Personal data

Villum Foundation (the "Foundation") takes processing of your personal data seriously. We ensure reasonable and transparent processing in accordance with the current rules on processing of personal data. Under the General Data Protection Regulation (GDPR), the Foundation is obligated to inform the data subjects how the Foundation processes the personal data collected and registered about the data subjects. 

This document describes how the Foundation processes your personal data as a grant applicant.

Villum Foundation, company registration no. (CVR) 44720515, is the data controller regarding the processing of your personal information. 

The Foundation’s address is Tobaksvejen 10, DK-2860 Søborg. 

The Foundation may be contacted by e-mail at info@villumfonden.dk. 

The Foundation will in general not disclose your personal data to third parties. However, personal data may be disclosed or passed on to the following categories of recipients in accordance with the purposes stated in section 4:

• IT suppliers
• External assessors (peer reviewers), panel participants and members of working groups under the Foundation’s board of directors
• VELUX FONDEN, if we consider that your application has a better chance of receiving a grant under that foundation, as well as for the purpose of administration
• Other grantees, if you participate in professional networks and similar events, where lists of participants with name, title and place of employment are shared
• The Danish tax authorities (SKAT), foundation authorities and other relevant authorities that are entitled to receive the personal data
• Public authorities and private organisations, including Statistics Denmark, when disclosure is necessary in order for the Foundation or recipient to pursue a legitimate interest, e.g. to perform a task in the public interest
• Researchers, research institutions and similar for scientific or historical research purposes or statistical purposes
• Social media, e.g. Facebook, LinkedIn, Vimeo and X, including images and video recordings of you if we have received your consent
• Attorneys, auditors and other consultants engaged by the Foundation

If the recipients act as data processors, the Foundation has entered into a data processing agreement with them. 

Furthermore, information about grant recipients will be published on the Foundation's website, www.villumfonden.dk, as described in section 4. Disclosure will take place in accordance with data protection regulations.

The purposes of processing of your personal data are:

• Evaluation of your application for potential grant allocation. The Foundation has a legitimate interest in processing and assessing received applications. The legal basis for the processing is Article 6(1)(b) and (f) of the GDPR.
   
• Allocation and administration of a grant, including the potential establishment of a grant agreement and its administration. The Foundation has a legitimate interest in managing a grant agreement, including the ability to establish, assert, or defend any legal claims. The legal basis for the processing is Article 6, paragraph 1, letter b if a grant agreement is entered, or Article 6, paragraph 1, letter f of the General Data Protection Regulation.
   
• Compliance with current legislation, including, in particular, declarations of grants to the tax and foundation authorities. The legal basis for the processing is Article 6(1)(c) of the GDPR, including, in particular, tax legislation, the Act on foundations and certain associations and section 11(2), no. 3 of the Danish Data Protection Act (processing of civil registration numbers).
   
• Inclusion of your data in the Foundation’s register of supported projects on www.villumfonden.dk. The register displays data on projects supported by the Foundation with the aim of creating transparency for future applicants and other stakeholders, as well as providing insight into which projects have been granted support. The processing is based on a legitimate societal interest in creating this transparency, as well as the opportunity for potential applicants to gain insight and information about previously supported projects. The legal basis is Article 6, paragraph 1, letters e and f of the General Data Protection Regulation. Furthermore, we assess that the publication, in consideration of freedom of expression and information, is covered by the Data Protection Act § 3, paragraph 1.
   
• Inclusion of your data in an internal register of applications and supported projects. The Foundation's legitimate interest is to have an overview of which projects are granted support, to differentiate and manage grants, provide guidance to new and previous applicants, and general administration purposes. The legal basis for the processing is Article 6, paragraph 1, letter b if we have entered into a grant agreement, or Article 6, paragraph 1, letter f of the General Data Protection Regulation.
   
• Evaluation of grants and rejections, use and disclosure of data for statistical, research, and historical purposes, as well as for the pursuit of legitimate societal interests. This includes the processing of information that may have been obtained from or compiled with publicly available sources, such as Statistics Denmark or international publication databases, for these purposes. The Foundation has a legitimate interest in evaluating its grant activities and, as part of this, sending surveys or invitations for qualitative interviews, including the processing of the information collected through these means. The Foundation also has a legitimate interest in using data about its activities for the stated purposes. The legal basis for the processing is Article 6, paragraph 1, letters e and f of the General Data Protection Regulation, and for personal identification numbers (CPR no.), the Danish Data Protection Act § 11, paragraph 2, no. 3 (L 2018-05-23 no. 502, Data Protection Act).
   
