Personal Data

The VELUX FONDEN ("the foundation") takes the processing of your personal information seriously. We ensure fair and transparent processing in accordance with applicable rules on the processing of personal data. The foundation, in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), is obligated to inform individuals about how the foundation processes the personal information collected and recorded about them.

This privacy policy provides information on how the foundation processes your personal information as a grant applicant.

VELUX FONDEN, VAT no. 61023917, is the data controller in relation to the processing of your personal information. The foundation's address is Tobaksvejen 10, 2860 Søborg.

You can contact the foundation via email at info@veluxfonden.dk.

We process the following general personal information about you:

• Name, title, address, phone number, email, gender, age, and nationality
• Possibly researcher ID (ORCID)
• Application and CV
• CPR number
• Information for the purpose of disbursing support (bank details)
• Any feedback on the results of projects that have received support, as well as projects that have not received support
• Other personal information that may be disclosed in or in relation to your application

We kindly ask you not to include sensitive personal information in the application, such as health-related details or religious beliefs.

The information is primarily collected from you through the foundation's application portal. If there are multiple applicants for the same application, information about co-applicants will be collected from the applicant who submits the application via the foundation's application portal.

In connection with the assessment of the application and for research and statistics related to the evaluation of the foundation's programs, the foundation may obtain additional information about you if we deem it relevant and necessary:

• Publicly available personal information
• Personal information from Statistics Denmark
• Personal information from international publication databases

Additionally, we process images and video recordings of you if we receive your consent. These images and videos are usually taken by the foundation or possibly by an external photographer.

The purpose of processing your personal information is:

• Evaluation of your application for possible grant allocation. The foundation has a legitimate interest in processing and assessing received applications for the purpose of granting or rejecting support. The legal basis for this processing is Article 6(1)(b) and/or (f) of the General Data Protection Regulation.
   
• Allocation and administration of the grant, including the potential conclusion of a support agreement and its administration. The foundation has a legitimate interest in managing a potential support agreement, including the ability to establish, assert, or defend any legal claims. The legal basis for this processing is Article 6(1)(b) if an agreement for support is concluded, or Article 6(1)(f) of the General Data Protection Regulation.
   
• Compliance with applicable legislation, including, in particular, reporting to tax and foundation authorities regarding support. The legal basis for this processing is Article 6(1)(c) of the General Data Protection Regulation, especially in accordance with tax legislation, the law on foundations and certain associations, and Section 11(2), Nos. 1 and 3, of the Data Protection Act (processing of CPR numbers).
   
• Inclusion in the foundation's register of supported projects on www.veluxfonden.dk. The register displays data about projects supported by the foundation with the aim of creating transparency for future applicants and other stakeholders, as well as providing insight into which projects have received support. The processing is based on a legitimate societal interest in creating this transparency, as well as the opportunity for potential applicants to gain insight and information about previously supported projects. The legal basis is Article 6(1)(e) and (f) of the General Data Protection Regulation. Additionally, we assess that the publication is covered by Section 3(1) of the Data Protection Act regarding freedom of expression and information.
   
• Inclusion in an internal list of applications and supported projects. The foundation's legitimate interest is to have an overview of which projects are granted support, to differentiate and manage grants, provide guidance to new and previous applicants, and handle other administrative tasks. The legal basis for the processing is Article 6(1)(b) if an agreement for support has been entered into, or Article 6(1)(f) of the General Data Protection Regulation.
   
• Evaluation of granted support and rejections, use, and disclosure of data for statistical, research, and historical purposes, as well as pursuing legitimate societal interests. This includes the processing of information that may have been obtained from or compiled with publicly available sources, such as Danmarks Statistik or international publication databases, for these purposes. The foundation has a legitimate interest in evaluating its distribution activities, sending questionnaires or invitations to qualitative interviews, and processing the collected information. The legal basis for the processing is Article 6(1)(e) and (f) of the General Data Protection Regulation, and for the CPR number, the Data Protection Act's § 11(2), no. 3 (Act no. 502 of May 23, 2018 on Data Protection).
   
