Privacy Notice
Institute for Molecular Genetics and Genetic Engineering, Vojvode Stepe 444a, 11042 Belgrade, Serbia ("IMGGE" or "Controller") takes care of your personal data.
The purpose of this privacy notice is to inform you about the purposes of the intended processing of your data in our business, the legal basis for the processing of your personal data, the recipients of your personal data, the transfer of your personal data abroad, the storage period of your personal data, your rights and technical and organizational measures for the protection of your personal data based on the Law on Protection Data Protection (“Official Gazette RS” No 87/2018) and REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR).
For all details regarding the processing of your personal data, you can contact our Data Protection Officer: Ivan T. Milošević, Attorney at Law, Palmotićeva 16a, 11 000 Beograd or e-mail: ivan.milosevic@jpm.law or by selecting one of the categories below.
A) Data subjects
B) Manners of collection of your personal data and purpose of processing
a) Participants
b) Employees of our business partners and other interested persons
c) Visitors to our website and our social media pages
d) Students and high school students
e) Job candidates
C) Legal basis for processing your personal data
a) Participants
b) Employees of our business partners and other interested persons
c) Visitors to our website and our social media pages
d) Students and high school students
e) Job candidates
D) Joint controllers and processors
E) Transfer of data abroad
F) Period of storage of your personal data
a) Participants
b) Employees of our business partners and other interested persons
c) Students and high school students
d) Job candidates
G) Rights of data subjects
A) DATA SUBJECTS
We process personal data of the following data subjects: participants, employees of business partners and other interested persons, visitors to our website, students and job candidates.
B) MANNERS OF COLLECTION OF YOUR PERSONAL DATA AND PURPOSE OF PROCESSING
A) PARTICIPANTS
IMGGI processes your personal data to carry out genetic analyses for scientific research purposes ("scientific research purposes") and to conduct genetic analysis, with monetary compensation, at your request ("commercial purposes").
IMGGI collects personal data of respondents from you, through our video surveillance system (when you reside in our facility), from health institutions where you receive treatment or other business partners of ours.
a) Processing for scientific research purposes
IMGGI processes the following personal data of yours for scientific research purposes: name and surname, gender, age, DNA sample, body fluids, buccal swab, microscopic preparation, bone marrow and other samples of human origin ("sample"), medical history, data from genetic analyses, biogeographic origin, ethnic origin and epidemiological data.
b) Processing for commercial purposes
The Institute processes the following personal data about you for commercial purposes: first and last name, gender, age, sample, medical history of the participant, telephone number, address and e-mail.
Your name and surname, gender, age, sample, disease history collected from you for commercial purposes, as well as the results obtained from research for commercial purposes are further processed by the Institute for scientific research purposes.
When you bring samples to the IMMGE premises yourself, we collect your first and last name, ID number and your videos from you in order to protect your safety and the safety of people at IMGGE and IMGGI property.
B) EMPLOYEES OF OUR BUSINESS PARTNERS AND OTHER INTERESTED PERSONS
a) Employees of our business partners
We process your personal data for the purpose of achieving business cooperation with our business partners and to protect your safety and security of persons in IMGGE and property of IMGGE, in the case when you are staying on the premises of IMGGE.
We collect your personal data from you, from your employers and through our video surveillance system.
IMGGE processes the following personal data about you: first and last name, business name of the company you work for, your position in the company you work for, your official mobile and landline phone number, your videos and your business e-mail address.
b) Other interested persons
We process your data:
i) to enable you to insert your personal data in our application (name and surname, e-mail address, user name and password and data on variants of uncertain significance from genetic analyses which you are interested in), to enable you to access our application with dataon variants of uncertain significance from genetic analyses as well as to access public databases and obtain other necessary information which are subject to your interests;
ii) so that you can receive notifications from us about variants of uncertain significance that are the subject of your interest;
iii) to protect the security of our application and the personal data we process.
We process the following personal data about you: name and surname, e-mail address, IP address, name of the institution where you work and personal data - variants of uncertain significance from genetic analyses.
C) VISITORS TO OUR WEBSITE AND OUR SOCIAL NETWORK PAGES
For more information about the collection of your personal data of visitors to our website, please read our Cookie Policy https://www.imgge.bg.ac.rs/en/cookies-policy
D) STUDENTS AND HIGH SCHOOL STUDENTS
We process your personal data to enable you to accomplish practice at IMGGE and to protect your safety and the safety of persons at IMGGE and IMGGE property, in the event that you are staying on the premises of IMGGE.
We collect your data from your biographies and through our video surveillance system.
