COVID-19 Protein Portal Privacy Policy

The privacy and security of your personal data are very important to us. This Privacy Policy explains how and why we use your personal data, and what actions we take so that you can be confident about sharing that information with us.

This Privacy Policy applies whether you’re a member of the COVID-19 Protein Production Consortium, a user of any of our services if you visit our website, or email, phone or write to us or if we are otherwise engaged with you in a contractual relationship. 

Instruct-ERIC, the European Research Infrastructure for Structural Biology, is the data controller for the purpose of this Privacy Policy, and complies with the General Data Protection Regulation (Regulation EU of 27 April 2016) and all other data protection laws of the European Economic Area (“EEA”), and its respective member states, and any legal instrument for international data transfers, each as applicable, and as may be amended or replaced from time to time (“Applicable Data Protection Legislation”).

The accuracy of your information is important to us. If you change your email address, or if any of the other personal data we hold on you is inaccurate or out of date, please feel free to keep us updated by sending a message to support@instruct-eric.eu.

WHO ARE ’WE'?

In this policy, whenever you see the words “we”, “us”, “our”, it refers to Instruct-ERIC, operators of the COVID-19 Protein Portal on behalf of the COVID-19 Protein Production Consortium (CPPC), the group of UK institutes and funders coordinating the provision of protein reagents through the COVID-19 Protein Portal.

The portal itself is hosted and run by consortium partner Instruct-ERIC, Oxford House, Parkway Court, John Smith Drive, Oxford, OX4 2JY, UK. Instruct-ERIC was established in July 2017 according to European ERIC Council regulation number 723/2009, implementation reference 2017/C 230/01.

When we refer to our “Websites”, we refer to all COVID-19 Protein Production Portal websites. These include at least the following domains:

If you have any questions relating to this Privacy Policy or how we use your personal data please contact us at GDPR@instruct-eric.eu, or send a letter addressed to Instruct Admin Team, Oxford House, Parkway Court, John Smith Drive, Oxford, OX4 2JY, UK.

WHAT PERSONAL DATA DO WE COLLECT?

Personal data is defined as any information or the combination of information that identifies you or can be identified as relating to you personally. Because of the diversity of personal data we might collect on you during the provision of our services, we set out the main categories of those personal data in the next part.

1. PERSONAL DATA YOU SHARE WITH US ONLINE

The COVID-19 Protein Portal uses the ARIA IDSS authentication platform to provide login services for the Website (see the ARIA IDSS privacy policy here https://instruct-eric.eu/aria-idss-privacy-policy). When registering an account for the first time on the COVID-19 Protein Portal, you will link a new or existing ARIA IDSS account, to the COVID-19 Protein Portal. By linking your ARIA IDSS account, we receive your basic contact details and any other information from your IDSS profile you choose to share with us. These basic contact details consist of your first name, last name and email address. We will also receive your username randomly generated by the ARIA IDSS for the purpose of confirming your identity.

Should you choose to share more personal data with us in order to complete your account information, you will be able to share the personal data stored on the ARIA IDSS for this particular purpose. These personal data can include among others your name, address, phone number, email address, home country, professional experience, title, current employment, etc.

Additionally, personal data might be collected from any content you subsequently choose to place on the COVID-19 Protein Portal. This might be the case for any additional personal data required in order to apply for services of the COVID-19 Protein Portal such as requesting reagents, or to contribute reagents.

Personal data might, furthermore, be collected via surveys offered on the COVID-19 Protein Portal.

Finally, personal data may be collected from correspondence we have with you for example via email.

2. INFORMATION RECEIVED FROM THIRD PARTIES

When offering services, we might make use of third-party services that help with the organisation of certain aspects relating to those services which do not take place on the COVID-19 Protein Portal. These third-party services include document management and sharing platforms, calendaring, video conferences and helpdesk enquiries, for example Microsoft Office 365, Doodle, GoToMeeting and FreshDesk.

HOW WE USE YOUR PERSONAL DATA

The COVID-19 Protein Portal allows for the sharing of knowledge and resources for vital COVID-19 related research. Below we identified for you the main categories of processing purposes of your data, which will differ depending on the nature of our relationship with you and whether and how you interact with our Website(s) and our various services and activities. 

We never sell your information and we will not pass your information on to a third party, except to approved partners that help us provide these services.

