Privacy Policy

Introduction

The following policy applies only to the PEP-CV platform (pep-cv@mariecuriealumni.eu). This policy is not applicable to other MCAA websites and platforms. The processing of personal data by the Marie Curie Alumni Association (MCAA), an international non-profit association with a registered address at des Arts 24, 1000 Brussels, Belgium and registered in the Belgian Crossroad Bank of Enterprises under the number 0548.914.288, is governed by this privacy statement.

MCAA data processing operations take place under the responsibility of the MCAA (Av des Arts 24, 1000 Brussels, Belgium, CBE 0548.914.288). MCAA is to be qualified as a “data controller” within the meaning of the EU General Data Protection Regulation 2016/679 (GDPR) concerning the protection of individuals regarding the processing of personal data and the free movement of such data. The MCAA determines the purposes and means of the data processing activities, based on its role, as described in this privacy statement. Unless specified, any reference in this privacy statement to “we”, “us” or “our” consequently refers to the data controller.

The MCAA is responsible as data controller for the contents of the Privacy Statement for the access granted to their staff to personal data processed for the means and purposes they determine. The MCAA, acting Data Controller, have appointed the Data Processors, to process personal data of PEP-CV users in order to i.e. enhance networking among participating researchers, and increase the acceptance, usability, and value of the narrative-style CV.

The processing of personal data described here is governed by the following data protection Regulation:

• The MCAA processes your data under Regulation (EU) 2016/679 also known as the GDPR. The MCAA is responsible for ensuring that the Privacy Statement is made available and kept up-to-date through the PEP-CV website for the processing of personal data concerning the detailed dataset processed by the Data Processors once a new user registers at and creates a profile in the PEP-CV website.

In order to legally cover this processing, the data controller created their own Data Protection Record (DPR). The DPR by the MCAA can be found in the annex of this document.

This privacy statement explains the reason for the processing, the way we collect, handle, and ensure protection of all personal data provided, how that information is used, and what rights you may exercise in relation to your data (the right to access, rectify, block, etc.).

From time to time, we may need to change this Privacy Statement. The MCAA will, in such a case, duly inform you. The most recent version of this Privacy Statement will be at all times available on the PEP-CV website.

Please note that this text is for the reference of the data subjects only and it does not, in any way, restrict the right of the data subjects to address the Data Controller in case of complaint.

Why do we process your data?

The purpose of the PEP-CV platform is to connect individuals working in the research and innovation sector to have mentoring exchanges around the elements of narrative-style CVs, including a broader range of outputs, experiences, and achievements that are a part of research. The platform is open to people from the global research and innovation sector and will help drive forward adoption of narrative-style CVs across research institutions and countries around the world.

The processing of personal data for this purpose is lawful because:

• This processing enables the platform to be a resource for people looking for those with similar outputs, experiences, and achievements to them, to facilitate connections between these people.
• The creation and updating of a personal profile are necessary to make use of the services offered by the platform.
• No other processing of personal data will occur without express consent from a user of the platform.

In addition, your data is processed only after you have been informed of the provisions of this privacy statement, published on the PEP-CV website, and have the chance to read it carefully.

Some processing of personal data may require specific consent from the data subject. This would be the case of the following specific purposes of processing that would be based on consent:

– processing of data in the context of communication and outreach activities in the interest of PEP-CV users (such as cases when PEP-CV users subscribe to a potential mailing list, receive updates, news, exclusive offers, and invitations).

A consent box or banner to obtain the data subject’s consent will be used for these purposes. The data subject will be able to withdraw his or her consent at any time.

What data do we collect and process?

Types of personal data

We may collect the following personal data about you insofar as this information is relevant for the purposes for which it is needed, as explained under title 2 above. At registration, certain information is mandatory and other information is optional, this shall be clearly indicated as such, so that you can choose whether to provide such information.

Identification and contact information	First name, last name, e-mail address, country of residence, and password for the personal profile
Personal characteristics	Birth date, nationality, gender, and any other information disclosed by data subjects
Education	Academic curriculum and degrees
Profession and employment	ORCiD profile link, employer organisation, position within the organisation. Information about professional activities, licences and permits.
Other data	Research experience, a broad range of experiences and outputs from their career, periods of leave, travel and cross-national experiences, grants received, experience with narrative-style CVs, and any other data that the individual user may choose to add to their profile to assist in networking with other users

How do we collect data?

