PRIVACY NOTICE FOR e-COST

  1. Data controller
  2. Who is concerned by this privacy policy
  3. What information about you do we handle?
  4. Why do we handle that information and what is the legal basis for those processings?
    1. Creation of an e-COST profile
    2. When you submit a COST action proposal
      1. Based on your consent (article 6.1.a of GDPR)
      2. Based on the necessity of the data processings for the performance of our tasks carried out in the public interest (article 6.1.e)
    3. When you otherwise participate in the SESA procedure
    4. When you participate in a COST Action
      1. For all COST Action participants
      2. As an Action Management Committee (MC) Member, MC Substitute or MC Observer
      3. As a Grant Holder representative
      4. As an Action Rapporteur
    5. In all of the above-mentioned cases
  5. Do we transfer your data to third parties?
    1. Service providers
    2. COST Members, EU, other States and public entities with whom we collaborate
  6. Do we transfer your data outside the EU/EEA?
  7. How long is the information retained for?
    1. Your e-COST profile
    2. Reimbursement / Honoraria data and related data
    3. Data for Impact of networks and on your career
  8. How do we protect your personal data?
  9. Your rights

1. DATA CONTROLLER

Your personal data are processed by the COST Association, an International not-for-profit Association (AISBL) under Belgian law, registered in Brussels clerk office under n° 0829.090.573.

If you have any queries about the process or how we handle your information please contact us at:

Address: COST Association, Science Administration unit, Avenue Louise 149, 1050 Bruxelles

Email: science.administration@cost.eu

Data Protection Officer: Elodie Cornez, privacy@cost.eu

2. WHO IS CONCERNED BY THIS PRIVACY POLICY?

Every individual having an e-COST profile.

3. WHAT INFORMATION ABOUT YOU DO WE HANDLE?

We can handle the hereunder mentioned personal data that we collect directly from you or via cookies (see cookies policy for e-COST) when you make use of e-COST.

When you participate in a COST Action, we can also receive personal data from the COST National Coordinator (CNC) of the COST Member where your primary institution of affiliation is situated or from the Grant Holder(s) of your COST Action(s).

When filling in an e-COST profile, some data are required as mandatory. Some data however become mandatory to fill in only in cases where you participate in a COST Action, choose to be consulted as an independent External Expert, Action Rapporteur or Review Panel Member in the framework of a selection and evaluation procedure or when you apply for special grants. The data the e-COST profile requires depend on those specific functions/demands.

Identification data
Personal identification data Title, first name, private address, phone numbers, email addresses (personal or professional at your choice).
Electronic identification data User IP address for e-COST signature, cookies.
Financial data
Financial identification data Bank account numbers, honoraria we pay you, expenses and supporting documents.
Personal characteristics
Personal details Age, gender, date and place of birth, citizenship.
Training and studies data
Academic background and professional qualification Degree level, PhD thema, year of start of PhD thesis, date of award PhD, participation in COST trainings ...
Professional data
Professional identification data Position, institution of affiliation (name and address), place of work, scientific field of expertise, research area.
Career Participation and role in COST Actions, your grants (dates, funding agency(ies)), CV, ORCID id, professional webpage if any.

4. WHY DO WE HANDLE THAT INFORMATION AND WHAT IS THE LEGAL BASIS FOR THOSE PROCESSINGS?

The data processings that we conduct are there because either you have consented to them or because they are necessary for performance of our tasks carried out in the public interest as the COST Association was set up by States to execute tasks on their behalf that are better realised by a cooperation body than by those States themselves or because we, our COST Members or your country or institution of affiliation have a legitimate interest to do so or because we have a legal obligation to do so. You can find those reasons and legal bases hereunder:

A. CREATION OF AN e-COST PROFILE

When you create an e-COST profile, we collect your data in the e-COST database based on your consent (article 6.1.a. of the General Data Protection Regulation, GDPR). Your consent is derived from the indubitable motion you make for creating the profile.

During the process of creating your e-COST profile, we ask for your specific consent to be invited and serve as an independent External Expert (iEE) in the Submission, Evaluation, Selection and Approval (SESA) procedure or as Action Rapporteur of a COST Action (based on article 6.1.a) of the GDPR).

B. WHEN YOU SUBMIT A COST ACTION PROPOSAL

When you belong to a network of proposers submitting a COST Action proposal in the framework of the SESA procedure:

We process your contact details and possibly access your e-COST profile when you request support in the use of e-COST.