1. ACCOUNT LINKING

You receive access to the COVID-19 Protein Portal by linking your ARIA IDSS account to the COVID-19 Protein Portal. For the purpose of linking your account to the COVID-19 Protein Portal, we process your basic account details, consisting of your first name, last name, email address and randomly generated username. This information is necessary in order to become an COVID-19 Protein Portal member.Your explicit and specific consent is required within ARIA IDSS to enable the transfer of your basic account details to the COVID-19 Protein Portal.

2. PORTAL SERVICES

2a. Portal Account

We use your personal data in order to enable you to apply for our services, contribute resources to the portal, and receive information about our services, activities and scientific research and funding opportunities related to COVID-19 in the spirit of open science. Limited personal data may be viewable to users registered in the COVID-19 Protein Portal and other organisations using the ARIA software (the software powering the COVID-19 Protein Portal application system). This is to enable other ARIA users to search for you to assign you a role or permission within the administration pages of ARIA or send you an internal message.

We provide you with an account in execution of our contractual relationship.

2b. Communications

We use personal data for the purpose of servicing your COVID-19 Protein Portal membership. This includes, but is not limited to administering your membership, and communicating with you about our services such as funding opportunities, and system notifications. For these communications we base ourselves on our legitimate interest, or where necessary our legal obligations.

We will normally contact you via email, although we might occasionally need to write to you or phone you when these other methods of communication are more appropriate in the specific circumstances.

2c. Applying for Reagents through the COVID-19 Protein Portal

The COVID-19 Protein Portal offers the opportunity apply for reagents for COVID-19 research. Such applications are made by submitting a request through COVID-19 Protein Portal. By making an application you are a Requestor and are bound by the COVID-19 Protein Portal Terms of Use. For your application, additional personal data is required in the form of details about your research project, your institution and address to be used for eventual shipments.

Your personal data will be shared with those necessary for evaluating your application, managing the matchmaking process of you, the requestor, with an appropriate provider as described in the Terms of Use.

We use the personal data you provide for the purpose of reviewing your application, identifying an appropriate provider, enabling the appropriate provider to deliver the Reagents to you, to communicate with you throughout the process and to collect your feedback on the COVID-19 Protein Portal. We process your data on the basis of our contractual relationship as stated in our Terms of Use.

We may wish to publish information to wider audiences on our Websites and on social media channels, for example general news about your research results, obtained with the assistance of the COVID-19 Protein Portal, alongside information about you and your research team. If we wish to feature you in such a way, we will contact you to request your consent as the basis to use your personal information in this way. We will respect your needs with respect to scientific confidentiality for unpublished work and any embargo periods where applicable.

Furthermore, we may use your personal data to produce aggregated reports on the COVID-19 Protein Portal for the purposes of reporting to our funders. The resultant reports would not contain personal data.

3. OFFERING REAGENTS THROUGH THE COVID-19 PROTEIN PORTAL

The COVID-19 Protein Portal allows the opportunity to offer Reagents for COVID-19 research as a Provider. If you wish to supply Reagents you can do so by contacting members of the COVID-19 Protein Consortium using an online contact form.

Your email request, including the contact information you provide in the contact form, will be sent directly to the COVID-19 Protein Production Consortium in order for them to manage your onboarding as a Provider.

If you become a Provider for the COVID-19 Protein Portal, those who receive Reagents from your laboratory will be provided with your name and email address if they need further communications with you after delivery of Reagents, in order to fulfil the contract.

4. REVIEWERS OF COVID-19 PROTEIN PORTAL REQUESTS

If you agree to act as a reviewer for COVID-19 Protein Portal Requests, your personal information will be shared internally with the COVID-19 Protein Portal moderators (who are employees of COVID-19 Protein Production Consortium organisations) on the legal basis of our legitimate interest to allow them to allocate appropriate applications for your area of expertise. Your identity as a reviewer will be hidden from the applicants.

5. PORTAL MANAGEMENT

We regularly monitor the COVID-19 Protein Portal for compliance with the Terms of Use, security and any illegal activities which might take place thereon. This information is held as a legitimate interest for the purposes of detecting and preventing unauthorised system access and ensuring system security. Where illegal activities take place, our legal basis might additionally be derived from our legal duties as Portal operators.

6. USE OF "COOKIES" ON THE COVID-19 PROTEIN PORTAL

The COVID-19 Protein Portal makes use of cookies in order to provide the portal to you, to allow you to log in to the portal with ARIA IDSS and to ensure the proper functioning of the site. We do not use any analytics or marketing cookies on the COVID-19 protein portal. All of our cookies are strictly necessary. Full information on the cookies used by the COVID-19 Protein Portal can be found in the COVID-19 Protein Portal cookie policy. Cookies containing personal data such as randomly assigned user ids, are processed as our legitimate interest.

