For the purposes of this information clause, the “Contractor” means the other contracting party entering into the agreement with GÉANT Association. This information clause sets out how GÉANT Association processes personal data relating to signatories of the agreement and to employees, representatives, authorised persons and other contact persons of the Contractor involved in the negotiation, conclusion, performance, administration or termination of the agreement.
Controller
The controller of your personal data is GÉANT Association – registered with the Chamber of Commerce in Amsterdam with registration number 40535155 with its registered address at Hoekenrode 3, 1102 BR, Amsterdam, The Netherlands, Netherlands (the main establishment of GÉANT in line with GDPR) – and operating in the United Kingdom as a branch located at City House, 126-130 Hills Road, Cambridge CB2 1PQ (hereafter “GÉANT” or the “Controller).
Data Protection Officer / privacy contact
GÉANT Association has appointed a Data Protection Officer who can be contacted via this contact form.
Categories of personal data
GÉANT may process the following categories of personal data relating to signatories and to employees, representatives, authorised persons and other contact persons of the Contractor:
- first name and surname;
- business email address;
- business telephone number;
- job title / position;
- employer / organisation name;
- department or business unit, where relevant;
- signature;
- data contained in correspondence and contract-related communications;
- any other business contact details or identification data necessary for the negotiation, conclusion, performance, administration or termination of the agreement.
Purposes and legal bases of processing
GÉANT processes personal data for the following purposes:
- Negotiation, conclusion, performance, administration and termination of the agreement with the Controller
This includes preparing, signing, implementing, managing and terminating the agreement, maintaining contact with relevant representatives and contact persons, and ensuring operational cooperation between the parties.
Legal basis: Article 6(1)(f) GDPR, namely GÉANT Association’s legitimate interest in entering into and managing contractual relationships and maintaining the necessary business contacts for that purpose.
Where the data subject is personally a party to the agreement, the legal basis may also be Article 6(1)(b) GDPR. - Compliance with legal and regulatory obligations of the Controller
This includes compliance with obligations relating to accounting, taxation, audit, reporting, record-keeping, sanctions compliance, fraud prevention, and responding to lawful requests from courts, regulators or other public authorities.
Legal basis: Article 6(1)(c) GDPR. - Establishment, exercise or defence of legal claims of the Controller
This includes handling disputes, complaints, investigations and legal proceedings.
Legal basis: Article 6(1)(f) GDPR, namely GÉANT Association’s legitimate interest in protecting its legal rights and interests. - Management of business relationships and communications of the Controller
This includes identifying contact persons, maintaining internal records of cooperation, and ensuring continuity and efficiency in communications relating to the agreement and related activities.
Legal basis: Article 6(1)(f) GDPR, namely GÉANT Association’s legitimate interest in maintaining effective business relationships and communications.
Source of personal data
Personal data may be obtained:
- directly from you;
- from the Contractor (your employer or the company that you are representing);
- from publicly available professional sources, such as organisational websites, directories or professional profiles;
- from correspondence, contractual documentation and other materials exchanged in the course of the contractual relationship.
Recipients of personal data
Personal data may be disclosed, on a need-to-know basis, to:
- authorised employees, officers and contractors of GÉANT Association;
- external advisers, including legal, tax, audit, compliance and insurance advisers;
- IT, hosting, cloud, communication, document management and other service providers acting on behalf of GÉANT Association;
- banks, payment service providers and accounting service providers, where necessary;
- competent public authorities, regulators, courts, law enforcement authorities or other third parties where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.
Transfers to third countries or international organisations
Where necessary for the purposes described above, personal data may be transferred to recipients located outside the European Economic Area. In such cases, GÉANT Association will ensure that appropriate safeguards are in place in accordance with Chapter V GDPR, including, the European Commission’s Standard Contractual Clauses with the Transfer Impact Assessment.
Retention period
Personal data will be retained for no longer than is necessary for the purposes for which it was collected and processed, in particular:
- for the duration of the negotiation and contractual relationship;
- for the period necessary to manage and document the performance and administration of the agreement;
- for the period required under applicable accounting, tax, audit and record-retention laws;
- for the duration of any complaint, dispute or legal proceedings;
- thereafter, for the period necessary to establish, exercise or defend legal claims, in accordance with applicable limitation periods.
Requirement to provide personal data
The provision of personal data is generally necessary for the negotiation, conclusion, performance, administration or termination of the agreement and for maintaining effective business communication between the parties.
If the relevant personal data is not provided, GÉANT may be unable to conclude the agreement, communicate with the relevant persons, or properly perform and administer the contractual relationship.
Rights of the data subject
Subject to the conditions and limitations set out in the GDPR, you have the right to:
- request access to your personal data;
- request rectification of inaccurate or incomplete personal data;
- request erasure of your personal data;
- request restriction of processing;
- object to processing based on Article 6(1)(f) GDPR;
- request data portability, where applicable.
Requests concerning the exercise of these rights may be submitted using the contact details provided above.
Right to lodge a complaint
You have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
Automated decision-making
Your personal data will not be subject to decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.