2. Based on the necessity of the data processings for the performance of our tasks carried out in the public interest (article 6.1.e)

When your proposal is included in the list for possible selection by the COST Scientific Committee (SC),

  1. We transfer your contact details, gender, date or year of birth, year of obtention of PhD and institution of affiliation to the SC members (one per COST Full and Cooperating Member – see https://www.cost.eu/who-we-are/members/) for final selection;
  2. The SC processes those data to select the proposals to be proposed for approval to the COST Committee of Senior Officials (CSO). The selection implies that compliance of your proposal with the COST Excellence and Inclusiveness policy shall be assessed. This process in turns requires to process your data towards:
    • Country of affiliation of your institution (Inclusiveness Target Country or not) for Inclusiveness assessment;
    • Year of obtention of PhD for qualification as Early Career Investigator (ECI);
    • Gender for gender balance.
  3. When your COST Action proposal is successful, we transfer your contact details, gender and institution of affiliation to your CNC for MC nomination purposes.

C. WHEN YOU OTHERWISE PARTICIPATE IN THE SESA PROCEDURE

Based on the necessity of the data processings for the performance of our tasks carried out in the public interest (article 6.1.e), we
  1. If you have consented to be invited and serve as an iEE in the SESA procedure, we process your data in order to invite you for evaluation of proposals that would fall under your area of expertise;
  2. If you have been nominated by a COST National Coordinator (CNC) as a potential Review Panel (RP) member in the SESA procedure, we process your data in order to allocate proposals to appropriate RP members for evaluation of proposals;
  3. When you are invited to act as an independent External Expert (iEE) or a Review Panel (RP) member in the SESA procedure and you accept to do so,
    • your contact details will be transferred to the other iEEs / RP members assigned to the evaluation of the same proposal so that you can communicate among each others in your evaluation tasks. As an iEE, this may imply the transfer of your contact details to the other iEEs evaluating the same proposal based in non-EU/EEA countries or countries not recognised by the EU Commission as offering an adequate level of protection of personal data.
      As a RP member, this may imply the transfer of your contact details to the other RP members in the same Review Panel based in a COST Member being a non-EU/EEA country or country not recognised by the EU Commission as offering an adequate level of protection of personal data.
      Those international transfers are necessary for important reasons of public interests (based on article 49§1.d) of the GDPR). Indeed, COST could not ensure the evaluation of bottom-up proposals without using the expertise of relevant experts, wherever situated in the world. Efficient evaluation requires the involment of multiple evaluators including consensus building among those evaluators, which in turn requires contacts among them.
    • your names will be transferred to the Scientific Committee members together with the consensus and reviewed consensus evaluation report;
    • your data will be processed to pay the honoraria we owe you;
Based on our legitimate interests or those of the COST Members (article 6.1.f of the GDPR),
  1. When you participate in the evaluation process of proposals as RP member, your participation and your name are transferred to your CNC for monitoring of your participation in the SESA procedure.

D. WHEN YOU PARTICIPATE IN A COST ACTION

1. For all COST Action participants

Based on the necessity of the data processings for the performance of our tasks carried out in the public interest (article 6.1.e), we
  1. Process your data in view of your participation (notably guidance in the use of tools, attendance, invitation to workshops, seminars, webinars, special events, mentoring activities…) in the COST Action and to assess whether you are entitled to reimbursements and to special grants (as Early Career Investigator (ECI), as ECI from an Inclusive Target Countries, ...);
  2. Process your contact details to provide you with access to the e-Signature system in e-COST;
  3. Process your claims for reimbursement;
  4. Process your data in order to possibly invite you to participate in COST success stories to be published on COST website;
  5. Transfer, for the purposes of inviting you to events or conferences where your participation could be beneficial, your name and contact details to
    • an EU institution, body, office or agency of the EU; or
    • your CNC or equivalent for Action participants with an institution of affiliation situated in a non-COST Country or in an International Organisation.
Based on your consent (article 6.1.a of the GDPR), we
  1. Transfer, for the purposes of inviting you to events or conferences where your participation could be beneficial, your name and contact details to stakeholders of COST.
Based on our legitimate interests or those of the COST Members (article 6.1.f of the GDPR), we
  1. Process your data for monitoring purposes of :
    • Quality of management of COST Actions and quality of COST Actions activities;
    • Your participation in COST Action as MC member. In this regard, your participation and your name are transferred to your CNC;
For compliance with legal obligations to which we are subject (article 6.1.(c) of the GDPR):
  1. Your data are processed for accounting and audit purposes.
  2. When we pay you honoraria, your data are processed and transferred to Belgian authorities with regard to fiscal obligations.

