By registering for QualNotes and checking the ‘consent’ box when you download the mobile application, you agree to the terms and conditions in the Data Processing Agreement and the Privacy Policy, as outlined below:
(1) the Data Processing ‘The Agreement’ between QualNotes as the Data Processor and yourself, on behalf of your university (and/or organisation) who acts as the Data Controller, and,
(2) The Privacy Policy for use of the QualNotes application, when you are the Data Processor and you use the app to collect data from a participant/s, which includes processing their personal data.
_____________________________________________________________________
Data Processing Agreement
This data processing agreement (the “Agreement”) is entered into on the date when you register to use QualNotes to collect data. The agreement is between:
(1) You as an employee and/or student of your university, where your university is the Data Controller, and
(2) QualNotes AB, reg. no. 559417-9862, [Nybohobvsbacken 65, 117 64 Stockholm] (the “Data Processor”).
The above parties are hereinafter jointly referred to as the “Parties” and each individually as a “Party”.
1. Introduction
1.1 The Data Processor provides an application, QualNotes, which the Data Controller will use as an aid when conducting research, within the application it is known as a “Project”.
1.2 Within the undertakings arising from the using the QualNotes application, the Data Processor might process personal data and other information on behalf of the Data Controller.
1.3 For that reason, the Parties enter into this Agreement to regulate the conditions for the Data Processor’s processing of, and access to, personal data on behalf of the Data Controller.
1.4 Unless the circumstances clearly indicate otherwise, any definition or term used in this Agreement that is not set out otherwise in the Agreement shall be defined as set out in Article 4 of the GDPR.
2. Documents
2.1 The Agreement consists of this document and the attached instruction.
2.2 In the event of any contradiction between this document and the instruction, this document shall prevail, unless otherwise specified or unless circumstances clearly dictate otherwise.
3. Processing of personal data
3.1 The Data Controller is the controller of the personal data processed in connection with performance and provision of services under this Agreement to register and use the QualNotes application. The Data Processor is to be considered as processor for the Data Controller for the processing of personal data carried out by the Data Processor on behalf of the Data Controller.
3.2 The Parties agree that the Data Processor:
i) may transfer, store, transmit, or otherwise Process Personal Data on behalf of the Data Controller outside the EU/EEA, provided the Data Processor, before transfer to a third country commences, complies with the requirements and measures that follow from the General Data Protection Regulation or Other Regulatory Regime with regard to third country transfers. The Data Processor therefore undertakes, where applicable, to enter into the EU Commission’s Standard Contractual Clauses (SCC) or equivalent transfer mechanism with subprocessors whose operations are outside the EU/EEA,
ii) shall ensure that its employees and all other persons with authority to process personal data covered by this Agreement have undertaken to observe confidentiality or are subject to a relevant and appropriate statutory duty of confidentiality;
iii) shall take all measures required in accordance with Article 32 of the GDPR;
iv) shall respect the terms and conditions referred to in clause 5 below regarding retaining a subprocessor;
v) taking into account the nature of the processing, shall, through appropriate technical and organisational measures, assist the Data Controller, to the extent possible, so that the Data Controller can fulfil its obligation to respond to requests regarding exercise of the rights of the data subject in accordance with Chapter III of the GDPR;
vi) shall assist the Data Controller in ensuring that the obligations in accordance with Articles 32-36 in the GDPR are fulfilled, taking into account the nature of the processing and the information which the Data Processor has at its disposal;
vii) depending on what the Data Controller chooses, shall erase or return all personal data to the Data Controller after the provision of processing services has ended and erase existing copies, unless storage of the personal data is required by EU law or the Member States’ national law; and
viii) shall provide the Data Controller with access to all information required to demonstrate that the obligations prescribed in Article 28 of the GDPR have been fulfilled, and to make possible and assist in audits, including inspections, conducted by the Data Controller or by other auditor authorised by the Data Controller.
3.3 The Data Processor shall immediately inform the Data Controller if it believes that an instruction violates the GDPR or any other Union or Member State data protection provision.
3.4 The Data Processor undertakes to process only the personal data necessary to achieve the purpose of the relevant processing. This undertaking concerns, for example, the amount of personal data, the scope of the processing, the duration of processing of the personal data, and its accessibility.
4. Term of the Agreement
The Agreement shall apply as from execution by both Parties and shall remain in force for as long as the Data Processor or any sub-processor retained by the Data Processor processes personal data on behalf of the Data Controller within the scope of the undertakings arising from this Agreement.
