Your personal data is collected as part of our relationship management with current and potential future donors:

5.1. Internal recipients
a) The fundraising office;
b) Any other departments of the University on the basis of the need to know principle e.g accounting or Legal department;
c) any other department of the Faculties or Interdisciplinary Research Centers of the University being in contact with the University donors or potential donors.
The internal communication from the fundraising office to the other entities or departments of the University is strictly limited to what is necessary.

5.2. External recipients
a) The Company SFDC Ireland Limited, having its registered office at 1 Central Park, Leopardstown, Dublin 18, Ireland who is providing the Customer Relationship Management Platform called Salesforce as processor in the meaning of the GDPR.

The University and SFDC Ireland concluded a data processing agreement due to the processor qualify of this service provider.

More generally, all third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.

Your Personal Data is mainly processed within the European Union for the different purposes listed in section 2. There are situations when we transfer your data outside of the European Economic Area as our Service Provider of Salesforce (as mentioned in section 5.2) use subcontractors or operates within group entities located outside of the European Union. Appropriate safeguards have been put in place by the University including the conclusion of agreements annexing the standard contractual clauses approved by the European Commission for such transfers and the service provider has implemented Binding Corporate Rules at Group level. For further information on the measures in place, please contact the Data Protection Office.

The University will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for.The retention periods we have defined depend on the purposes of our processing activities.

In particular, the personal data of University donors in relation with your donation agreement will be kept for the time necessary to achieve the purpose and comply with our obligations in tax and accounting matters (10 years from the moment of signature).). The donors’ personal data collected to ensure continued stewardship (newsletter,annual reports etc) will be stored as long as you do not object to the processing.

The retention period is relation with the events is detailed in our dedicated privacy noticy published on the University website and available on Privacy notice related to events management.

The future potential donors’ personal data will be stored as long as you do not object to the processing.

According to the GDPR, you benefit notably from the following rights: right to be informed, right to access to your personal data, right to rectification, right to erasure, right to restrict the scope of the processing, right to object, right to data portability, right to lodge a complaint.

• Right to be informed: you have the right to know how your personal data is collected and used.
• Right to access you have the right to obtain a copy of the personal data we hold about you and to check whether it is lawfully processed.
• Right to rectification: you have the right to request the University to rectify any inaccurate personal data we hold about you.
• Right to erasure: you have the right to obtain from us the erasure of personal data concerning you without undue delay. This right will only apply where, for example, you consider that there is no good reason for us continuing to process it and  your personal data are not necessary for us; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with the Right to object mentioned below).. Note, however, that we may not always be able to comply with your request of erasure for specifical legal reasons which will be notified to you, if applicable at the time of your request.
• Right to restrict the processing: you have the right to suspend the processing of your personal data under certain circumstances (for instance if you want us to establish its accuracy or the reason for processing it).
• Right to object: you have the right to object on grounds relating to your situation, based on points (e) or (f) of Article 6 (1) GDPR.
• Right to data portability: in the instances where the processing is based on your consent and is carried out by automated means, you have the right to receive your personal data and to request the transmission of your data to another party.
• Right to withdraw consent: in the instances where you have consented to the processing, you can withdraw your consent at any time by contacting the relevant department.