• Sending invitations to events and activities of professional relevance, such as network meetings or workshops with other grant recipients. For this purpose, we process your personal information, including email address and name. The processing is based on our legitimate interest in strengthening and supporting grant recipients and supported projects, in accordance with Article 6(1)(f) of the General Data Protection Regulation.
   
• Public disclosure of your name, title, professional background, as well as information about your project and granted funding on www.veluxfonden.dk and posts on social media, such as Facebook, LinkedIn, Vimeo, and X. The legal basis is a legitimate interest in raising awareness about the foundation's grant activities and attracting other qualified applicants, in accordance with Article 6(1)(f) of the General Data Protection Regulation.
   
• Sending newsletters, which may include inspiration for other foundation funds you could apply for. For this purpose, we process your personal information, including email address and name. The processing is based on our legitimate interest in obtaining as many qualified applications for foundation funds as possible, in accordance with Article 6(1)(f) of the General Data Protection Regulation. You can unsubscribe from the newsletter at any time by writing to info@veluxfonden.dk.
   
• Processing of images and videos of you, along with explanatory text if you have given your consent, on www.veluxfonden.dk, on social media platforms such as Facebook, LinkedIn, Vimeo, and X, as well as in the foundation's annual report or other printed profile materials, for the purpose of providing information about the foundation. The legal basis for this processing is your consent, as per Article 6, paragraph 1, point (a) of the General Data Protection Regulation (GDPR).

Additionally, the foundation processes your personal information to update the registered information about you. This could include details such as title, phone number, or email address. Therefore, we ask you to contact us if your information needs to be updated.

The foundation generally does not disclose your personal information to third parties. However, with reference to the purposes mentioned in section 4, disclosure or transfer of personal information may occur to the following categories of recipients:

• IT suppliers
• External assessors (experts), panel participants, and members of working groups under the foundation's boards
• Villum Foundation, if we assess that your application has a better chance of receiving support there, and for administrative purposes
• Other grant recipients in connection with participation in professional networks and similar, where participant lists are shared, including names, titles, email addresses, and/or places of employment
• Tax authorities, foundation authorities, and other relevant authorities entitled to receive the personal information
• Public authorities and private organizations, including Statistics Denmark, when disclosure is necessary for the foundation or the recipient to pursue a legitimate interest, such as performing a task in the public interest
• Researchers, research institutions, and similar for scientific or historical research purposes or statistical purposes
• Social media, such as Facebook, LinkedIn, Vimeo, and X, including possibly with pictures or films of you if we have obtained your consent
• Lawyers, auditors, and other consultants engaged by the foundation

If the recipients act as data processors, the foundation has entered into a data processing agreement with them. Additionally, information about grant recipients will be published on the foundation's website, www.veluxfonden.dk, as described in section 4. Disclosure will comply with data protection regulations.

The personal information you provide to the foundation will be retained at least until a decision is made regarding your application and then based on the following criteria:

If your project is awarded funding, the foundation will keep your information for a minimum period until the project is completed, and thereafter as long as and to the extent the foundation has a lawful basis for doing so. Your information, including name, gender, age, CPR number, nationality, title, any employment information, address, phone number, email, possible researcher ID (ORCID), possible CV, project title, your application and an assessment of it, and any agreement for support/grant letter, will be included in the foundation's internal list of applications and supported projects.

The basis for further retention depends on the purposes stated in section 4, including the foundation's interest in ensuring differentiation of support, evaluating projects and support effectiveness, as well as for statistics, research, and historical purposes. The foundation will periodically review data to ensure that we do not retain information that is not necessary for these purposes.

Accounting-relevant information will be kept for 5 years plus the current accounting period after the completion of a project.

If your application is approved, your name, project title, any employment information, and participation in the project that has been awarded support, as well as a picture if you have given us consent to publish it, will also be kept in the foundation's list of supported projects, publicly available on www.veluxfonden.dk. We consider this publication, for the sake of freedom of expression and information, to be covered by the Data Protection Act § 3, paragraph 1, and the information will therefore remain published on the foundation's website without a time limit.