5. Subprocessors
5.1 The Data Processor shall not be entitled to retain a subprocessor to carry out processing of personal data under the Agreement without the prior written consent of the Data Controller. Such written consent may be specific (relating to a particular subprocessor) or general.
5.2 If a general prior written authorisation has been given by the Data Controller, the Data Processor shall inform the Data Controller of any plans to retain a new subprocessor or, if an existing subprocessor is to be replaced by another, so that the Data Controller has the opportunity to object to such a change. If the Data Controller objects, the Data Processor is not entitled to use the subprocessor in question.
5.3 If the Data Controller has given written consent, irrespective of whether it is specific or general, the Data Processor shall ensure that such subprocessor enters into a written data processing agreement before the subprocessor commences work that has a connection to the Data Controller. Such a data processing agreement must contain, at a minimum, the undertakings and obligations which follow from the Agreement. In such data processing agreement, the subprocessor shall provide sufficient warranties regarding implementation of appropriate technical and organisational measures in such manner that the processing fulfils the requirements of this Agreement and the GDPR.
5.4 The data processing agreement between the Data Processor and any subprocessor shall specifically provide that the subprocessor may not retain another subprocessor without the prior written consent of the Data Controller.
6. Governing law
The Agreement shall be governed by the substantive law of Sweden.
_____________________________________________________________________
QualNotes AB Privacy Notice for Users
Information regarding collected personal data
1. To whom is this notice directed?
This note applies to users of the application QualNotes as an aid during research and studies.
Information which must be provided regarding the personal data collected from the data subject
Any party who collects and processes personal data must ensure that the party affected by the data is informed of the processing of the personal data. According to Article 13 of the General Data Protection Regulation (“GDPR”), the following information must be provided to the data subject when personal data is collected from the data subject.
2. Who is the controller of personal data?
QualNotes AB, reg. no. 559417-9862
Address: Nybohobvsbacken 65, 117 64 Stockholm.
Phone number: +46 0737 094 291
E-mail address: qualnotes@gmail.com
3. The purposes and the legal basis for each processing
The purpose for collecting and processing your personal data is to provide you with services in the application QualNotes. The mentioned data include:
The processing of personal data is based on either a consent with you, the data subject, or to fulfil the contract with you. To Process participant’s names, email addresses and signatures, is necessary to fulfil the contract to supply an application of research ethics within the data processor’s institutional/country-based ethics review authority.
To start a research project in QualNotes, a user can upload “PDF version of their Participant Information Statement and Consent Forms” approved by their institutional/country-based ethics review authority. This form might include personal data, as:
4. Where does the personal data come from?
The personal data we collect comes from you, the data subject.
5. Are there any recipients of the personal data?
There are no other recipients of the personal data than the data processor.
6. Is any transfer made to a third country?
The data controller will not transfer data to a third country.
7. How long is the personal data saved?
The personal data is saved in the application as long as the user remains as a registered use of the QualNotes application. When the user deletes the application or stop to be a user in the application, will the personal data be deleted.
8. What are your rights as a data subject?
The right to access: You have a right to access the personal data we hold about you.
The right to rectification: You have the right to require us to rectify any inaccurate personal data about you without undue delay. If such personal data has been disclosed to a third party in accordance with this privacy notice, we will also ask them to rectify or update your personal data (if relevant).
The right to erasure: The right to have us erase any personal data we hold about you in circumstances such as where it is no longer necessary for us to hold the personal data or, in some circumstances, if you have withdrawn your consent to the processing.
The right to object: You have the right to object to us to processing personal data about you such as processing for profiling or direct marketing.
The right to data portability: You have a right to ask us to provide your personal data to you in a portable format or, where technically feasible, for us to port that personal data to another provider provided it does not result in a disclosure of personal data relating to other people.
The right to restriction: You have the right to request a restriction of the processing of your personal data.
The right to complain: You have the right to complain to the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten) about our processing of your personal data if you are dissatisfied with our processing of your personal data. Contact details for the Swedish Authority for Privacy Protection can be found here: www.imy.se.
9. Automated decision-making
No automated decision-making (including profiling) takes place.
10. You can always withdraw your consent
Where the processing is based on Article 6(1)(a) or 9(2)(a) GDPR, you are entitled to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Please note that it must be clearly distinguishable and unambiguous.
11. Direct marketing?
No direct marketing will take place.
12. Miscellaneous
You are not obligated to provide personal data. The consequences of not providing the requested information are that the application may not work for you.
CONTACT US
If you have any additional questions about our Data Processing Agreement and/or Privacy Policy please feel free to contact us at qualnotes@gmail.com.
Copyright © 2024 QualNotes - All Rights Reserved.