Processing of personal data at SLU

Last changed: 12 November 2019

On this page you will find information on how SLU, as a public authority, processes personal data, for example data collected through our websites. The university complies with the General Data Protection Regulation (GDPR).

SLU is responsible for all processing of personal data within its operations. This web page describes how your personal data is processed at SLU. Use the bookmarks to view the different page sections.

SLU processes personal data in accordance with regulation (EU) 2016/679 of the European Parliament and of the Council, see link below. These provisions are often referred to as the General Data Protection Regulation (GDPR).

How do we use your personal data?

SLU processes personal data in order to fulfill our assignment as a public authority and university, i.e. to provide first-class research and education, carry out environmental monitoring and assessment and collaborate with society. We also do it to review and develop our operations, and to comply with Swedish law.

All processing of personal data at SLU occurs in order to promote these purposes in some form. Processing must also have a legal basis. Only the personal data needed for a particular purpose is processed.

Your contact, course coordinator, manager or head of research at SLU can provide you with more information on how your personal data as an employee, student or outside party is processed. If you have not received any information, you can contact the Privacy and Data Protection Function at SLU. Contact information can be found at the bottom of this page.

To the top of the page

What personal data do we collect?

At SLU, there are various reasons for collecting personal data. The most common reasons are that you are a student, researcher, study participant, employee, owner of an animal being treated at the University Animal Hospital, participant in a conference or other event, job applicant, a property owner or that you have contacted or collaborated with the university for some other reason.

Most of this information will be collected directly from you. In certain cases, we also collect data from other sources such as the Swedish Tax Agency or the Swedish Board of Student Finance (CSN).

What personal data we process depends on the information we need. The following information is often necessary:

  • Contact information such as your name, address, phone number and email.
  • Personal identity numbers are processed when we need to ensure your identity or to coordinate your information between systems to ensure uniform information.
  • Bank or other financial information in order to disburse a payment or send an invoice.
  • Personal data that has been collected within the framework of participation in a research study.
  • Study results or other information regarding your studies at SLU.
  • Information we collect when admitting an animal, or information which is needed to treat an animal.
  • Information about property owners and other persons who have been in contact with SLU in connection to environmental monitoring and assessment.
  • Information on how to use our websites, for example cookies, which are used to improve user-friendliness.
  • Information for conference or course participants.
  • Personal data which is necessary for an employment or if you have applied for a job.

To the top of the page

How is your personal data protected?

SLU must ensure that all processing of personal data is protected through
technological and organisational measures. The measures must ensure a security level appropriate to the risk. The security aspects must include confidentiality, integrity and availability as well as adequate technological protection. This may involve only giving those authorised access to the information, encrypting the information, storing it in specially protected locations and making a processing copy.

To the top of the page

Who can access your personal data?

A lot of information at SLU constitutes official documents. If your personal data can be found in an official document, anyone who requests access to this document can view your personal data, unless the Public Access to Information and Secrecy Act (2009:400) prevents it.

In addition to this, your personal data may be disclosed to SLU's partners in research projects, to suppliers or other parties that need access to it due to an agreement between SLU and you. Data may also be disclosed to outside parties if it is needed for a public interest task, as part of the exercise of official authority or because of a legal obligation that SLU has.

A public interest task is a task SLU must fulfill according to law, or according to decisions based on laws, but which is not directly part of SLU's assignment as a public authority. See the link to information on official documents at the bottom of this page.

When transferring personal data to another party, SLU takes all legal, organisational and technological precautions necessary in order to protect your data. You will be informed if we plan to disclose information about you to other organisations.

SLU will only transfer personal data to other parties if there is a legal basis for this.

To the top of the page

For how long do we store your personal data?

We only store your personal data for as long as is necessary for the purpose of the processing, or as long as is required by law.

  • If, for example, you are an employee, we process your personal data for as long as we need to manage your employment conditions.
  • If you are a student, we process your personal data as long as you are a student at SLU.
  • When no longer a student at SLU, we process your personal data according to Swedish law, as well as in any publications that you have approved.
  • If you are a participant in a study, we process your personal data for as long as is necessary to ensure the quality of the research.

In regard to official documents, personal data is managed in accordance with the Freedom of the Press Act (1949:105), the Archives Act (1990:782) and the Swedish National Archive's regulations. In many cases, this means that your personal data may be stored in SLU's central archive between five years and in perpetuity.

To the top of the page

Transfer of data to a non-EU/EEA country

SLU may transfer personal data to a third country outside the EU/EEA, primarily as part of international research projects. SLU will then take all reasonable legal, organisational and technological precautions necessary to achieve an adequate security level for your personal data. You will also be informed if this should occur.

To the top of the page

Rights under the General Data Protection Regulation

The GDPR gives you the following individual rights at SLU:

Right to access

You have the right to be informed if SLU is processing your personal data. You also have the right to a free copy of the personal data that is being processed. If you request such personal data excerpts several times, SLU will charge a fee to cover the administrative costs. In connection with such a request, SLU also provides further information on the processing, its purpose, categories of processed personal data, expected storage time, etc.

Right to rectification

You have the right to request that your personal data be rectified if it is incorrect. You can do this by, for example, providing your contact, course coordinator, manager or head of research at SLU with a supplementary statement. SLU is obligated to correct your personal data without undue delay. SLU is not obligated to correct your data if it is only processed to document completed research.

Right to erasure

You have the right to request that your personal data be erased from SLU's systems if the personal data is no longer needed to meet the purpose for which it was collected. This may for example be the case if you decide to stop studying and wish to have your personal data erased.

There may be provisions that state that SLU cannot not delete your data, for example the provisions on official documents, research and study documentation. If your personal data has been transferred to other parties, SLU will take all reasonable measures to inform these parties about your request.

If SLU cannot delete your data for legal reasons, we will limit the processing of your data to only include what is necessary to fulfill our obligations.

Right to restrict processing 

You have the right to request that the processing of your personal data be restricted – this means that we will only process your personal data for certain specific purposes. SLU can restrict processing in the following cases:

  • You claim that your personal data is incorrect and SLU requires time to verify the accuracy of the data.
  • SLU no longer requires the data, but you have requested that we continue to store it because you require it to exercise a legal claim.
  • You object to processing carried out by SLU. In that case, processing is limited until it has been established whether your reasons for objecting override SLU's legitimate reasons for processing the data.
  • You want us to erase your personal data, but we cannot comply for some reason. 

Right to object to processing

In certain cases, you have the right to object to SLU's processing of your personal data, for example in regard to research or teaching. SLU will then cease processing unless we have imperative grounds to continue with it, or if processing is necessary to exercise a legal claim.

Questions

If you have any questions on data protection, please get in touch with your SLU contact, the person responsible for a project or course or the Privacy and Data Protection Function (contact details below).

Contact

Privacy and Data Protection Function, Vice-Chancellor's Office, SLU
dataskydd@slu.se, 018-67 20 90
Postal address: Integritets- och dataskyddsfunktionen vid SLU, Box 7070, 750 07 Uppsala
Visiting address: Ulls hus, Almas Allé 8

Page editor: ew-red@slu.se