Chalmers’ personal data processing in detail

Chalmers’ activities give rise to many reasons for processing personal data. Personal data processing is done with different purposes and for multiple categories of data subjects. As a university, Chalmers processes the personal data of inter alia students, doctoral students, researchers, participants in studies/research, event visitors, guests, job applicants, company partners and tenderers, alumni, and others who contact the University for one reason or another. Information on the processing of employees’ personal data is provided separately.

For certain purposes, personal data is collected directly from you, the data subject. For other purposes, Chalmers collects and updates personal data from public sources, such as the Swedish Tax Agency or the Swedish Board of Student Finance (CSN).

A description of Chalmers’ various forms of personal data processing is found below. Each form of personal data processing is listed separately for each category of data subject. Chalmers has divided its personal data processing into the ten categories found below. For each category, there is an explanation of that processing form's (i) purpose, (ii) use (actual processing), (iii) legal basis, (iv) retention time, (v) data recipients, and (vi) data sources.

Chalmers has identified processing of personal data for following groups/categories: 
  • Students
  • Research study participants
  • Conference or event participants
  • University visitors
  • Job applicants
  • Borrowers from the library
  • Tenderers and other company partners
  • Alumni
  • Donations 
  • Contacts with the university (Newsletters and email)

Students

Chalmers’ processing of students’ personal data can be divided into five main purposes: 
  • For admission 
  • For the administration of studies 
  • For the management of scholarships 
  • For the fulfilment of legal obligations
  • For follow-up, evaluation, development and research

Admission

Purpose: To manage and administer the admissions process for students of Chalmers University of Technology.

Processing: For decisions on the admission of students, Chalmers processes data about a student's first and last name, personal identity number, registration number from antagning.se, email address, nationally registered address, grades/qualifications, any work samples/portfolio, CV, personal letter, and results from interviews. For international students, Chalmers also processes passport data to verify citizenship, information from language tests, and bank account information.

Legal basis: Performance as contracted higher education institution with a task of public interest; Article 6.1 e GDPR.

Retention time: Personal data collected for admission is processed during the admissions process. If admission in rejected, the data submitted directly to the University is destroyed after six months. For data submitted to antagning.se, the Swedish Council for Higher Education (UHR) is responsible for destruction. If admission is accepted, personal data will continue to be processed for the additional purposes related to the awarding of a place in the programme and the necessary administration related to this. 

Data recipients: Personal data collected for the admissions process is shared with Chalmers Student Union. For international students, the data is also shared with the Swedish Migration Agency.

Data sources: The personal data processed as part of the admissions process is primarily obtained from the applicant, the Swedish Council for Higher Education (via antagning.se), the student administration system shared by all Swedish universities and colleges (Ladok), and the Swedish Tax Agency. For international students, data is also obtained from the Swedish Migration Agency.

Study administration

Purpose: To administer studies at Chalmers University of Technology.

Processing: Chalmers uses first and last name as well as personal identity number to bring students together with teachers and other students in a course/study programme. At the same time, personal data is used to assign the student relevant study materials and provide access to the University’s premises. The data is processed to provide course information on Chalmers’ student website. Shared contact details (both private and school details) are used as needed during the programme for contacts with the students. The data is also used to offer study and career guidance, to decide on registration and tuition fees, to investigate and manage appeals, and to investigate disciplinary cases or other violations where appropriate. Chalmers also processes data on illness, diagnosis and the like to allocate relevant support measures to the student. Data is also processed for exchanges with foreign higher education institutions and for decisions on travel grants and distinctions. Personal data is also processed to administer examinations.

Legal basis:  Performance of education-specific measures, such as course/programme administration, in order to carry out a task of public interest and the exercise of official authority; Article 6.1 e GDPR. Processing for Chalmers’ compulsory student union membership is supported as the performance of a contract with the student; Article 6.1 b GDPR.

Retention time: The personal data that Chalmers processes for administration of studies is saved for as long as the data is needed for the measure in question. Personal data necessary for student administration is saved for as long as the student is registered as having studies (or when the student is on an approved leave from studies but intends to continue their studies at the University). After graduation, student administration of necessary personal data ceases, but contact details continue to be processed for the school’s alumni activities and the data is also saved for archiving and research purposes. Decisions on students who have not utilised their place in a programme are saved, but the reason for the decision is destroyed as soon as the decision is made.

Data recipients: 
Collaborative partners
During the study time, Chalmers shares personal data with others for educational purposes. This is done, for example, in connection with a degree project or other student projects connected to the studies. 