E) JOB CANDIDATES
We process your personal data for the purpose of carrying out the selection process of candidates for employment at IMGGE and to protect your safety and the safety of people at IMGGE and IMGGE property, in the event that you are staying on the premises of IMGGE.
We collect your data from your biographies and through our video surveillance system.
C) LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA
A) PARTICIPANTS
Legal basis for processing your personal data for scientific research and commercial purposes is your consent, which we will obtain from you before processing your personal data. In the event that our business partners transfer data to us in order to implement the purposes stated here, we will provide them with a consent form, which we ask you to sign.
After having your personal data processed for commercial purposes, we process your personal data (see Section B "Manners of collecting your personal data and purposes of processing", point a) further for scientific research purposes). Further processing for scientific research purposes is carried out on the basis of Article 44 of the Law on Science and Research ("Official Gazette of the RS" No. 49/19), i.e. on the basis of Article 12 paragraph 1 point 3 (necessity of processing for the purpose of complying with the legal obligations of the controller) and 17 paragraph 2 point 10, and in connection with Article 6 paragraph 1 ZZPL.
Namely, IMGGE is a scientific institute which main activity consists of basic and applied research that are in the function of valorising the results of basic research and is accredited by the national accreditation body of the Republic of Serbia for conducting genetic analyses. IMGGE was incorporated for the purpose of carrying out scientific research activities and carrying out genetic analyses for scientific research purposes is its legal obligation. Additionally, Article 6 paragraph 1 of the LPPD prescribes that, if personal data is further processed for the purposes of scientific or historical research, as well as for statistical purposes, in accordance with this law, it is considered that personal data is processed in a manner that is in compatible with the original purpose. It follows from the cited legal provision that the processing of your personal data by IMGGE for scientific research purposes based on the Law on Science and Research is in accordance with the original purpose of processing your personal data.
Additionally, since the sample, disease history and the results of the obtained genetic analyzes are genetic personal data and health data, i.e. special categories of personal data, the legal basis for processing your special categories of personal data is the necessity of processing for scientific research purposes from Article 17 paragraph 2 point 10 LPPD.
We process your videos, name and surname and ID card number in order to achieve our legitimate interest, in order to preserve your safety and the safety of persons in IMGGE and the property of IMGGI - Article 12 paragraph 1 point 6 LPPD.
In order to process your personal data for the purpose of carrying out scientific research, the controller will implement appropriate organizational and technical measures in accordance with Article 92 of the LPPD. Pseudonymization will be carried out - processing in a way that makes it impossible to assign personal data to a specific person without using additional personal data. After carrying out genetic analyzes for commercial purposes, your sample will be marked with a numerical code, and your personal data - name and surname will be separated from the sample and other data that we will process and will be stored separately from it, other personal data and results we will come in the scientific research that the Controller will carry out on your samples in the future. Only a limited number of researchers and other persons at the Controller will have access to all your personal data and only for the reason that they could implement organizational and technical measures for pseudonymisation or, if you want us to inform you about the results of genetic tests on your sample, in case we find that you are suffering from some disease. When we receive data from our business partners in order to carry out scientific research purposes, we will request that samples marked with numerical codes and other documents be delivered to us, without your first and last name.
B) EMPLOYEES OF OUR BUSINESS PARTNERS AND OTHER INTERESTED PERSONS
a) Employees of business partners
The legal basis for processing your personal data is our legitimate interest to achieve business cooperation with business partners and to preserve your safety and the safety of persons in IMGGI and the property of IMGGI (Article 12 paragraph 1 point 6 LPPD).
b) Other interested persons
The legal basis for processing your data from your genetic analyses (variant of uncertain significance) is your consent (Article 6 (1) (a). The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
The only information about you that will be available to the persons having access to our database is your information about variant of uncertain significance. IMGGE, upon receipt of your personal data from Section B point b) will implement pseudonymisation - the processing of variants of unspecified content will be carried out in a way that prevents your identification by persons who have access to our database. Your remaining data will be stored separately and only those persons who are in charge of exercising your rights and fulfilment of our legal obligations in accordance with the LPPD will have access to these data.
The legal basis for processing your personal data - your e-mail address - is your consent to store this personal data on our server and receive the requested notifications from us. Withdrawal of consent does not affect the validity of processing that was carried out on the basis of consent before the withdrawal (Article 6 (1) (a) of GDPR).
The legal basis for processing your name and surname, e-mail address and the name of the institution where you work is to take action at your request - so that you could register and access our application (Article 6 (1) (b) of GDPR) and use our services as well as fulfilment of our legal obligations – to enable you to exercise your rights in accordance with GDPR and to store your personal data in accordance with LPDP (Article 12 paragraph 1 item 3) .
