DATA CONTROLLER

The Gulbenkian Institute for Molecular Medicine Foundation (“GIMM” or “Data Controller”), a private non-profit association, NIPC 517706156, with its registered office at Avenida Professor Egas Moniz, Edifício Egas Moniz, 1649-028 Lisboa, is the Data Controller of the personal data of users of the https://gimm.pt website (“data subjects”).

The purpose of this privacy policy is to provide information to data subjects on how their personal data is collected and processed by GIMM, as well as the rights that data subjects have and how they can exercise them.

Data is collected directly from the data subject. 

Various types of personal data may be collected for the purposes described in the table below, based on the appropriate legal basis.

Personal Data	Processing Purposes	Legal basis
Identification data: e-mail address	Sending a newsletter	consent of the data subject.

COMMUNICATION OF PERSONAL DATA

For the purpose of sending communications – Newsletter – the GIMM Foundation shares personal data with the following entities:

Mailchimp (The Rocket Science Group LLC) is part of the Intuit Inc. group of companies. This company has adhered to the EU-U.S. Data Privacy Framework.

TRANSFER OF PERSONAL DATA

GIMM may transfer personal data of users of the Site to countries outside the EU/EEA, namely the United States of America, for the purpose of sending and managing communications. These international transfers take place with companies that have adhered to the EU-U.S. Data Privacy Framework.

The EU-U.S. Data Privacy Framework is an adequacy decision issued by the Commission that allows European entities to transfer personal data to companies in the United States that have adhered to this decision, without having to apply additional data protection safeguards.

STORAGE OF PERSONAL DATA

GIMM has implemented the necessary procedures to ensure that the personal data processed is suitable for the intended use and is correct and complete for the purpose for which it is processed. Personal data will be kept for the periods established by law or, failing that, for the period necessary to fulfill the purposes for which they are processed.

• Website users – until consent is revoked.
• After the retention period has elapsed, the personal data will be deleted and will only be kept if necessary to comply with legal obligations to which GIMM is subject or for the purposes of declaring, exercising or defending a right in legal proceedings.

RIGHTS OF DATA SUBJECTS

1. Right to access your personal data and right to correct it
   • GIMM ensures that all personal data is corrected. The data subject has the right, but also the responsibility, to ensure that their data is kept up to date, communicating any changes to GIMM so that it can guarantee the permanent updating of the data. The data subject can also access their personal data, and how it is processed
2. Right to erasure
   • The data subject has the right to obtain the erasure of their personal data, without undue delay, when one of the following reasons applies:
     • the personal data is no longer necessary for the purpose for which it was collected or processed;
     • the data subject withdraws the consent on which the processing of personal data is based, if there is no other legal basis for the processing;
     • the personal data has been processed unlawfully;
     • the personal data must be erased in order to comply with a legal obligation to which the controller is subject.
3. Right to withdraw consent
   • In cases where GIMM invokes consent as the legal basis for processing, the data subject has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing previously carried out on the basis of consent. In the event of withdrawal of consent, the personal data will no longer be processed, unless there is another basis, such as the contract, legal and regulatory obligations or the legitimate interest of iMM, which justifies such processing.
4. Right to lodge complaints
   • The data subject also has the right to lodge a complaint with the National Data Protection Commission (www.cnpd.pt) if they consider that the processing of their personal data violates the applicable legislation.

CONTACTS AND EXERCISE OF RIGHTS

For any question related to privacy or to exercise your rights, please contact GIMM by sending an email to imm-dpo@medicina.ulisboa.pt .

The exercise by the data subject of the above rights is free of charge, unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged considering the associated costs.

CHANGES TO THIS PRIVACY POLICY

The GIMM Website is growing, so it is likely that this privacy policy will be updated at any time, informing data subjects of any such changes or updates by making the privacy policy available to data subjects and publishing it in the appropriate places.

Updated on July 08, 2024