Chalmers Student Union
Chalmers applies compulsory student union membership and therefore transfers personal data to Chalmers Student Union for administration of a student’s union membership, entry into Chalmers premises, and, where applicable, investigations of irregularities and harassment during the study time. Chalmers Student Union also processes personal data for the purpose of inviting to and holding student activities. Chalmers Student Union is independent in its processing of personal data, and is the data controller for such data. Chalmers and Chalmers Student Union have entered into a data sharing agreement for the transfer of personal data used in the collaboration as a means of ensuring the security and protection of the personal data. Chalmers Student Union informs students about their personal data processing. For questions about Chalmers’ transfer of data to Chalmers Student Union, please contact Chalmers. Contact details can be found at the end of this policy.  
 
Data sources: The personal data processed as part of student administration is primarily obtained from the Swedish Council for Higher Education (via antagning.se), the student administration system shared by all Swedish universities and colleges (Ladok), and from the student. To ensure that the collected data is accurate, the data is updated from time to time with information from the Swedish Population Register (Swedish Tax Agency). For study administration purposes, data is also updated with information from the Swedish Board of Student Finance (CSN). 

Scholarships

Purpose: To manage and administer the scholarships for prospective and current students of Chalmers University of Technology.

Processing: For decisions about and payment of awarded scholarships, Chalmers processes data on a student’s first and last name, personal identity number, phone number, email address, nationally registered address, grades, qualifications, bank account number, and CID number. For tuition fee scholarships, Chalmers also processes a passport copy to verify citizenship, CV, personal letter, working life experience, and language tests. 

Legal basis: Scholarships are part of Chalmers’ educational activities and the processing is thereby supported by Article 6.1 e GDPR.

Retention time: The data is saved for 10 years in accordance with the applicable destruction plan for Adlerbertska and “donation” scholarships, etc. Scholarships for third-country tuition fees – the data of individuals not awarded the scholarship is destroyed after 2 years. The data of individuals awarded the scholarship is destroyed 10 years after the decision is made RA:MS 2017:39.

Data recipients: Personal data collected for the scholarship process is shared with units within Chalmers, with directors of Master’s programmes and scholarship coordinators, and with donors.

Data sources: The personal data processed as part of student administration is primarily obtained from the Swedish Council for Higher Education (via antagning.se), the student administration system shared by all Swedish universities and colleges (Ladok), and from the student. 

Legal obligations

Purpose: To fulfil the various legal obligations that Chalmers has as a result of conducting educational and research activities.

Processing: As a higher education institution, Chalmers is legally obliged to ensure that data on students, grades and degrees is saved. Under the Higher Education Act and Higher Education Ordinance, Chalmers is also obliged to carry out plagiarism checks and examinations. Grades, attendance and study-related data are saved. For these purposes, Chalmers processes first and last name, personal identity number and nationally registered address. Data from studies is also used to collect anonymous official statistics and draft reports to the Swedish Council for Higher Education.
 
Legal basis: Fulfilment of legal obligations for educational activities; Article 6.1 c GDPR.
Retention time: Documents subject to archiving obligation are saved as specified in the regulations of the Swedish National Archives.

Data recipients: Processed personal data for this purpose is transferred to government authorities, such as the Swedish National Agency for Education, the Swedish Board of Student Finance (CSN), Statistics Sweden (SCB), the Swedish Institute, the Swedish Higher Education Authority, the Swedish Research Council (Vinnova innovation agency), authorities within Sweden and the EU in order to handle matters related to professional qualifications and credentials, partner universities, and other universities in Sweden or within the EU when we check your eligibility.

Data sources: The personal data processed for fulfilment of Chalmers’ legal obligations is primarily obtained from the Swedish Council for Higher Education (via antagning.se), the student administration system shared by all Swedish universities and colleges (Ladok), relevant authorities, and from the student. 

Follow-up, evaluation, development and research

Purpose: To follow up, evaluate and develop completed courses and programmes, and to conduct operations-oriented research and development.

Processing: Former students’ input, results and evaluations of courses/programmes may be used to develop operations at Chalmers. Collected personal data, such as first and last name, personal data and study results, are also used for research purposes. The processing of data about students is done internally, and the personal data is not published outside of Chalmers’ organisation. Chalmers’ follows the guidelines of the ethical review board in its research activities.

Legal basis: Development activities are part of Chalmers’ educational activities and the processing is thereby supported by Article 6.1 e GDPR.

Retention time: Data collected for evaluation and follow-up is processed for as long as the follow-up measures are in progress. Data that will be processed for research purposes is saved while the research efforts are in progress. As far as possible, Chalmers provides information to students whose data is being processed for research purposes. If it is not possible to provide this information, Chalmers publishes information about ongoing research/evaluation measures.

