MAPS Task 1.2 eDelphi study
This privacy notices describes how we process your personal data in compliance with data protection legislation. In data protection legislation, the term “data subject” refers to the person whose personal data are processed. In this privacy notice, we refer to data subjects as “you”.
This privacy notice may be updated or edited if necessary. You will be notified of any significant changes as mandated by data protection legislation.
This privacy notice came into force on 15.03.2025.
1. Data Controller
The Data Controller(s) of the research project include multiple organisations:
- Tampere University Foundation sr. (Tampere University)
Business ID: 284451-8
Kalevantie 4 FI-33100 Tampere, Finland - Corvinus University of Budapest
The research project (MAPS Task 1.2) will be conducted as a collaborative project among Data Controllers, with multiple partners jointly determining the purpose and means of processing personal data.
The contact person for questions about data processing is Tampere University’s PI Tuuli Hirvilammi, who can be reached at tuuli.hirvilammi@tuni.fi. To call Tampere University’s switchboard, dial +358 (0) 294 52 11.
If you have general questions about data protection at Tampere University, please email our Data Protection Officer at dpo@tuni.fi.
2. Scope and purpose of data processing
Name of the research project: MAPS (Models, Assessment and Policies of Sustainability), Task 1.2. This is a research project that will last until 31.5.2028.
We will process your personal data as part of a scientific research project. The purpose of processing your personal data is to conduct the research project specified above.
The research project’s eDelphi study in Task 1.2 aims to enrich the current understanding of postgrowth scenarios and policy alternatives with the expert insights. During this research project, personal data will be processed jointly by the joint controllers specified above.
The Principal Investigator (lead researcher) is responsible for overseeing the research project. The research group may also be assigned to serve as the Principal Investigator, with its members participating in conducting the research project.
The research findings, reported in aggregate form so that individual research participants cannot be identified, are intended to the published in relevant scientific journals.
3. Lawful basis for processing personal data
The lawful basis for processing your personal data is:
☐ consent
☐ Data Controller’s legal obligation
☐ vital interests
☒ public interest or the exercise of official authority (scientific research)
In case special categories of personal data (such as health data or criminal offence data) will be processed, the lawful basis for processing is:
☐explicit consent
☐protecting vital interests when the data subject is physically or legally incapable of giving consent.
☐establishing, exercising or defending legal claims
☒ scientific or historical research in the public interest
☐ public interest in the area of public health on the basis of national legislation[1]
☐ other lawful basis that complies with data protection legislation and is specified in national legislation: ___
4. Sources and types of personal data
Depending on the circumstances, we may collect personal data either directly from you or from other sources. We will collect data from:
☒you as the data subject
☐the following regular data sources: ___
We will process the following types of personal data:
General personal data: name, contact details (if provided)
☐ Special category data (sensitive personal data):
☐health data: ___
☐racial or ethnic origin
☒political opinions or religious/philosophical beliefs
☐trade union membership
☐sexual behaviour or orientation
☐genetic data
☐biometric data for unique identification
☐criminal convictions or offences
☐Technical data: ___
☒Other data: questionnaire replies, input during the eDelphi process
We will process data on the following categories of data subjects:
☐employees ☐students ☒research participants ☐research staff ☐others, please specify: ___
5. Transfer and disclosure of personal data
Under certain circumstances, your personal data may be transferred to a third country or an international organisation located outside the European Union (EU) or the European Economic Area (EEA). During such transfers, personal data will be appropriately protected by employing suitable transfer mechanisms (such as standard contractual clauses) and technical measures.
☒Your personal data will not be transferred outside the EU/EEA.
☐ Your personal data will be transferred outside the EU/EEA as follows: ___ Describe the transfer mechanism and the protective measures: ___
☒Your personal data will not be regularly disclosed to other data controllers.
☐Your personal data may be disclosed to other data controllers under data protection legislation as follows: ____
In some cases, your personal data may be processed by data processors with whom we have signed appropriate data processing agreements.
6. Transfer and disclosure of personal data
Your personal data will be protected using appropriate technical and organisational measures. We will protect your data through technical measures, including antivirus software, firewalls and regular software updates. Users who can access personal data are required to log in with a username and password or, in some cases, with multi-factor authentication.
We will also protect your data through organisational measures. Our staff are obligated to maintain confidentiality, and access to data is restricted. If necessary, we will implement additional safeguards to protect data, such as separate storage locations.
Any physical documents will be safeguarded by storing them in locked facilities.
Materials containing personal data will be:
☐pseudonymised
☒stored with personally identifiable information, which is necessary for the following reasons: to be able to analyse differences in experts’ replies representing different scientific backgrounds and stakeholder groups
7. Retention period for personal data
We will retain your personal data for only as long as necessary, as determined on a case-by-case basis. The retention period also depends on the requirements set out in data protection legislation. We will adhere to our Data Management Plan and all applicable legislation when determining the retention period of personal data.
Your personal data will be retained as follows: as long as necessary for the research purposes, maximum 5 years after the research project has ended in 2028.
After the research project has been completed, the research records containing personal data will be:
☐destroyed in their entirety
☒anonymised and archived without personally identifiable information
☐archived with personally identifiable information
8. Profiling and automated decision-making
We will not use your personal data for profiling or automated decision-making purposes.
9. Data subjects’ rights and how to exercise them
Data protection legislation affords certain rights to data subjects, depending on the lawful basis for processing their personal data. Under certain circumstances, your rights may be restricted, for example, due to the Data Controller’s legal obligations or if personal data are processed for scientific research, statistical or archiving purposes. If your rights have been restricted, the Data Controller will implement appropriate and necessary technical and organisational measures to protect your privacy. As a data subject, you have the following rights which you can exercise by contacting our Data Protection Officer at dpo@tuni.fi.
Right of access
You have the right to request confirmation of whether we hold your personal data and to receive a copy of the data we hold.
Right to rectification
You have the right to request that any incorrect or incomplete personal data we hold to be revised or supplemented. You are also entitled to have any unnecessary personal data erased from our records.
Right to restrict processing
You may have the right to restrict the processing of your personal data in certain cases defined by law. For example, this right may apply if you believe the personal data we hold about you is incorrect or that your data are being processed in violation of data protection legislation, or if you have opposed the processing of your data.
Right to object
In certain circumstances, you have the right to object to the processing of personal data on grounds relating to your particular situation.
Right not to be subject to automated decision-making
You have the right not to be subject to decisions based solely on automated processing (such as profiling) that produce legal effects concerning you or otherwise similarly and significantly affect you. However, there are exceptions to this prohibition.
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority (Data Protection Ombudsman), if you believe that the processing of your personal data violates data protection legislation.
Office of the Data Protection Ombudsman
Street address: Lintulahdenkuja 4, FI-00530 Helsinki, Finland
Postal address: PO Box 800, FI-00531 Helsinki, Finland
Switchboard: +358 29 56 66700
Fax: +358 29 56 66735
Email address: tietosuoja@om.fi
[1] This refers to processing that is conducted to ensure the reliability of research, the safety of research participants, or compliance with statutory notification, reporting or archiving obligations.