• Sending invitations to events and activities of professional relevance, such as networking meetings or workshops with other grant recipients. For this purpose, we process your personal information, including email address and name. The processing is based on our legitimate interest in strengthening and supporting grant recipients and supported projects, in accordance with Article 6, paragraph 1, letter f of the General Data Protection Regulation.
   
• Publication of your name, title, professional background, and information about your project and granted support on www.villumfonden.dk, and posts on social media platforms such as Facebook, LinkedIn, Vimeo, and X. The legal basis is a legitimate interest in raising awareness about the Foundation's grant activities and attracting other qualified applicants, in accordance with Article 6, paragraph 1, letter f of the General Data Protection Regulation.
   
• Sending newsletters, which may include inspiration for other grant opportunities you could apply for. For this purpose, we process your personal information, including email address and name. The processing is based on our legitimate interest in receiving as many qualified grant applications as possible, in accordance with Article 6, paragraph 1, letter f of the General Data Protection Regulation. You can unsubscribe from the newsletter at any time by writing to info@villumfonden.dk.
   
• Processing of images and video recordings of you, along with explanatory text, if you have given your consent, on www.villumfonden.dk, on social media platforms such as Facebook, LinkedIn, Vimeo and X, as well as in the Foundation's annual report or other printed promotional materials, for the purpose of providing information about the foundation. The legal basis for the processing is your consent, in accordance with Article 6, paragraph 1, letter a of the General Data Protection Regulation.

The Foundation further processes your personal data for the purpose of updating the information registered about you. This may be e.g. your title, telephone number or e-mail address. We kindly ask you to contact us if your information needs to be updated.

The Foundation will in general not disclose your personal data to third parties. However, personal data may be disclosed or passed on to the following categories of recipients in accordance with the purposes stated in section 4:

• IT suppliers
• External assessors (peer reviewers), panel participants and members of working groups under the Foundation’s board of directors
• VELUX FONDEN, if we consider that your application has a better chance of receiving a grant under that foundation, as well as for the purpose of administration
• Other grantees, if you participate in professional networks and similar events, where lists of participants with name, title and place of employment are shared
• The Danish tax authorities (SKAT), foundation authorities and other relevant authorities that are entitled to receive the personal data
• Public authorities and private organisations, including Statistics Denmark, when disclosure is necessary in order for the Foundation or recipient to pursue a legitimate interest, e.g. to perform a task in the public interest
• Researchers, research institutions and similar for scientific or historical research purposes or statistical purposes
• Social media, e.g. Facebook, LinkedIn, Vimeo and X, including images and video recordings of you if we have received your consent
• Attorneys, auditors and other consultants engaged by the Foundation

If the recipients act as data processors, the Foundation has entered into a data processing agreement with them. 

Furthermore, information about grant recipients will be published on the Foundation's website, www.villumfonden.dk, as described in section 4. Disclosure will take place in accordance with data protection regulations.

The personal data you submit to the Foundation will be stored as a minimum until a decision has been made on your application, and thereafter based on the following criteria: 

If your project receives a grant, the Foundation will keep your information until the project is completed, and after that for as long and to the extent that the Foundation has a legitimate and justifiable reason for this. Your information, including name, gender, age, civil registration number, nationality, title, place of employment if required, address, telephone number, e-mail, researcher ID (ORCID) if required, CV if required, project title, your application and an assessment thereof, as well as any agreement (grant letter), will be included in our internal register of applications and supported projects. 

The basis for the storage depends on the purposes listed under section 4, and includes in particular the foundation’s interest in obtaining a balanced allotment of grants, evaluating the effect of the grants allotted, as well as using data for scientific or historical research purposes or for statistical purposes. 

Information relevant for bookkeeping purposes will be stored for five years and in the current accounting period after the project has been completed.

