Privacy notice
- for GÉANT Security Innovation Lab
Within the scope of the GÉANT Security Innovation Lab (Innovation Lab) personal data is processed for various purposes, for which we are providing the following information with respect to Art. 13, 14 GDPR.
The responsible entity for this processing is GÉANT Association, Hoekenrode 3, 1102 BR Amsterdam, Netherlands.
All data subjects can execute their rights as a data subject by contacting GÉANT. Please find more information about contacting GÉANT at https://geant.org/privacy-notice/.
As all processing activities are conducted based on a legitimate interest, data subjects can object to the processing. Please also contact GÉANT for this.
All processing takes place with the EU and UK, with DFN-CERT Services GmbH, Hamburg, Germany being the only processor. There is an adequacy decision based on GDPR Art. 45 for data transfers between the EU and the UK.
Administration of experiments
To conduct the Innovation Lab by running and coordinating experiments, we need to collect and process contact data of project coordinators or representatives.
That data is used to prepare and coordinate experiments and in the aftermath of experiments.
This data may also be shared with other experiments to improve collaboration between experiments. If you do not want your data being shared with other experiments running on the Innovation Lab, please object by reaching out to GÉANT.
Access and user management
In order to grant access to users accessing the platform, we process certain personal data.
This is limited to strictly required data like names, contact data (e.g. email addresses, phone numbers) and security related data (e.g. MFA). This data is only required during preparation and conduct of the project and will be deleted shortly afterwards. This data is not shared outside of the Innovation Lab.
Provision of Services
To make sure that all services are running as intended and to prevent malicious activity, log data is collected and evaluated, including data on access to Innovation Lab facilities. The retention period is 32 days.
We consider IP addresses anonymized, as we usually cannot identify the person which is using a certain IP address.
The legal ground for the processing of log data is a legitimate interest to securely operate the Innovation Lab.
Experiment related processing of personal data
Within each of the experiment running in the Innovation Lab, personal data might be processed to achieve the objective of the experiment. This may include sharing data with third parties, if required for the objective of the experiment.
Responsible for each experiment's personal data processing is the respective experiment's owner. We require each experiment to document processing of personal data and conduct Privacy Impact Assessments in colaboration with a Data Protection Officer to evaluate and reduce the impact on data subjects.
We can not provide more information about the nature of the processing for each experiment, as experiments change frequently. Please use the contact details mentioned above if you like to know more.