Private policy

Version 05 of March 29, 2024

Contents

  1. Who are we?. 1
  2. Who are the data subjects?. 2
  3. What is our commitment to data protection?. 2
  4. What personal data do we process and for what purposes?. 2
  5. In what capacity do we process your personal data?. 4
  6. On what bases do we process your personal data?. 4
  7. Where does your personal data come from?. 5
  8. Who has access to your personal data?. 5
  9. How do we manage our processors?. 6
  10. Where do we process your personal data?. 6
  11. What retention periods apply?. 7
  12. What are your rights?. 7
  13. What level of security do we ensure?. 9
  14. Do you have any questions or complaints?. 9
  15. Anything else?. 9

 

  1. Who are we?
  • Name: 101 Genomes Foundation (“we“, “our“)
  • Registered office: Avenue de Sumatra 6, 1180 Uccle (Belgium)
  • Company number: BE0684.609.172
  • Website: https://www.f101g.org (the “Website“)
  • Contact details of our contact person for any questions relating to data protection: dpo@f101g.org.
  1. Who are the data subjects?

2.1 We process personal data relating to:

  • participants in our research projects (such as the Genome4Good initiative and the GEMS study);
  • participants in specific research projects who entrust us with data hosting;
  • fund donors (for example, people who donate money to us), fundraisers (for example, people who raise funds for us) and supporters (for example, people who take part in our events, etc.);
  • representatives of our partner organisations (for example, research centres, associations and other organisations);
  • representatives of our suppliers;
  • candidates applying for a job with us;
  • visitors to our website and our workplaces;

Hereinafter: the “data subjects“, “you“, “your“.

2.2 This privacy policy (the “Policy“) applies to any processing of your personal data that we carry out.

  1. What is our commitment to data protection?

3.1 We undertake to use our best efforts to ensure that our personal data processing activities comply with applicable data protection legislation, including Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the ” GDPR “) and the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, as amended, supplemented or replaced from time to time (the ” Applicable Data Protection Legislation “).

  1. What personal data do we process and for what purposes?

4.1 If you are a participant in one of our projects or in a specific research project of a group that entrusts us with data hosting, we process:

  • your contact details and address to send you your saliva sample collection kit;
  • certain data relating to your health and certain biometric data for scientific research purposes (including for the development and training of bioinformatics tools essential to research and to the provision of data analysis services). An up-to-date list of the scientific research carried out on your data is available at any time on our website at https://www.f101g.org/recherches and via your dedicated portal;
  • your personal identification data and your contact details to offer you the opportunity to take part in specific additional studies (which we will invite you to join and for which a specific consent form will be provided to you);
  • with your consent and following an opinion from our data access committee, certain data concerning your health, your biometric data, and your personal identification data requested by your treating physician or a genetic analysis expert you have appointed, to enable them to carry out medical investigations related to your health (for example, in the event of cancer, a diagnostic odyssey, etc.)
  • with your consent, certain data concerning your health, your biometric data, your personal identification data and your contact details with your reference physician in the event that information relevant to your health is incidentally discovered by a researcher previously authorised to consult your data in anonymised form. After consulting our data access committee, your reference physician will take a position regarding the information potentially important for your health that has been communicated and may, where appropriate, decide to pass it on to you within an appropriate ethical framework, taking into account the preferences indicated in your consent and in accordance with applicable legislation and professional rules;
  • your personal identification data, your contact details and your bank account number when preparing documents entitling you to a tax deduction for financial donations.

4.2 If you are a donor, fundraiser or supporter, we process:

  • your personal identification data and your contact details to help us organise events to promote our activities and to inform you about our activities;
  • where applicable, your bank account number to prepare tax deduction forms.

4.3 If you are the representative of one of our partners, we process:

  • your personal identification data, your professional identification data, your contact details and, where applicable, data concerning your professional experience, for the activation, management and maintenance of your partnership;
  • where applicable, your personal identification data, your professional identification data and your contact details for communication purposes.

4.4 If you are the representative of one of our suppliers, we process your personal identification data, your professional identification data and your contact details to manage our business relationship with our suppliers.

4.5 If you apply for a job with us, we process your personal identification data, your professional identification data, your contact details, data relating to your professional life (skills, qualifications, experience, etc.) and the personal data contained in your curriculum vitae to assess your profile against our recruitment needs.