If the Foundation decides to allot a grant based on your application, information about your name, project title, place of employment and participation in the project and picture, if you have given your consent to publication thereof, will be included in the Foundation’s register of supported projects that is publicly available at www.villumfonden.dk. We assess that this publication – in consideration of freedom of expression and information – is covered by section 3(1) of the Data Protection Act, and the information will therefore remain public on the Foundation’s website indefinitely. 

If your project does not receive a grant, your information, including name, gender, age, civil registration number, nationality, title, place of employment if required, address, telephone number, e-mail, researcher ID (ORCID) if required, CV if required, project title, your application and an assessment thereof, as well as any agreement (grant letter), will be included in our internal register of applications received. 

The Foundation will store your information for as long and to the extent that the Foundation has a legitimate and justifiable reason for this in accordance with the purposes listed under section 4, which includes in particular the Foundation’s interest in obtaining a balanced allotment of grants and in providing the best possible service and guidance to former applicants, evaluating the effect of the grants allotted, as well as using data for scientific or historical research purposes or for statistical purposes. 

The Foundation will conduct periodic reviews to ensure that we do not store data that is not necessary for the purposes stated.

Your data may be transferred to external assessors (peer reviewers), panel participants and members of working groups under the Foundation’s board of directors in countries outside the EU/EEA, which do not uphold the same legal standards of protection of personal data as within the EU/EEA. In addition, data may be transferred to other third parties in countries outside the EU/EEA, cf. section 5, e.g. to IT suppliers and consultants.

If a transfer to a third country takes place, the Foundation will ensure an adequate legal basis, generally by way of the EU Commission’s standard contractual clauses or Article 49(1)(b) or (c) of the GDPR. You may receive a copy of the basis for any transfers by contacting the Foundation, see the contact details under section 2.   

As part of the processing of your personal data, data will be stored on servers situated within the EU, but data stored in the cloud solution Salesforce may be stored via a backup in the United States at Salesforce. The transfer to Salesforce is based on the Commission's standard contractual provisions and binding corporate rules. 

For more information, see Salesforce’s website.

If the Foundation shares information about grant activities on social media, e.g. Facebook, LinkedIn, Vimeo and X, data such as your name, title and professional background, as well as information about your project and grants will be transferred to the United States. The same applies to pictures and video recordings of you, if you have consented to the Foundation’s use of these on social media. The basis for the transfer is the EU Commission's standard contractual clauses. For more information, see the following links:

• Facebook privacy 
• LinkedIn privacy
• Vimeo privacy 
• X privacy 

If you wish to exercise the below rights, please contact the Foundation using the contact details stated in section 2 of the privacy policy. 

• Right to access: You are entitled to obtain access to the personal data processed about you and various additional data. However, the right of access should not adversely affect the rights or freedoms of others.
   
• Right to rectification: You are entitled to have incorrect personal data about you rectified.
   
• Right to erasure: In some cases, you are entitled to have personal data about you erased before our usual general erasure takes place.
   
• Right to restriction of processing: In certain situations, you are entitled to have the processing of your personal data restricted. If you are entitled to restricted processing, we may only process your personal data - except for storage - with your consent or for the purpose of establishing, exercising or defending a legal claim or to protect a person or important public interests.
   
• Right to transmit data (data portability): You are entitled to data portability if our processing of your personal data is based on your consent or a contract, and the processing has taken place automatically. This right implies that you are entitled to have your personal data forwarded in a structured, generally applied and machine-readable format which you are entitled to transfer to another controller.
   
• Right to object: If we base our processing on Article 6(1)(e) or (f) of the GDPR, you are in certain cases entitled to object to our otherwise lawful processing of your personal data. 
   
• Right to withdraw consent: If our processing is based on your consent, you are entitled to withdraw your consent to our processing of your personal data wholly or partly at any time. The withdrawal of your consent will not affect the lawfulness of the processing made by us until you withdraw your consent. Withdrawal of your consent will thus only be valid from that point in time.

Your requests will be processed in accordance with the data protection rules, and conditions or restrictions may apply. For more information on your rights, see the Danish Data Protection Agency’s guidelines describing the data subject’s rights at www.datatilsynet.dk. If you exercise either of the above rights, we will also process personal data about you in connection with the receipt of and response to the inquiry.

You may complain to the Data Protection Agency at any time about the Foundation’s processing of your personal data. Contact details are available at www.datatilsynet.dk.

We update our privacy policy regularly, and most recently 9 November 2023.