2. As an Action Management Committee (MC) Member, MC Substitute or MC Observer

Based on the necessity of the data processing for the performance of our tasks carried out in the public interest (article 6.1.e), we

Publish, on the COST website, your contact details and your position as MC member, substitute or observer in the COST Action so that you can be contacted by researchers and other interested stakeholders with regard to that COST Action.

3. As a Grant Holder representative

Based on the necessity of the data processing for the performance of our tasks carried out in the public interest (article 6.1.e),

When your institution is elected as Grant Holder of a COST Action and you occupy a relevant function in this regard as stated in COST Vademecum (see https://www.cost.eu/Vademecum), we process your data for conclusion of the COST Action Grant Agreement.

4. As an Action Rapporteur

Based on the necessity of the data processings for the performance of our tasks carried out in the public interest (article 6.1.e), we
  1. If you have consented to be invited and serve as an Action Rapporteur in the monitoring and assessment of a COST Action, we process your data in order to allocate Action to appropriate Action Rapporteur for monitoring and assessment purposes;
  2. Process your data to pay the honoraria we owe you.

E. IN ALL OF THE ABOVE-MENTIONED CASES

Based on our legitimate interests or those of the COST Members (article 6.1.f of the GDPR), we
  1. Process your data in the framework of our impact assessment purposes (impact of networks, i.e. the COST Actions, and impact on your career) and reporting obligations towards the COST Members and our public funders, statistics, financial reports, audit obligations. With regard to statistics, anonymised results can be transferred to our funders and COST Members that may in turn use the results to carry out their tasks in the public interest;
  2. In order for COST to demonstrate impact, we post publications, photos, videos on the COST website (success stories…) where you can appear. Your consent is then sought through additional means (special authorisation document or checkbox).

5. DO WE TRANSFER YOUR DATA TO THIRD PARTIES?

A. SERVICE PROVIDERS

We have recourse to service providers in order to support us in, amongst others, the following services:

  • Grant Holders, to administer the Grant of the COST Action in which you participate;
  • Local Organisers via the Grant Holders for the organisation of conferences events, meetings in the remit of the COST Action;
  • Academic collaborators and contractors, to support COST Association in impact analysis in different forms (surveys, data analysis,…);
  • Technical providers, for e-COST hosting and related services (e-Signature).

Those service providers otherwise referred to as data processors are third parties who provide elements of support to COST Association. We have contracts in place with our data processors which exclude the transfer of personal data to a third country or international organisation. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

B. COST MEMBERS, EU, OTHER STATES AND PUBLIC ENTITIES WITH WHOM WE COLLABORATE

As mentioned above, we can also transfer your names and contact details to the EU, COST Members, non-COST countries or public or semi-public entities with whom we collaborate, for the purposes of inviting you to events or conferences where your participation could be beneficial. In those cases, we limit transfers of your personal data outside the EU / EEA or to States not offering an appropriate level of data protection (see hereunder) to data originating from the country where the data are transferred and no sensitive or highly personal data are transferred.

6. DO WE TRANSFER YOUR DATA OUTSIDE THE EU/EEA?

COST is an intergovernmental framework with States as Members. Some of our Members are neither belonging to the EU nor to the EEA and do not benefit from an adequacy decision from the European Commission (for the list of countries benefitting from an adequacy decision, see here).

With those COST Members where we transfer data in the framework of the SESA procedure or for the management of a COST Action (see above for the details of those transfers), we are in the process of concluding bilateral agreements built on the Standard provisions of the European Commission. Once concluded, those agreements will be posted on our website.

Further, when a Grant Holder is situated in one of those COST Members, the Action Grant Agreement contains specific provisions regarding privacy that are also built on the Standard provisions of the European Commission (to see the Action Grant Agreement of your COST Action, refer to https://www.cost.eu/COST_Actions and your COST Action).

Under those agreements, transferred personal data may only be used for the purposes of COST (see our mission statement, COST Statutes and the SESA procedure) or for statistical or reporting purposes or for inviting you to events, conferences or activities in correlation with COST.