4.6 If you visit our website, we may process electronic identification data about you in aggregated form to measure traffic on our website, improve the browsing experience, and detect and prevent fraud and IT security vulnerabilities. For detailed information about the cookies we use and the purposes for which we use them, please refer to our cookie policy.

4.7 If you use the free online version of our variant classification tools, we retain the variant entered for statistical purposes and to improve our prediction tools.

4.8 If our workplaces are equipped with surveillance cameras, we may request access to images concerning you, only where such access is necessary to pursue our legitimate interest in detecting offences or incivilities and to the extent permitted by applicable law.

4.9 We may also process some of your personal data for the following purposes:

  • carrying out restructuring operations of our activities;
  • conducting internal and external audits;
  • managing disputes with data subjects and where processing is necessary for the establishment, exercise or defence of legal claims;
  • maintaining the security of our information services.

In general, we never subject data subjects to decisions based solely on automated processing that produce legal effects concerning them or similarly significantly affect them.

  1. In what capacity do we process your personal data?

5.1 We process your personal data as data controller. In this context, we determine the purposes and means of processing your personal data.

  1. On what bases do we process your personal data?

6.1 The provision of your personal data may be necessary:

  • for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at your request (for example, in the event you apply for a job with us);
  • to comply with a legal obligation applicable to us (for example, in accounting, taxation, etc.) or to comply with requests from law enforcement authorities or courts and tribunals;
  • for the purposes of our legitimate interests (or those of a data recipient) provided that those interests override your fundamental freedoms and rights (for example, to maintain the security of our information systems).

6.2 We ask for your prior, free and informed consent before processing certain of your personal data (for example, in the situations referred to in point 4.1 above).

6.3 The provision of certain of your personal data (for example, your personal identification data, etc.) conditions our ability to allow you to participate in our actions.

6.4 Possible consequences of not providing your personal data could include our inability to allow you to participate in our actions or a breach on our part of one or more obligations under applicable legislation (for example, accounting and tax legislation).

  1. Where does your personal data come from?

7.1. The personal data we process comes from the following sources:

  • directly from you, for example during the first contact we make with you (possibly via the intermediation of a third party (such as itsme);
  • via our partners (research centres, associations and other organisations) whom you authorise us to contact so that they provide us with the data you authorise us to access;
  • through the general practitioner, specialist or other person responsible for your care (and staff authorised to work under their supervision, including in a hospital setting) whom you authorise us to contact so that they provide us with the data you authorise us to access;
  • from publicly accessible information (on the Internet), for example when we check the profile of candidates applying for a job with us.
  1. Who has access to your personal data?

8.1 The following recipients may receive or have access to some of your personal data (only if necessary for the performance of their duties):

  • members of our operational team have access to certain data concerning your health and certain of your biometric data;
  • members of our staff responsible for administrative follow-up have access to the personal identification data, professional identification data and contact details of representatives of our partners;
  • the sequencing service providers with whom we work;
  • certain persons responsible for your healthcare and the experts you have authorised to access your data (for example as part of your medical follow-up or a genetic analysis service);
  • research groups working on specific projects that would require obtaining additional data from you if you have consented to be recontacted to participate in specific studies that require the collection of additional information;
  • research groups (academic and industrial) whose research projects have received approval from an ethics committee and who have been authorised, after consultation with our data access committee, to have access to your anonymised data or at least pseudonymised data (i.e. so that such data is not linked to your personal identification data) may process certain data relating to your health and certain biometric data;
  • IT groups wishing to access the data to improve the predictive capabilities of their bioinformatics tools;
  • our research teams and consultants appointed by us to conduct research on our behalf and/or to enable and monitor access granted to other groups;
  • members of our team responsible for monitoring our suppliers have access to the personal identification data, professional identification data and contact details of representatives of our suppliers;
  • our legal advisers and lawyers have access to certain personal data of data subjects in the context of restructuring operations of our activities or disputes;
  • our legal advisers and genetic counsellors have access to certain personal data to enable the organisation of personalised online information consultations;
  • our expert security consultants and network architecture auditors;
  • our other advisers (such as our accounting, financial and tax experts);
  • external service providers (such as providers related to the operation and maintenance of information systems processing your personal data);
  • the provider that supplies us with the online dialogue and support service (in particular via a conversational agent or “chatbot”) when browsing our websites;
  • law enforcement or regulatory authorities (for example, tax, health or data protection authorities, ethics committees) or courts and tribunals where we are required to disclose or share your personal data to comply with a legal obligation or to protect our rights, property or security or those of other persons.