YOUR DATA PROTECTION RIGHTS

Under the Applicable Data Protection Legislation, you are entitled to exercise certain rights in relation to your personal data stored and processed by us.

If you would like further information on your rights or wish to exercise them, please write us at Instruct Admin Team, Oxford House, Parkway Court, John Smith Drive, Oxford, OX4 2JY, UK, or contact us at GDPR@instruct-eric.eu. We ask of you to properly identify yourself when exercising your data protection rights in order to enable us to execute your request within the provided delays.

The exercise of your rights is free of charge and will be executed within one (1) month of the receipt of your request to exercise your rights. This delay may be extended with an additional two (2) months for a total delay of three (3) months, should your request prove to be particularly complex. If we decide to extend the delay, you will always be informed of this decision in due time.

In those cases where we deem your request to exercise your rights manifestly unfounded or excessive, we reserve the right to charge you an administrative fee for the execution of your request or to refuse to act on your request. You will always be informed within the abovementioned timeframe of one (1) month of our decision.

Please note that exercising your right to rectification, right to erasure, right to restrict the processing of your right to object to processing in relation to us, will not result in the same effect with any of the other organisations making use of any other services to which you have linked your ARIA IDSS account.

  1. WITHDRAWAL OF CONSENT

You have the right to withdraw your consent at any time where you have previously given us your consent for such processing. Withdrawing your consent will not impact the validity of the lawful processing activities performed on your personal data before exercising your right of withdrawal.

2. RIGHT OF ACCESS

You are entitled to request a copy of the data we process and hold on you. If we process and/or hold personal data about you, you will receive a copy of the information in an understandable format together with an explanation of why and how we hold and use it. 

Additionally, you can ask to receive information regarding the recipients or categories of recipients to whom your personal data has been disclosed, including any recipients from third countries, meaning countries outside the EEA. For the personal data sent to third countries, you will be entitled to receive information regarding the appropriate safeguards we have taken in order to ensure the secure processing of your data. For more information regarding the transfer of your personal data to third parties and/or third countries, we refer to the relevant sections below.

3. RIGHT TO RECTIFICATION

You have the right to ask us to correct your personal data. This includes the right to have us correct spelling mistakes, change an address, email addresses, phone numbers, etc.

Additionally, depending on the purposes of the processing, you have the right to complete any incomplete information we process or hold on you.

In order to adapt certain information which is centrally stored on the ARIA IDSS, you might have to adapt your information in the applicable ARIA IDSS profile management page if you want those changes to have an effect on all the services linked to your ARIA IDSS account.

4. RIGHT TO ERASURE

You have the right to request the deletion of the personal data we process or hold on you, including your membership to the COVID-19 Protein Portal. We can object to the deletion if the processing of your data is on the basis of contract or is necessary for the exercise of our freedom of expression or information, to comply with legal obligations, for reasons of public interest or for the establishment, exercise or defence of legal claims.

Should you decide to exercise this right to permanently delete your membership to the COVID-19 Protein Portal you will lose the historical record of any reagent requests that you may have submitted during your membership.

Furthermore, you are able to delete your ARIA IDSS account directly, using the profile management pages of the ARIA IDSS. However, please note that we might retain certain personal data on you, not directly linked to your ARIA IDSS account (as explained above). Should you wish to erase such information you can send a combined request for erasure with your ARIA IDSS account and COVID-19 Protein Portal account or send us a separate request to the contact information stated above.

5. RIGHT TO RESTRICT THE PROCESSING

You have the right to restrict our processing of your personal data. Please note that in exercising this right the relevant personal data will remain in our possession, but we will not be able to further process it.

6. RIGHT TO OBJECT TO THE PROCESSING

In those cases where we process and collect your personal data based on our legitimate interest, you have the right to object to our processing of such data. Please note that if you decide to exercise your right to object to our processing of your personal data, we have the right to provide you with our legitimate grounds in order to continue the processing of your data. Our decision to continue the processing of your personal data does not preclude you from filing a complaint with the relevant supervisory authority as set out further below.

7. RIGHT TO DATA PORTABILITY

You are entitled to receive the personal data we process or hold on you in a structured, commonly used and machine-readable format. Furthermore, you have the right to have these personal data transmitted to another data controller, unless we consider this action not to be technically feasible.