The legal basis for processing your IP address is our legitimate interest in protecting the security of our application as well as the security of our information system and the personal data we process (Article 6 (1) (e).
C) VISITORS TO OUR WEBSITE AND OUR SOCIAL NETWORK PAGES
In the case of processing your personal data for marketing and statistical purposes, the legal basis for processing your personal data is your consent (Article 6 1 (a) of GDPR).
In case of processing your personal data for the purpose of security of our website, the legal basis for processing your personal data is our legitimate interest (Article 6 paragraph Article 6 1 (e) of GDPR).
For more information about the collection of your personal data of visitors to our website, please read our Cookie Policy https://www.imgge.bg.ac.rs/en/cookies-policy
D) STUDENTS AND HIGH SCHOOL STUDENTS
The legal basis for the processing of your personal data is the necessity for the execution of the contract concluded with the person to whom the data refer (Article 12 paragraph 1 item 2 LPDP).
We process your videos, name and surname and ID card number in order to achieve our legitimate interest, in order to preserve your safety and the safety of persons in IMGGI and the property of IMGGE - Article 12 paragraph 1 item 6 of LPDP.
E) JOB CANDIDATES
The legal basis for processing your personal data is necessity of taking steps by IMGGE at your request prior to entering into an employment contract at IMGGE and to preserve your safety and the safety of persons at IMGGE and IMGGE property (Article 12 paragraph 1 item 2 of LPDP).
D) RECIPIENTS
When we process personal data of respondents for commercial purposes in cooperation with health institutions and other organizations, namely:
- University Children's Clinic from Belgrade, Tiršova 10 - tanja.sormaz@udk.bg.ac.rs
- Institute for the Application of Nuclear Energy from Belgrade, Banatska 31b ("INEP") - mail@inep.co.rs
- PZU Human Reproduction, Prvomajska 4, 85310 Budva, Montenegro - info@ordinacije.me
- Polyclinic "Mikromedika", Đure Jakšića 2l, 35 000 Jagodina - kontakt@mikromedika.rs
- Health Insurance Fund of Montenegro, Vaka Đurovića bb, 81000 Podgorica, Montenegro - kabinet@rfzcg.co.me
- Republika Srpska Health Insurance Fund, Zdrave Korde 8, Banja Luka, Republika Srpska, BiH zastitnik.prava@zdravstvo-srpske.org
we act in the capacity of independent controllers (Article 4, paragraph 1, item 8 of LPPD) . The Controller has concluded contracts with the aforementioned legal entities on the transfer of personal data in which certain adequate organizational and technical measures are defined in order to protect your personal data and the responsibility of joint controllers in terms of how to exercise your rights in accordance with Articles 23 and 24 of the ZZPL. In connection with exercising your rights, you can contact our person for the protection of personal data at e-mail: ivan.milosevic@jpm.law or at the e-mails of our business partners. The responsibility of IMGGE refers to the handling of personal data after receiving personal data from the aforementioned legal entities for the purpose of conducting genetic analyses. In any case, you can contact either us or our business partners to exercise your rights in accordance with the ZZPL.
We engaged GS4 doo, with headquarters in Belgrade, Viline Vode 6, Belgrade, in capacity of processor under the law to implement physical protection measures for persons and property and IMGGE. The Controller concluded a contract with GS4 doo Belgrade on the transfer of personal data in which adequate organizational and technical measures are defined to protect your personal data. In connection with exercising your rights, you can contact our personal data protection officer at e-mail: ivan.milosevic@jpm.law or at e-mail of GS4 doo Beograd direkcija@rs.g4s.com. The responsibility of IMGGE refers to the processing of personal data during the time when the employees and visitors stay in the premises of IMGGE. GS4 doo Belgrade maintains appropriate records in accordance with the Law on Private Security ("Official Gazette of RS", Nos. 104/2013, 42/2015 and 87/2018). In any case, you can contact either us or our business partners to exercise your rights in accordance with the ZZPL.
Access to your data is also available to a company that acts as an administrator of our website, our website and our pages on social networks (processor), namely: Facebook https://www.facebook.com/imggi /Twitter https://twitter.com/imgge, Google plus https://plus.google.com/u/0/116895656862579263219 /Pinterest/https://www.pinterest.com/imgge/LinkedInhttps://www.linkedin.com/company/imgge. The controller concluded an agreement with the administrator of the website and pages on social networks on the transfer of personal data, which defined certain adequate organizational and technical measures in order to protect your personal data in accordance with Article 45 of the Personal Data Protection Act.
