With the following information we would like to inform you about the processing of your personal data and give you an overview of your rights under the General Data Protection Regulation (GDPR) in accordance with Article 13 and Article 14 GDPR.

I. General Information:

The JPI Urban Europe Online Project Monitoring System serves as a central tool for the administration of transnational R&D&I projects which are funded by different European funding agencies.

This policy applies to the general use of the Online Project Monitoring System and the associated processing of personal data, directly or indirectly, from all individuals with “personal data” being defined as any data that relates to an identified or identifiable individual or a person who may be identified by means reasonably likely to be used.

The usage of this system is currently managed by the Austrian Research Promotion Agency (Österreichische Forschungsförderungsgesellschaft mbH).

Below you will find general information how your personal data might be processed through the online JPI Urban Europe Online Project Monitoring System.

For further information and details on the processing of personal data by the different funding agencies, please refer to the specific privacy policy statements of the respective agency:

Further information on the processing of personal data can also be found on the submission platform for the  JPI Urban Europe calls 2nd Pilot Call, ENSCC, ENSUF, SUGI, MCW, Sustainable Urbanisation Europe-China, Urban Migration) and on the submission platform for EN-UAC.

II. Contact and Address of the Data controller regarding the general use of the Online Project Monitoring System

FFG will be qualified as the data controller regarding the general use of the monitoring system as long as FFG does not process data on behalf of a different data controller (Article 4 and Article 28 General Data Protection Regulation – GDPR):

Austrian Research Promotion Agency (Österreichische Forschungsförderungsgesellschaft mbH)
1090 Vienna, Sensengasse 1
Commercial Register No. (FN) 252263a, Competent Court: Vienna Commercial Court (Handelsgericht Wien)
Tel.:  +43 (0)5 7755 – 0
Fax: +43 (0)5 7755 – 97900

The Austrian Research Promotion Agency has appointed a data protection officer who can be reached at datenschutz@ffg.at.

III. Affected personal data categories

Grant recipient / beneficiary:

• First name
• Last name
• Associated organisation
• Academic title
• E-Mail address
• Other contact data
• Only for transnational consortium leads: Access password, IP address (necessary for login)

Personnel of the monitoring agency / external reviewers:

• First name
• Last name
• Associated organisation
• E-Mail address
• Other contact data
• Access password, IP address (necessary for login)

Please take note that most of this data is provided by the involved funding agencies for creation and activation of the user profiles.

Please also take note that without this data the system cannot be used or can only be used to a limited extent.

IV. The purpose of processing personal data:

Purpose of the processing of the personal data is the operation of the Online Project Monitoring System as a central tool for the administration of transnational projects which are funded by different European funding agencies.

Main aspects of this system are the contract monitoring, the monitoring of the progress of projects as well as the reporting towards the European Commission on these projects.

V. Legal basis of data processing:

In order to be able to offer you our website and the associated services, we process personal data on the following legal basis:

• for the fulfillment of contracts (Article 6 (1)(b) GDPR)
• to fulfill a legal obligation (Article 6 (1)(c) GDPR)
• on the basis of legitimate interests (Article 6 (1)(f) GDPR)

Article 6 (1)(b) GDPR forms the legal basis in cases where we require your personal data for the purpose of processing your request or for the initiation or performance of a contract with you (or your organisation).

In certain cases, Article 6(1)(c) GDPR in conjunction with section 2 of the Austrian Research Organisation Act (Forschungsorganisationsgesetz, FOG) might also form the legal basis for the contacting of recipients of Article-89-GDPR benefits or applicants.

The legitimate interests within the meaning of Article 6 (1)(f) GDPR shall also be named as constituent elements for the processing. In the case at hand, such legitimate interest of the different funding agencies consist in the functioning and effective administration of the contract monitoring, the monitoring of the progress of projects as well as the reporting regarding transnational R&D&I projects.

VI. Duration of storage of personal data:

Your personal data will be deleted or made unavailable as soon as the purpose for storing and processing such data no longer applies, provided that no longer retention period is stipulated by statutory provisions.

For further information on the statutory retention obligations and limitation periods by the different funding agencies, please refer to the specific privacy policy statements of the respective agency and the call documents.

VII. Disclosement of personal data:

Disclosure of certain personal data of grant recipients / beneficiaries (e.g. name, associated organisation, contact data, …) is made in particular to the European Commission for the purpose of monitoring the transnational R&D&I projects.

For the purpose of support and further development of the monitoring system, we use an IT service provider who may, in certain cases and based on our order and our instructions, also obtain access to personal data to render the commissioned IT services.

In all other cases we disclose personal data only if the transfer of certain data is legally required, e.g. within the scope of legal information obligations, in compliance with the respective legal requirements, or if you have consented to the disclosure.

VIII. Data Subject Rights:

We are committed to ensure protection of your rights under applicable laws. You will find below a table summarising your different rights according to the GDPR:

1. Right to access

You have the right, vis-à-vis us, to request access to all data concerning you processed by FFG. In particular, you may request the following information from us:

1. The purposes of the processing;
2. The categories of personal data concerned;
3. The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
6. The right to lodge a complaint with a supervisory authority;
7. Where the personal data are not collected from the data subject, any available information as to their source;
8. The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether your personal data is passed on to recipients in third countries or international organisations. In this context, you may demand to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

2. Right to rectification and right to restriction of processing

You may request the rectification of inaccurate data or have incomplete data completed. You may, under certain circumstances, for example if the accuracy of the data is contested, demand restriction of processing until the accuracy of the data is verified to the extent that such data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

3. Right to data portability

You may demand that FFG transmits to you – or if technically feasible to a third party indicated by you – a copy of your data in a structured, commonly used and machine-readable format. In addition, you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where

• the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR, and
• the processing is carried out by automated means.

In exercising this right, you also have the right to have the relevant personal data transmitted directly from one controller to another, where technically feasible. Rights and freedoms of others shall not be adversely affected by the above.

4. Right to erasure

Under certain circumstances, you have the right to obtain erasure of your data, e.g. if your data is not processed in accordance with data protection requirements.

If you have asserted your right to rectification, erasure or restriction of processing vis-à-vis FFG, we are obligated to communicate such rectification or erasure of data or restriction of processing to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.

5. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.

In that case, the controller shall no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

6. Right to withdraw declaration of consent under data protection law

You have the right to withdraw your declaration of consent at any time.

The withdrawal of consent shall not affect the lawfulness of any consent-based processing performed until the withdrawal.

To exercise any of the above rights, please contact us via e-mail: johannes.bockstefl@ffg.at

IX. Supervisory authorities:

You have the right to lodge a complaint with the national supervisory authority in your place of residence if it is assumed that the processing of personal data is carried out unlawfully.

Each national supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.

Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6 (1), the supervisory authority of the Member State concerned shall be competent.

If you have a complaint, please contact the competent supervisory authority.

The list of the national data protection authorities is available here.