The MCAA collects your personal data directly from you when you provide it by registering on the PEP-CV website and creating and updating your personal profile.

How long do we keep your data?

The data and documents that are filled by a user in forms like the user profile will be retained for as long as PEP-CV exists and for as long as you are a user of the PEP-CV website, or until you decide to leave the platform, whichever occurs first. You can erase your data by leaving the platform. In order to resign, an email must be sent to the platform administrator to request a cancellation of the account – PEP-CV@mariecuriealumni.eu

Afterwards, it is still possible that your data can be found in the PEP-CV back-ups or archives, but they will no longer be actively processed.

As described in art. 17.3 GDPR only where the MCAA is legally obliged to retain your data, or where retention is necessary for defending the MCAA interests in the context of judicial proceedings (e.g. in case of a dispute), your personal data will keep being processed after your resignation, for as long as required for such purposes.

If you want to resign from PEP-CV and for any reason you are unable to log in to your PEP-CV account to resign, you may also send an e-mail message of resignation to: PEP-CV@mariecuriealumni.eu stating your name (under which you registered) and your reasons for wishing to resign.

You may also write to MCAA, c/o Inova+, 24 avenue des Arts, 1000 Brussels, Belgium.

Please note that the termination of your PEP-CV profile eliminates immediately all user rights and privileges. Should you wish to re-join PEP-CV, your length of membership and experience records within the platform would start again at zero.

Who has access to your personal data and to whom is it disclosed?

To some extent, other PEP-CV users will be able to see your basic profile information and other relevant information you chose to make public, but certain information is not visible to other users, in particular your email address, until a mentorship is successfully initiated between a mentor and mentee.

Access to your personal data is granted to the data controller, in compliance with the principle of necessity and data minimization, as well as to the relevant MCAA PEP-CV website and services. Other (sub-) data processors and service providers may also – within the limits of the tasks entrusted to them – process your personal data.

Your data will not be communicated to any other third party unless you provide specific written request / consent for this (e.g. allowing your mentorship data and metrics to be shared with your institution) or in case of (threatened) litigation which requires the disclosure of your personal data to a law firm representing the MCAA (under a professional secrecy obligation) or in case of mandatory disclosure of personal data to government or police authorities or the judiciary (in case of a legal obligation to do so).

Your personal data will only be transferred to countries outside the European Economic Area through active user activity (e.g. beginning a mentorship, a user accessing another profile). The Data Controller will not purposefully transfer your personal data to countries outside the European Economic Area without your consent (through website activity). If the controller would intend to do so, you will be informed thereof, and appropriate legal safeguards will be implemented.

How do we protect and safeguard your information?

The collected personal data is saved on external servers within the EU area, whose owner ensures website security of your personal data. It shall act only on instructions from the MCAA and shall comply with the obligations set out in the EU General Data Protection Regulation (GDPR), and/or Regulation EU 2018/1725 (IDPR) applying to the processing of personal data by the EU institutions and bodies, depending on their applicability.

More information on our protection measures is available upon request.

What are your rights and how can you exercise them?

Within the limits defined by articles 15-22 of the GDPR, you have the following statutory rights:

Right to information and right to access your personal data – You may at any time request more information on our processing activities and your personal data that we are keeping.

Right to rectification of inaccurate or incomplete personal data – You have the right to require us to, without undue delay, rectify or complete any of your personal data that is inaccurate or incomplete.

Right to deletion of your personal data (‘right to be forgotten’) – You may request us to delete (part of) your personal data in the following situations:

– when the processing is no longer necessary for achieving the purposes for which they we collected or otherwise processed these; or

– when the processing was based on your consent, and you have decided to withdraw that consent;

– when you have other reasonable grounds to object to the processing of your personal data;

– when we would unlawfully process your personal data;

– when your personal data has to be erased in compliance with a legal obligation directed to us.

