal data processing practices.
As further detailed in this Privacy Notice, we may process your personal data because it is included in the datasets and other contents uploaded by our data depositors (the Uploads). This Privacy Notice does not govern how our depositors (or the organization to which they are affiliated) process your personal data through the Services. You must refer to their individual policies. Please see section 3.4 below for additional information about your personal data which may be included in a project or dataset.
Most data you provide to us directly, for example when you register for an event, subscribe to our newsletter or reach out to us. Other data is collected automatically by our IT systems when you visit the Platform (i.e. IP-address and other technical information).
The description below summarizes the type of data we may process in connection with the Platform and the purpose of the processing of this data:
3.1 Automatic and technical processing
Purpose: We may process your personal data for our legitimate business operations related to providing our Services, which include (i) ensuring that our Services are provided in an efficient and secure way (e.g. through internal analysis of the Services’ stability and security, updates and troubleshooting); (ii) protecting the security of our IT systems, architecture and networks; (iii) benefiting from cost-effective services (e.g. we may opt to use certain services offered by suppliers rather than undertaking the activity ourselves); and (iv) improving and developing the Services (including monitoring the use of our Services, and for statistical purposes).
3.2 Authentication service provider
Purpose: Authentication service providers connect to a third-party source of user identity. Authenticated identification allows us to provide access to certain Platform features and datasets only to authenticated users.
3.3 Communication and promotion
Purpose: For our legitimate business interests related to the provision and functioning of the Services, to ensure the security of the Services, to improve our Services, and for monitoring or statistical purposes.
3.4 Personal data that we process which is provided by other users (e.g. data depositors)
Purpose: Your personal data may be processed because it is included in a project, dataset or other content uploaded by one of our depositors, please read the following:
We process your personal data in compliance with the Swiss Federal Act on Data Protection and other data protection laws applicable to us.
We also do not make decisions exclusively based on automated processing which have legal effects on the data subjects or affect them significantly (automated individual decision).
We process your data if it is necessary for processing purposes, legal retention periods and our legitimate interests, e.g. for documentation, for evidence purposes or for IT security.
Your personal data will not be stored longer than necessary. We will erase or anonymize your personal data as soon as it is no longer necessary for us to fulfill the purposes set out in section 3 of this Privacy Notice. This period varies, depending on the type of data concerned and the applicable legal requirements. Considering the purpose of the Services, certain personal data will be retained if we do not receive a request to suppress it. For instance, we do not automatically delete after a certain period from our metadata catalogue the names of the persons who have uploaded a dataset.
For the aforementioned processing purposes, we may share your data with our service providers (such as IT service providers for example).
SWISSUbase may also be required to disclose your data to comply with its legal obligations, following a request from a judicial or administrative authority or in the context of legal proceedings.
Under no circumstances will your data be sold to third parties for marketing or promotional purposes.
All personal data processed by SWISSUbase is hosted on servers located in Switzerland.
Information in the public online catalogue, including project and dataset metadata are visible and may be viewed worldwide.
We do our utmost to ensure the security of your data and to prevent any unauthorized access, use, loss, modification or disclosure. To guarantee the confidentiality of data exchanged, particularly during the delivery of an online service, our Platform uses SSL certificates authenticated by a third party.
Personal data will be protected according to the GÉANT Data Protection Code of Conduct for Service Providers, a common standard for the research and higher education sector to protect the user’s privacy.
We make every effort to ensure that any third parties to whom your data may be communicated (as described above) treat it in a secure manner to ensure its confidentiality and integrity.
Our security measures are continuously improved in line with technological developments.
Despite our best efforts, it is not possible to fully guarantee the security of information exchanged over the Internet. SWISSUbase assumes no responsibility for the data you transmit.
The Platform uses cookies. Cookies are individual codes (for example, a serial number) that our server or a server of our service providers transmits to your system when you connect to our website, and that your system accepts and stores until the set expiration time. Your system transmits these codes to our server or the third-party server with each additional access. That way, your digital footprint is recognized even if your identity is unknown. As the cookies are stored on your system, you as the user have complete control over how cookies are used. By changing the settings in your web browser, you can deactivate or restrict the transmission of cookies to external websites. You can also delete all saved cookies on your system at any time. Restrictions on cookie usage can be managed automatically by your browser. If you disable cookies for our Platform, you may no longer be able to use the site’s full range of functions.
We distinguish the following categories of cookies:
– Performance cookies:
To optimise our website and to better adapt them to the needs of the users, we use performance cookies to record and analyze the use of our website. The web server only records usage data which reveal statistical trends which we use to improve our offer (log files). We use Matomo for this purpose which also uses cookies. The data generated by cookies concerning your use of the site is transmitted to and stored on servers located at the University of Lausanne. All data is anonymized and will be kept for 24 months. This information is used to evaluate your use of the site, to compile reports on site activity for the site editor and Internet use.
– Preference cookies:
Preference cookies are necessary for the server to store options or information (which you have entered) beyond a session (i.e. a visit to the website) if you use this function. This site only uses preference cookies for language settings.
– Pixel tracking:
We use tracking pixels in our newsletters to analyze the open rate.
As your personal data is processed, you are considered a data subject within the meaning of Art. 5 lit. a FADP and are entitled to the following rights. If you wish to exercise of any of these rights, please contact us at support@swissubase.ch or the physical address mentioned in section 2.1.
If your personal data is contained in a dataset uploaded by one of our depositors, you should direct your privacy inquiries, including any requests to exercise your data protection rights, directly to such depositor (or its organization).
10.1 Right to information
At your request, SWISSUbase will inform you whether and which data about you is being processed. You will generally receive a copy of the personal data within one month of receipt of the request for information. This is usually done electronically.
10.2 Right to rectification
If your personal data is incorrect, you have the right to request that the incorrect data be corrected immediately. If personal data is incomplete, you have the right to request that it be completed.
10.3 Right to object
You have the right to object at any time to processing of personal data concerning you. We will no longer process the personal data unless we have legitimate grounds for the processing.
10.4 Right to erasure
You have the right to request the erasure of your personal data. The right to erasure may be restricted if SWISSUbase processes the data to assert, exercise or defend legal claims or if there is an overriding public interest.
10.5 Right to restriction of processing
You can request the restriction of the processing of personal data if in particular:
– The accuracy of the personal data is contested for a period enabling the accuracy of the personal data to be verified;
– The processing is unlawful and the restriction of the use of the personal data is requested instead of erasure.
If processing has been restricted for the aforementioned reasons, this personal data will only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
You will be informed before the restriction is lifted.
10.6 Right to data portability
You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, provided that the processing is based on consent or on a contract and is carried out by automated means.
10.7 Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority.
If you believe your personal data has been used in a way that is not consistent with this Privacy Notice, or if you have any questions or queries regarding the collection or processing of your personal data, please contact us at: support@swissubase.ch.
This Privacy Notice may be subject to amendments. Any changes or additions to the processing of personal data as described in this Privacy Notice affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you (including by email and/or via the Platform, e.g. banners, pop-ups or other notification mechanisms). If you do not agree to the changes made, you must stop accessing and/or using the impacted Services.
____________________________________________
Last updated: [30 September 2024]