8.2 We entrust the processing of certain of your personal data to processors only to the extent necessary to carry out their tasks and in accordance with our written instructions and the Applicable Data Protection Legislation.

8.3 In the event of a restructuring transaction (for example, a financing transaction), we may transmit certain personal data concerning a limited number of data subjects to a third party involved in the transaction (for example, a bank) in accordance with the Applicable Data Protection Legislation.

  1. How do we manage our processors?

9.1 We take appropriate measures to ensure that our processors process your personal data in accordance with the Applicable Data Protection Legislation.

9.2 Among other things, we ensure that our processors undertake to process personal data only on our instructions, not to engage another processor without our prior authorisation, to take appropriate technical and organisational measures to guarantee the security of personal data, to ensure that persons authorised to access personal data are subject to appropriate confidentiality obligations, to return and/or destroy the personal data they process at the end of their services, to comply with audits, and to provide us with assistance to ensure follow-up of data subjects’ requests regarding the exercise of their rights in relation to their personal data.

  1. Where do we process your personal data?

10.1 We ensure that we host the health data and biometric data of participants in our projects (including Genome4Good) exclusively on servers located within the territory of the European Economic Area (“EEA“).

The data collected is processed under our control to be accessible in biological format in our “BioB” and in electronic format in our “Genomic Cloud”.

  • BioB. We have created our own biobank called “BioB”. Our BioB is hosted in France by CryopAL Biobanque Solutions, which holds ISO 9001:2015 (No. 181277/1415F) and ISO 20387:2018 (No. 211277/1415F) certifications. The creation of BioB was approved on April 5, 2022 by the ethics committee of Erasme Hospital (Brussels – Belgium). It then received notification number BB220008 from the Belgian Federal Agency for Medicines and Health Products (FAMHP) on June 9, 2022.
  • Genomic Cloud. We have created our own bioinformatics biobank called “Genomic Cloud”. Our Genomic Cloud is built in Azure (ISO 27001:2013, Defender 100% Secure score) and complies with the FAIR principles.

10.2 In the very unlikely event that your personal data is transferred to countries outside the EEA, we will ensure that we put in place the following safeguards:

  • the country to which the personal data is transferred benefits from an adequacy decision by the European Commission under Article 45 of the GDPR and the transfer falls within the scope of that adequacy decision;
  • we will carry out a transfer impact assessment, adopt additional measures if necessary, and enter into a contract with the recipient of the personal data containing the standard contractual clauses for the protection of personal data adopted by the European Commission under Article 47 of the GDPR.

10.3 If your personal data were to be transferred to a country that does not provide a level of protection equivalent to that ensured by the GDPR, appropriate safeguards will be put in place to ensure a level of security and protection appropriate to the nature of the data transferred. You will be informed of the safeguards put in place via your dedicated portal and/or by email, and if you would like more information you may always contact the Data Protection Officer of the 101 Genomes Foundation via dpoAT101gDOTorg.

  1. What retention periods apply?

11.1 We ensure that your personal data is retained only for a period not exceeding what is necessary in view of the purposes for which it is processed.

11.2 We retain accounting documents (which may include some of your personal data) for a period of seven (7) years following their date of issue in accordance with accounting law. These documents contain the personal identification data, professional identification data and contact details of representatives of our clients.

11.3 We retain the data to which you have given us access for the entire duration of the projects in which you participate (such as Genome4Good). In any event, your personal data is retained for the time required by regulations.

11.4 We also use the following criteria to determine the retention period for personal data depending on the context and purposes of each processing activity:

  • the date of our last contact;
  • security reasons (for example, the security of our information systems);
  • any ongoing or potential dispute or litigation with a data subject;
  • any legal obligation to retain or erase personal data (for example, a retention obligation imposed by an accounting or tax law).
  1. What are your rights?

12.1 Subject to the limitations contained in the Applicable Data Protection Legislation, you have a right to information, a right of access to, rectification and erasure of your personal data, the right to object to or restrict the processing of your personal data, a right to data portability, and the right to withdraw your consent.