RETENTION PERIOD

Your personal data are only processed for as long as needed to achieve the purposes which are described above or, when we asked for your consent, up until such time where you withdraw your consent. In this section we provide you with the information you need to assess how long we will keep your personal data identifiable. As a general rule, we will de-identify your personal data when they are no longer necessary for the purposes outlined above or when the retention period as explained in this article has expired. However, we cannot de-identify your personal data if there is a legal or regulatory obligation or a judicial or administrative order that prevents Instruct-ERIC from de-identifying them.

All personal data we collect through our interactions with you via the Website(s), the COVID-19 Protein Portal, phone, e-mail and other digital communication channels we keep for as long as required to communicate with you, but also to keep an historical archive of our communications. This allows us to revert back to earlier communications if you return to us with new questions, request, remarks or other input.

All personal data we collect in the context of a contractual relationship with you or the organization you represent, we will keep for the duration of the contractual relationship and at least until 7 years thereafter. 

We retain the technical data for the period of time necessary for the purposes set out above, including to investigate issues relating the COVID-19 Protein Portal. We delete any unused technical data collected and processed after 180 (one hundred eighty) days.

TRANSFER OF DATA TO THIRD PARTIES

Moderators (who are employees of COVID-19 Protein Production Consortium organisations) and reviewers (who are external scientific experts) will receive the necessary information for the execution of the tasks they are assigned. Reviewers can use your personal information to evaluate your request. Moderators can use your personal information to match compatible requestors and providers and to put them in contact with one another. These reviewers and moderators will not be allowed to use the information they receive for any other purpose than the reviewing and/or moderating purpose they were assigned.

Your personal information can be shared with judicial or administrative authorities or any other authorities or third parties, regardless of their qualification under the applicable national law, if the transfer of personal data is necessary or obligatory to fulfil any legal obligations imposed on us by any applicable laws and regulations.

For the functioning of the performance of our services, we can share minimal personal data with external service providers acting as our processors. These external service providers help among others with the maintenance, analytics, safety, fraud detection, development, etc. We will always make sure that the appropriate safeguards are put in place in relation to these external service providers, in order to ensure the safe and confidential transfer and storage of any personal data you make available to us.

INTERNATIONAL DATA TRANSFERS

We ensure that the appropriate safeguards necessary for the safety and security of your personal data are in place for all personal data processed and transferred for the COVID-19 Protein Portal. For this purpose, we will conclude the necessary agreements to ensure safeguards are in place in the event that it there is reason for your personal information to be transferred internationally. These agreements include the standard data protection clauses adopted by the European Commission.

1. REVIEWERS AND MODERATORS

In certain cases, research proposal, moderators and/or peer reviewers may be located outside of the EEA, in which case your proposal data may be transferred outside of the EEA. We will only share data with reviewers outside of the EEA who are based in countries that provide an adequate level of data protection or reviewers who have individually agreed to additional safeguards to protect your personal data.

2. EXTERNAL SERVICE PROVIDERS

Lastly, your information might also be shared with external service providers located outside the EEA in order to perform the processing activities set out above in the most secure manner possible. This is done by only sharing your personal data to external service providers established in third countries which have been deemed to provide essentially equivalent protection of your personal data by the European Commission or, where applicable, by concluding an agreement containing the standard contractual clauses drafted by the European Commission. These external service providers will always be considered data processors of Instruct-ERIC.

DATA SECURITY

We protect your personal data by providing the appropriate technical and organisational security measures to minimise the risk of data loss, misuse, unauthorised access, unauthorised disclosure or unauthorised alteration. For this purpose, we use, among others, firewalls, data encryption procedures and internal authorisation procedures.

AMENDMENTS

We may update this this Privacy Policy from time to time. But when we do, we’ll let you know one way or another. Sometimes, we’ll let you know by revising the date at the top of the Privacy Policy that’s available on our website or through our application or other tools. Other times, we may provide you with additional notice (such as adding a statement to our website’s homepage or providing you with an e-mail notification). Modified versions will have immediate effect, unless stated otherwise.

WHAT TO DO IF YOU ARE NOT HAPPY

The Applicable Data Protection Legislation gives you the right to file a complaint with your local supervisory authority (depending on your place of residence, your place of employment or the place of infringement on data protection law) or with the lead Supervisory Authority being the Information Commissioner’s Office (ICO). You can contact the ICO if you have any questions about Data Protection or wish to file a complaint against Instruct-ERIC. You can contact them using their helpline 0303 123 113 or at www.ico.org.uk.

However, we would appreciate it if, prior to filing any complaint, you contact us in order for us to assist you however possible with your request or concern.

 

COVID-19 Protein Portal Privacy Policy version 1.0 updated 11 May 2020