– We note that in some cases, we may refuse to delete your personal data: (i) for exercising the right of freedom of expression and information; (ii) for compliance with a legal obligation; or (iii) for the establishment, exercise or defence of legal claims.

Right to restriction of processing – You may request us to (temporarily) restrict the processing of your personal data in the following situations:

– when you have contested the accuracy of your personal data, for a period enabling us to verify this accuracy; or

– when the processing appears to be unlawful, and you request us the restriction of use of your data instead of the deletion of this data; or

– when we no longer need the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims; or

– pending verification whether our legitimate grounds override yours in the framework of an objection.

Right to object to the processing of your personal data (free of charge) – You may under certain circumstances object to the processing of your personal data. If we agree, we will no longer process your personal data, unless we have compelling legitimate grounds to do so, or because such a process is necessary.

Where we process your personal data for direct marketing purposes (in particular for sending an electronic newsletter) you may at any time object to the processing thereof or withdraw your consent thereto.

Right to data portability – In some cases, you have the right to receive all your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller. This right applies:

– in case the processing is based on consent or on the necessity for the performance of a contract; and

– in case the processing is carried out by automated means.

In addition to the above, you also have the right to opt out of email correspondence from us. 

Right to Opt-in or Opt-out of email communications on ‘Edit your Profile’:

– By becoming a registered member of the PEP-CV Platform, you agree to receiving educational and informational emails from us- these would include correspondence regarding webinars, training, workshop and event-related information. However, if you would like to remain a member at the PEP-CV platform but no longer wish to receive our emails, there is an option to ‘Opt out’ of ‘receiving emails’ simply by making changes in your user profile. 

You can exercise these rights by logging in to the PEP-CV website as a user, then go to your profile page and make use of the ‘Edit profile’ and/or ‘Edit account’ options in the red ‘ACTIONS’ tab on the right of the page. Alternatively, you can also contact the MCAA via: PEP-CV@mariecuriealumni.eu. To totally delete your information, you must resign from the PEP-CV platform; please use the information given above under title 5.

Further information and advice about your rights can also be obtained from the data protection authority in your country. Finally, you also have the right to lodge a complaint relating to the processing of your personal data by us with the data protection authority in your country, which can be found here: https://edpb.europa.eu/about-edpb/board/members_en.

We aim to respond as quickly as possible to your requests or questions. We might request a proof of identity in advance in order to double-check your request.

Contact information

For any questions related to this privacy statement, the processing of your data and your rights, please feel free to contact either one or both joint data controllers, explicitly specifying your request, by:

• using the ‘Contact us’ section of the MCAA website
• Writing to the MCAA at the following address:
  • Postal address: MCAA, 24 avenue des Arts, B-1000 Brussels, Belgium
  • E-mail: PEP-CV@mariecuriealumni.eu
• Contacting the MCAA Data Protection Officer (DPO):
  • Postal address: MCAA, 24 avenue des Arts, B-1000 Brussels, Belgium
  • E-mail: DPO@mariecuriealumni.eu

In case of conflicts with the MCAA, complaints can be addressed to the Belgian Data Protection Authority: https://www.privacycommission.be/

ANNEX 1. Data Protection Record (DPR)

This document contains certain details regarding the processing of Personal Data of the Data Controller as required by the applicable EU Data Protection Legislation.

1. The subject and duration of the processing of Personal Data by the Data Controller

The subject-matter of the processing of Personal Data by the Data Controller is the processing of personal data of PEP-CV users, in order to, inter alia, assess the impact of the programme.

The duration of the Processing of Personal Data by the Data Controller is the duration of the Service Agreement.

2. The nature and purpose of the processing of the Personal Data by the Data Controller

The purpose of the processing of the Personal Data by the Data Controller is to (i) assess the impact of the PEP-CV platform and improve the platform, (ii) arrange mentorships between users of the platform, and (iii) general administration purposes (including the management of users, and of claims or disputes).

3. The categories of Data Subjects to which the Data Controller’s Personal Data relate

People who have signed up voluntarily to the PEP-CV platform.

4. The obligations and rights of the Data Controller

The obligations and rights of the Data Controller are laid down in this Document.