Data recipients: Units within Chalmers that work with follow-up, evaluation and development.
Data sources: The personal data processed as part of these follow-up measures is primarily obtained from the Swedish Council for Higher Education (via antagning.se), the student administration system shared by all Swedish universities and colleges (Ladok), and from the student.

Research study participants

Purpose: To conduct, publish, utilise and evaluate the research project in question.

Processing: The many research projects conducted at Chalmers require participants who contribute data, observations and other data relevant to the research. Different types of personal data will be processed depending on the research being conducted and its purpose. Chalmers gives research participants separate information about the personal data processing being applied. If sensitive personal data will be processed (e.g. health, genetic or biometric data), the project is preceded by an application to and decision by the Swedish Ethical Review Authority. 

Legal basis: The legal basis for research studies is usually performance of a task of public interest; Article 6.1 e GDPR. For projects dependent on the processing of sensitive personal data, consent is obtained. The processing is then supported by Article 9.2 a GDPR.

Retention time: More detailed information on the process for collecting, storing, anonymising and destruction is described in the personal data information associated with the specific research study. 

Data recipients: The sharing of personal data depends on the design and purpose of the research study.

Data sources: The origin of the personal data depends on the design and purpose of the research study.

Conference or event participants

Purpose: To plan, conduct and follow up events or conferences organised by Chalmers, either independently or in partnership with others.

Processing: In connection with the event, Chalmers or another party responsible for the event processes participants’ first and last name, company/organisation name and contact details (preferably work email address) for the invitation. During the event, personal data may be used for administration of activities that take place during the event. After the event, contact details are used to follow up the event with improvement work and/or information on future events.

Legal basis: Processing for events is supported as a pursuit of legitimate interests; Article 6.1 f GDPR. Mailings are sent to company and organisation representatives, and in the mailing private individuals and persons involved are given the right to object to the receipt of future invitations. 

Retention time: Personal data for the invitation to an event is saved until the data subject objects to continued processing. Data collected specially for a specific event is destroyed after the event, unless the data subject has given consent otherwise.

Data recipients: Co-organisers may receive the participants’ contact details for performance of the event.
Data sources: For the invitation to the event, data can be collected from co-organisers, public sources, or the published contact information of the participant’s organisation.

University visitors

Purpose: To allocate resources and grant access to Chalmers’ premises during the visit.

Processing: Chalmers offers IT resources and WiFi for people visiting the University. For secure allocation of these resources, Chalmers processes data about the visitor’s name, relevant IT resource and connection ID. Guests staying for a longer period of time are allocated an access card, which entails processing of name and access card number during entry to and exit from Chalmers’ premises. Collected personal data about guests will also be processed in connection with internal or external audits and reviews. 

Legal basis: Processing for access to premises and IT resources is supported on the basis of the user agreement with the visitor; Article 6.1 b GDPR. Other necessary processing of visitor personal data due to the visit is supported as a pursuit of legitimate interests; Article 6.1 f GDPR.

Retention time: Visitor personal data is destroyed on a running basis.

Data recipients: Visitor personal data is primarily managed within Chalmers’ organisation. In the event of misconduct/irregularities, data may be shared with the competent authorities.

Data sources: Visitor personal data is usually collected directly from the visitor.

Job applicants

Purpose: To attract new employees and conduct the recruitment process for employment.

Processing: Chalmers processes applicants’ first and last name, contact details from their CV (email, phone number, nationally registered address), and other information provided by the applicant in their application documents. For operations-development purposes, Chalmers compiles anonymous statistics on applications it has received. 

Legal basis: For fulfilment of the imminent employment contract, where applicable; Article 6.1 b GDPR.

Retention time: Data from the job application is processed during the recruitment process and is saved for two years after application in accordance with the applicable destruction plan. The names of applicants are saved until further notice in Chalmers’ register. When applying for specific projects, e.g. specific EU projects, Chalmers is legally obliged to save personal data for five years from the end of the project period. 

Data recipients: Chalmers may share necessary personal data with other actors involved in the recruitment process, such as recruitment companies, security companies and companies that administer employment tests.

Data sources: Data about applicants is obtained directly from the job applicant. Supplementary information may also be obtained from the provided references. For special positions, a background check may be performed on the final candidate. Such check is always carried out with the applicant's consent.

Borrowers from the library

Purpose: To administer the lending of books and other library materials.

Processing: Chalmers needs to process first and last name as well as personal identity number to allow the borrowing of books and other library materials. Chalmers needs to collect this data to know who has possession of which materials and to manage subsequent lending and any late returns.

Legal basis: Processing as part of library activities constitutes a task of public interest; Article 6.1 e GDPR. 