E) DATA TRANSFER
When transferring your personal data to the countries listed in the Decision on the list of countries, parts of their territories or one or more sectors of certain activities in those countries and international organizations where it is considered that an adequate level of protection of personal data is provided ("Official Gazette RS", No. 55/2019) - "Decision", we conclude contracts with controllers and processors in which we define adequate organizational and technical measures for the protection of your personal data.
If we transfer your personal data to countries that are not listed in the Decision and for the purpose of ensuring an adequate level of protection of your personal data, we conclude contracts on the transfer of personal data in accordance with the standard contractual clauses from Article 65 paragraph 2 paragraph 2 of LPDP. You can view concluded agreements on data transfer to countries that are not listed in the Decision at the IMGGE premises.
F) STORAGE PERIODS OF YOUR PERSONAL DATA
A) PARTICIPANTS
Your samples, your medical history, results of genetic analyses, gender, age, biogeographical origin, ethnic origin and epidemiological data will be kept by the Controller permanently in accordance with Article 8 paragraph 3 of the ZZPL.
Your name and surname, identity card number, e-mail address and residential address and telephone number will be stored for 10 years from the date of collection for the purpose of establishment, exercise or defence of legal claims.
Your videos records are stored for thirty days from the date of collection.
B) EMPLOYEES OF BUSINESS PARTNERS AND OTHER INTERESTED PERSONS
a) Employees of our business partners
Your personal data is stored for three years after the termination of cooperation with business partners in order to collect claims against business partners or defend against legal claims of business partners.
Your name and surname and ID number, which we process for the purpose of preserving your safety and the safety of persons and property of IMGGI, will be stored for 10 years from the date of collection for the purpose of establishment, exercise or defence of legal claims.
Your videos are stored for thirty days from the date of collection.
b) Other interested persons
We process your e-mail address for the purpose of sending notifications and personal about your interests and personal data – variant of uncertain significance until you withdraw your consent.
We store your name and surname, e-mail address, username and password, the name of the institution where you work and your IP address for three years from the day you stop using our services (in case you act in capacity of employee with legal entity) or ten years from the day you stop using our services (in case you act in capacity of natural person).
C) STUDENTS AND HIGH SCHOOL STUDENTS
Your personal data is stored for three years after the termination of practice in accordance with the statute of limitations for claims arising from employment relationships.
Your name and surname and ID number, which we process for the purpose of preserving your safety and the safety of persons and property of IMGGI, will be stored for 10 years from the date of collection for the purpose of establishment, exercise or defence of legal claims.
Your videos are stored for thirty days from the date of collection.
D) JOB CANDIDATES
Your personal data is kept until the end of the selection process of job candidates for employment at IMGGE. If you give us your consent, we will keep your personal data for one year after the end of the selection process of job candidates for employment at IMGGE, so that we can contact you if there is a need for your employment.
Your name and surname and ID number that we process for the purpose of preserving your safety and the safety of persons and property of IMGGE will be stored for 10 years from the date of collection for the purpose of establishment, exercise or defence of legal claims.
Your videos are stored for thirty days from the date of collection.
G) RIGHTS OF DATA SUBJECT
a) Participants
You are not authorised to submit a request for erasure of your personal data for the reason that the erasure of your data could prevent the fulfillment of the purpose of processing your personal data and the conduct of scientific research by the Controller based on the Law on Science and Research (Article 30 paragraph 1 item 2 of LPDP ). The same applies to the right to access personal data, the right to correction or addition, and the right to limit the processing of personal data. Namely, Article 92 paragraph 3 of LPDP stipulates that the provisions of the LPDP on the right of access to data, the right to rectification and the right to limitation of processing do not apply if the processing is carried out for the purposes of scientific or historical research or statistical purposes, if it is necessary for the achievement of those purposes or if the application of those provisions of the law would make it impossible or significantly difficult to achieve them, with the application of the measures from para. 1 and 2 of this Article.
b) Employees of business partners and other interested persons have the right to access and copy personal data, the right to object, the right to correct and supplement personal data, the right to limit processing and the right to delete personal data.
c) Visitors to our website have the right to access and copy personal data, the right to object, the right to correct and supplement personal data, the right to portability, the right to limit processing and the right to erasure of personal data;
d) Students and high school students have the right to access and a copy of personal data, the right to object, the right to correct and supplement personal data, the right to portability, the right to limit processing and the right to delete personal data;
e) Job candidates have the right to access and a copy of personal data, the right to object, the right to correct and supplement personal data, the right to limit processing and the right to delete personal data.
If you believe that your rights have been violated by the processing of your personal data, you have the right to file a complaint with the Commissioner:
Commissioner for Information of Public Importance and Protection of Personal Data
Bulevar Kralja Aleksandra 15
11 000 Belgrade
Republic of Serbia
e-mail:office@poverenik.rs