12.2 You will find below a table describing each of your rights in more detail:

Right Description
The right to information You have the right to obtain clear, transparent and understandable information on how we process your personal data and on the exercise of your rights. This information is contained in the Policy. If it is not sufficiently clear, we invite you to contact us (using the contact details set out in the Policy).
The right of access You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, where it is, access to that personal data. You have the right to obtain a copy of your personal data, unless exercising this right would adversely affect the rights and freedoms of others.
The right to rectification You have the right to obtain the rectification of personal data concerning you if it proves to be inaccurate. You also have the right to have personal data concerning you completed if it proves to be incomplete.
The right to erasure (the “right to be forgotten”) You have the right to obtain the erasure of your personal data. However, the right to erasure (or the “right to be forgotten”) is not absolute and is subject to specific conditions. We may retain some of your personal data to the extent permitted by the Applicable Data Protection Legislation, in particular where its processing remains necessary to comply with a legal obligation to which we are subject or for the establishment, exercise or defence of legal claims.
Right to object to processing You have the right to object to certain types of processing (where processing is based on our legitimate interests and, taking into account your particular situation, your interests or fundamental rights and freedoms prevail).
Right to object to processing for marketing purposes You have the right to object at any time to the processing of your personal data where we process such data for marketing purposes.
The right to restriction of processing You have the right to obtain restriction of processing in certain circumstances (for example where we no longer need your personal data but it is still necessary for the establishment, exercise or defence of legal claims).
The right to portability of personal data You have the right, in certain circumstances, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller.
The right to withdraw your consent If you have given us your consent to process your personal data, you have the right to withdraw it at any time.

 

12.3 Please address any request relating to your rights in relation to your personal data that we process in our capacity as controller to our contact person for any questions relating to data protection, using the contact details set out in the Policy. We undertake to respond to your request as soon as materially possible and always within the time limits provided for by the Applicable Data Protection Legislation. Please note that we may retain your personal data for certain purposes where required or permitted by law. Finally, please note that we may, if we have doubts about your identity, ask you for proof of identity in order to prevent any unauthorised access to your personal data.

12.4 Please note that we may charge a reasonable fee based on technical and administrative costs to respond to your request for access to your data and your right to data portability (this contribution must at least cover the full costs we have incurred for the collection, sequencing, processing and storage of the data).

12.5 The groups authorised to have access have access only to your anonymised data or at least pseudonymised data (i.e. so that such data is not linked to your personal identification data). We are the only ones able to link your Research Data to your personal identification data. You acknowledge that, at your request, we will validly comply with your request to exercise (i) your right to object to the processing of your Research Data, (ii) your right to withdraw your consent to the further processing of your Research Data and (iii) your right to delete your Research Data by irreversibly deleting the link between your Research Data and your personal identification data.

  1. What level of security do we ensure?

13.1 We take appropriate technical and organisational measures to ensure a level of security appropriate to the risks related to the processing of your personal data.

Our BioB (biobank) in which biological samples are stored is hosted in France by CryopAL Biobanque Solutions, which holds ISO 9001:2015 (No. 181277/1415F) and ISO 20387:2018 (No. 211277/1415F) certifications; it was approved on April 5, 2022 by the ethics committee of Erasme Hospital (Brussels – Belgium) and received notification number BB220008 from the Belgian Federal Agency for Medicines and Health Products (FAMHP) on June 9, 2022.

Our Genomic Cloud in which the IT data is stored is built in Azure and has achieved ISO 27001:2013 certification level (+Defender 100% Secure score). After consultation with our data access committee (DAC), bioinformatics researchers may be granted access to a query interface for our Genomic Cloud in order to conduct their research. The electronic data we collect does not leave the instance where it is stored in our Genomic Cloud. Researchers authorised to query the data may conduct their analyses on copies of the data, but they can neither extract nor save the data locally. Only the research results are retrieved and belong to the researchers.

13.2 We follow industry best practices to ensure that personal data is not, accidentally or unlawfully, destroyed, lost, altered, disclosed without authorisation, or accessed without authorisation.

  1. Do you have any questions or complaints?

14.1 If you have any questions or complaints about the way we process your personal data, please address them first to our contact person for any questions relating to data protection, using the contact details set out in the Policy.

14.2 You have the right to lodge a complaint with the competent supervisory authority. The competent authority for Belgium is the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be.

  1. Anything else?

15.1 We reserve the right to update the Policy from time to time. We will inform you of any changes we may make to the Policy.

15.2 In the event of a conflict or incompatibility between a provision of the Policy and a provision of another policy or another document relating to the processing of personal data, the provision of the Policy shall prevail.