COST also has an international policy with potential participation of researchers, engineers and scholars from universities, research centres, companies, as well as other relevant stakeholders from possibly all over the world and from International Organisations to COST Actions. No personal data from Action participants from COST Members are transferred to non-COST countries on a regular basis whilst this may happen occasionally (e.g. if you participate in an event in a non-COST Country). However, contact details of Action participants with an institution of affiliation situated in a non-COST Country or in an International Organisation can be transferred to the COST point of contact in their country of origin (legal basis: important reasons of public interests (based on article 49§1.d) of the GDPR).

7. HOW LONG IS THE INFORMATION RETAINED FOR?

A. YOUR e-COST PROFILE

  1. Your e-COST profile will continue to exist as long as you or your successors or assignees do not require its erasure.
  2. However, for accounts that have been inactive for more than 2 years, we will require from you confirmation whether you want to keep your account or not. Without confirmation in a delay of 1 months, the relevant data of your e-COST profile will be archived for the duration required for us to comply with our audit obligations or reporting obligations towards our COST Members. Once that duration has passed, we will anonymize your e-COST profile and archive relevant data for statistical and historical purposes.
    In order to avoid an unfortunate loss of your e-COST profile, we therefore recommend you to also include (as additional email address) in your e-COST profile a permanently valid email address.

B. REIMBURSEMENT / HONORARIA DATA AND RELATED DATA

When we have reimbursed your expenses or paid to you honoraria in the framework of your participation to COST in a COST Action or in a position for the SESA procedure or management or monitoring of a COST Action, we will retain your data for the period where we are subject to audit under Belgian law or under our Framework Agreement with the European Commission. To calculate this period, the following elements have to be clarified:

  • With regard to Belgian law, we are bound to keep data for audit purposes for a period of 7 years as of 1st of January of the year following the closing of the accounting period (1 May – 30 April) within which those data have been collected.
  • In order to comply with our audit obligation with regard to our Framework Agreement with the European Commission, we retain the data for audit purposes for the duration of our Framework Partnership Agreement (currently 2014-2021) plus 3 years should we face no audit (the audit can start up to two years after validation by the European Commission of the Final Financial Report for the Programme (COST).
  • Should we be audited with regard to the Framework Agreement where your Action was funded, then, those data need to be kept until the end of the audit.

As a conclusion, your personal data that we need to keep for audit purposes (reimbursement of expenses, justification of those expenses, honoraria,…) will be kept for the longest of the three durations above. This exact duration will depend on the date creation of the data and on events that we cannot define in advance (such as audits).

C. DATA FOR IMPACT OF NETWORKS AND ON YOUR CAREER

COST Association is publicly funded and was set up by COST Members to be devoted to the promotion, organisation, management and funding of practical support functions for the European Cooperation in Science and Technology. COST has therefore an obligation to demonstrate the impact of networks it funds and impact on your career as participants to COST activities. In order to do so, we keep your personal data (Personal identification data, gender and year of birth, Academic background and professional qualification, Professional identification data and career data) for impact assessment for a duration of 10 years after the end of your last participation in a COST activity favouring networking.

For the specific case of assessing impact on your career of participation in a leadership role, we will retain the above-mentioned data for the duration of your career when you occupied a leadership position in a COST Action or participated in a COST Academy leadership workshop.

8. HOW DO WE PROTECT YOUR PERSONAL DATA?

Your personal data are handled in full confidentiality. We make all necessary effort to take technical and organisational measures that might be required so as to ensure security of your personal data.

9. YOUR RIGHTS

Under the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), you have rights as an individual which you can exercise in relation to the information we hold about you:

  • right to request access to your data and rectification of your personal data. Please note you can at all time rectify directly yourself all the data you have provided when creating e-COST profile;
  • right to request erasure of your data (right to be forgotten) in the cases described in article 17 of the GDPR;
  • right to obtain from us restriction of processing where there is contestation about the data processing for a period enabling to solve the issue;
  • right to data portability;
  • where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Withdrawing your consent means that we will not make use of your data anylonger. However, use made of your data in the past remains valid.

Your right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on our legitimate interests (Article 6(1), (f) of the GDPR) as mentioned above.

To exercise those rights, please send us an email to privacy@cost.eu together with a proof of your identity or write us to the following address: COST Association, Privacy department, Avenue Louise 149, 1050 Brussels, Belgium.

Please note that you always have the right to lodge a complaint with the Belgian Privacy Commission at commission@privacycommission.be.

This Privacy Notice was last updated on 2 May 2018.