Retention time: The borrower’s data is processed for as long as the borrower has an active loan. The data of borrowers with a library card is saved for as long as the library card is active.

Data recipients: Data for lending purposes is processed within Chalmers’ operations.

Data sources: Chalmers obtains data on borrowers either directly from the borrower or from their internal register of students/doctoral students/researchers/employees.

Tenderers and other company partners

Purpose: To conduct procurement and enable contacts with representatives of companies and other organisations.

Processing: Chalmers processes contact details of company representatives to enable effective communication for the purpose of the procurement procedure and other contacts. 

Legal basis: Procurement-related processing is supported as performance of a task of public interest; Article 6.1 e GDPR. Processing of the personal data of company representatives is otherwise supported as a pursuit of legitimate interests – to enable communication with the parties concerned; 6.1 f GDPR.

Retention time: Personal data is processed for as long as necessary in relation to the relevant procurement procedure. Contact details about company partners is processed to the extent necessary for dealings between the parties.

Data recipients: Personal data collected for the purpose of procurement is handled with absolute confidentiality during the procurement procedure. After an award decision is announced, the tender documents may be requested as a public document. Data in the documents may be disclosed to the public after undergoing confidentiality assessment. 

Data sources: Personal data is normally obtained directly from the data subject. Data about company partners may also be conveyed from other organisations Chalmers has contact with, or be obtained directly from the published contact information of the organisation.

Alumni

Purpose: To stimulate learning for former students, follow up and develop Chalmers’ operations, and maintain contact with and offer career-stimulating, social and professional network get-togethers for former students of Chalmers.
 
Processing: Chalmers processes alumni’s first and last name, personal identity number, contact details, requested contact channels with Chalmers, and degree programme and years. This data is used to provide information about events occurring as part of Chalmers’ operations, maintain contact with alumni after they have completed their studies, and quality follow-up. 

Legal basis: This processing is supported as a pursuit of legitimate interests; Article 6.1 f GDPR. If any alumnus no longer wishes to receive mailings, they have a right to withdraw their registration. Processing related to quality follow-up of the education provided is supported as performance of a task of public interest; Article 6.1 e GDPR.  

Retention time: Personal data necessary for Chalmers’ alumni activities is processed from the date of graduation until the alumnus withdraws their registration.

Data recipients: Data on alumni is managed by Chalmers, as necessary by conference organisers, and sometimes by Chalmers’ collaborative partners for alumni activities. Alumni follow-up is submitted to the Swedish Higher Education Authority within the framework of their monitoring task.

Data sources: Personal data from Chalmers’ alumni activities is obtained from Swedish Council for Higher Education (via antagning.se), the student administration system shared by all Swedish universities and colleges (Ladok), and from the alumnus. The data is updated regularly with information from the Swedish Population Register (Swedish Tax Agency) and in contacts with the alumnus. 

Donations 

Purpose: To manage the donations made to Chalmers.

Processing: Chalmers processes account data and contact details it receives to enable donations to the University. 

Legal basis: The processing of personal data for donations is supported as the performance of a contract; Article 6.1 b GDPR.

Retention time: The data is saved for further contact with donors, unless the donor objects to continued contact. In accordance with the provisions of the Bookkeeping Act, personal data that Chalmers requires for accounting purposes is saved for at least 7 years after the time of donation.

Data recipients: Personal data is managed within Chalmers’ organisation. 

Data sources: The data is collected directly from contacts with the data subject. 

Contacts with the university​ (Newsletters and email)

Newsletter
Purpose: Administrate newsletters

Processing: First and last name, email address, sometimes also company affiliation.

Legal basis: When you register for a newsletter, the data processing is supported through consent; Article 6.1 a GDPR. Newsletters sent out in connection to an event is supported through pursuit of legitimate interests Article 6.1 f GDPR.  

Retention time: Personal data is stored until the data subject unsubscribes from the mailing. 

Data recipients: Personal data is generally managed within Chalmers’ organisation. 

Data sources: The data is collected directly from contacts with the data subject. 

General questions and emails
Purpose: To manage questions and requests sent to Chalmers.

Processing: Chalmers processes the contact details it receives to enable communication and feedback to persons who contact the University.
 
Legal basis: The processing of personal data in order to respond to questions and requests for performance of Chalmers’ educational and research activities is supported as performance of a task of public interest; Article 6.1 e GDPR.

Retention time: Personal data is processed during the time required to respond to the question/request.

Data recipients: Personal data is generally managed within Chalmers’ organisation. 

Data sources: The data is collected directly from contacts with the data subject. 

Published: Wed 26 Feb 2020.