On this page, you will find information on how SLU processes personal data.
SLU is responsible for all processing of personal data within its operations. This web page describes how your personal data are processed at SLU. Use the bookmarks to view the different page sections.
- How does SLU process your personal data?
- What personal data do we collect?
- How are your personal data protected?
- Who can access your personal data?
- For how long are personal data stored?
- Transferring your personal data to a third country
- Your rights according to the General Data Protection Regulation
SLU processes personal data in accordance with the EU's General Data Protection Regulation, abbreviated GDPR.
SLU processes personal data to fulfil our assignment as a public authority and university, i.e. to provide first-class research and education, carry out environmental monitoring and assessment and collaborate with society. We also do it to review and improve our operations, and to comply with Swedish legislation.
All processing of personal data at SLU is done with one of these purposes. Only the personal data needed for a particular purpose are processed. Processing must also have a legal basis. Your contact, course coordinator, manager or head of research at SLU can provide you with more information on how your personal data as an employee, student or outside party are processed. If you have not received any information, you can contact SLU’s data protection officer. Contact details can be found at the bottom of this page.
At SLU, there are various reasons for collecting personal data. The most common reasons are that you are a student, researcher, study participant, employee, owner of an animal being treated at the University Animal Hospital, participant in a conference or other event, job applicant, a property owner or that you have contacted or collaborated with the university for some other reason.
Most of this information will be collected directly from you. In certain cases, we also collect data from other sources, such as the Swedish Tax Agency or the Swedish Board of Student Finance (CSN).
What personal data we process depends on the information we need. The following information is often necessary:
- Contact information such as your name, address, phone number and email. Personal identity numbers are processed when we need to ensure your identity or to coordinate your information between systems to ensure uniform information.
- Bank or other financial information to make a payment or send an invoice.
- Personal data collected because you participate in a research study.
- Study results or other information regarding your studies at SLU.
- Information we collect when admitting an animal, or information which is needed to treat an animal.
- Information about property owners and other persons who have been in contact with SLU in connection with environmental monitoring and assessment.
- Information on how to use our websites, for example, cookies, which are used to improve user-friendliness.
- Information for conference or course participants.
- Personal data necessary for administration of a job application or employment.
SLU must ensure that all suitable technological and organisational measures are taken when processing personal data. The measures must ensure a security level appropriate to the risk. The security aspects must include confidentiality, integrity and availability as well as adequate technological protection. This may involve only giving those authorised access to the information, encrypting the information, storing it in specially protected locations and making a processing copy.
A lot of information at SLU is official. If your personal data are in an official document, anyone who requests access to this document can view your personal data, unless the Public Access to Information and Secrecy Act (2009:400) prevents it.
In addition to this, your data may be forwarded to SLU’s partners in research projects, suppliers or other parties that need access to them following an agreement between SLU and yourself, because of a task in the public interest or because SLU has a legal obligation. A task of public interest is a task SLU is obligated to perform by law, or by a decision based on legislation, but that is not part of SLU’s tasks as a public authority.
When transferring data to third parties, SLU will take all reasonable legal, organisational and technical precautions to protect your personal data.
Data may also be disclosed to outside parties if needed for a public interest task, as part of the exercise of official authority or because of a legal obligation that SLU has.
- If, for example, you are an employee, we process your personal data for as long as we need to manage your employment.
- If you are a student, we process your personal data as long as you are a student at SLU.
- When you have finished your studies at SLU, we will process your personal data as required by law, and in any publications approved by you.
- If you take part in a research study, we will process your personal data as long as it is required to ensure the quality of the research findings.
As to official documents, personal data in them are managed in accordance with the Freedom of the Press Act (1949:105), the Archive Act (1990:782) and the regulations of the National Archives of Sweden. This will often mean that your personal data will be saved for 5 years to perpetuity in the SLU central archive.
SLU may transfer personal data to non-EU/EEA countries. If that happens, SLU will take all reasonable legal, organisational and technical precautions to ensure adequate protection of your personal data. You will also be informed if this happens.
Your rights under the General Data Protection Regulation
As an individual, your rights are defined in the General Data Protection Regulation. If you want to exercise any of these rights, contact firstname.lastname@example.org.
Right to access
You have the right to be informed if SLU is processing your personal data. You also have the right to a free copy of the personal data that are being processed. If you request such personal data excerpts several times, SLU will charge a fee to cover the administrative costs. In connection with such a request, SLU also provides further information on the processing, its purpose, categories of processed personal data, expected storage time, etc.
Right to rectification
You have the right to request that your personal data be rectified if they are incorrect. You can do this by, for example, providing your contact, course coordinator, manager or head of research at SLU with a supplementary statement. SLU is obligated to correct your personal data without undue delay. SLU is not obligated to correct your data if they are only processed to document completed research.
Right to erasure
You have the right to request that your personal data be erased from SLU's systems if the personal data are no longer needed to meet the purpose for which they were collected. This may for example be the case if you decide to stop studying and wish to have your personal data erased.
There may be provisions that state that SLU cannot delete your data, for example the provisions on official documents, research and study documentation. If your personal data have been transferred to other parties, SLU will take all reasonable measures to inform these parties about your request.
If SLU cannot delete your data for legal reasons, we will limit the processing of your data to only include what is necessary to fulfil our obligations.
Right to restrict processing
You have the right to request that the processing of your personal data be restricted – this means that we will only process your personal data for certain specific purposes. SLU can restrict processing in the following cases:
- You claim that your personal data are incorrect and SLU requires time to verify the accuracy of the data.
- SLU no longer requires the data, but you have requested that we continue to store it because you require it to exercise a legal claim.
- You object to processing carried out by SLU. In that case, processing is limited until it has been established whether your reasons for objecting override SLU's legitimate reasons for processing the data.
- You want us to erase your personal data, but we cannot comply for some reason.
Right to object to processing
In certain cases, you have the right to object to SLU's processing of your personal data, for example regarding research or teaching. SLU will then cease processing unless we have imperative grounds to continue with it, or if processing is necessary to exercise a legal claim.
If you have any questions on the protection of personal data,you can reach out to your SLU contact, the person responsible for a project or a course, or email email@example.com.
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Swedish Authority for Privacy Protection's pages on the General Data Protection Regulation (GDPR)