If your project is not awarded funding, your information will be included in the foundation's internal list of received applications, including your name, gender, age, CPR number, nationality, title, any employment information, address, phone number, email, possible researcher ID (ORCID), possible CV, project title, and your application and an assessment of it.

The information will be kept for as long as and to the extent the foundation has a lawful basis for doing so, depending on the purposes stated in section 4, including the foundation's ability to provide the best possible guidance to applicants who have previously been rejected, the foundation's interest in ensuring differentiation of support, evaluating projects and support effectiveness, as well as for statistics, research, and historical purposes.

The foundation will periodically review data to ensure that we do not retain information that is not necessary for these purposes.

The foundation may choose to transfer data to external assessors (experts), panel participants, and members of working groups under the foundation's boards in countries outside the EU/EEA, where the same legal level of data protection is not provided as within the EU/EEA. In addition, transfer to other third parties in countries outside the EU/EEA, as mentioned in section 5, may occur, including to IT suppliers and consultants.

If such a transfer occurs, the foundation will ensure a proper transfer basis, primarily in the form of the EU Commission's standard contractual clauses or Article 49(1)(b) or (c) of the Data Protection Regulation. You can receive a copy of the basis for any transfer by contacting the foundation, see the contact details in section 2.

As part of the processing of your personal information, information is stored on servers located in the EU. However, information stored in the Salesforce cloud solution may be backed up in the USA with Salesforce. The transfer to Salesforce is based on the EU Commission's standard contractual clauses and binding corporate rules. You can read more about this on Salesforce's website: https://www.salesforce.com/privacy/regions/?d=cta-body-promo-5.

If the foundation uses the option to share information about grant activities on social media, such as Facebook, LinkedIn, Vimeo, and X, data in the form of your name, title, professional background, as well as information about your project and the grant received, will be transferred to the USA. The same applies to pictures and videos featuring you, provided you have given consent for the foundation to use them on social media. The transfer basis is the EU Commission's standard contractual clauses. You can find more information on the following pages:

• Facebook: https://www.facebook.com/privacy/explanation
• LinkedIn: https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=da
• Vimeo: https://vimeo.com/privacy
• X: https://twitter.com/en/privacy

If you wish to exercise the rights below, please contact the foundation using the contact information provided in section 2.

• Right to access: You have the right to obtain access to the personal data we process about you, along with additional information. However, access to information must not infringe on the rights and freedoms of others.
• Right to rectification: You have the right to have incorrect personal data about yourself corrected.
• Right to erasure of personal data: In some cases, you have the right to have information about you deleted before our usual general deletion period.
• Right to restriction of processing: In certain cases, you have the right to have the processing of your personal data restricted. If you have the right to restrict processing, we may only process the information, except for storage, with your consent or for the establishment, exercise, or defense of legal claims, or to protect a person or important societal interests.
• Right to data portability: When our processing of your personal data is based on consent or a contract and the processing is carried out by automated means, you have the right to data portability. This right means that you have the right to receive the personal data we process about you in a structured, commonly used, and machine-readable format that you have the right to transmit to another data controller.
• Right to object: If we base our processing on Article 6(1)(e) or (f) of the Data Protection Regulation, you have, in certain cases, the right to object to our otherwise lawful processing of your personal data.
• Right to withdraw consent: If we base our processing on your consent, you have the right to withdraw your consent to our processing of your personal data at any time. The withdrawal of your consent only takes effect from the time we become aware of the withdrawal and does not affect the legality of the processing we have carried out prior to that time.

Your requests will be processed in accordance with data protection rules and may be subject to conditions or limitations. You can find more information about your rights in the Danish Data Protection Agency's guide on the rights of data subjects, available at www.datatilsynet.dk. If you exercise any of the above rights, we will also process personal data about you in connection with receiving and responding to your request.

You can always file a complaint with the Danish Data Protection Agency regarding the foundation's processing of your personal data. Contact information can be found at www.datatilsynet.dk.

This privacy policy is updated regularly and was last updated on November 9, 2023.