Privacy policy
The purpose of this Personal Data Protection Policy is to inform individuals, service users, external partners, employees and other persons (hereinafter referred to as “the individual” or “data subject” or “you”) working and/or interacting with Jožef Stefan Institute, (hereinafter referred to as “IJS” or “we” or “Organisation”) of the purposes, legal bases, security measures and rights of individuals with regard to the processing of personal data carried out by Jožef Stefan Institute.
This website is hosted in Slovenia by Jožef Stefan Institute.
We value your privacy, and always carefully protect your data.
We process personal data in accordance with European legislation – Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons regarding the processing of personal data and on the free movement of such data (hereinafter referred to as the “General Regulation”), the applicable Slovenian legislation on the protection of personal data and other legislation that provides us with a legal basis in this regard.
The Personal Data Protection Policy contains information on how we, as controller, process personal data that we receive from the individual.
1. Data Controller
The controller of personal data is:
Jožef Stefan Institute
Jamova 39
1000 Ljubljana, Slovenia
Telephone: +386 1 477 39 00
Mail: info@ijs.si
2. Data Protection Officer
Mail: dpo@ijs.si
3. Personal Data
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
4. Purposes of and Bases for Data Processing
We collect and process personal data on the following legal grounds:
- The processing is necessary to fulfil a legal obligation applicable to IJS.
- The processing is necessary for the performance of a contract to which the data subject is a contracting party, or for the implementation of measures/steps at the request of such an individual prior to entering into the contract.
- The processing is necessary due to the legitimate interests pursued by IJS or a third party.
- The data subject consents to the processing of his or her personal data for one or more specific purposes.
- The processing is necessary to protect the vital interests of the data subject or of another natural person.
4.1 Personal data processed by SQUASH project – data necessary for the entering into and performance of a contract
If you apply to the SQUASH open calls, we collect all your data provided in the application platform for the purpose of the application, evaluation, and the selection procedure, as well as for the purpose of entering into and performance of the contract with the recruited applicants.
We collect and process the following data when you apply to the SQUASH open calls:
Name and surname, Date of birth, Current institution, Phone number, E-mail address, Current country of residence, Sex As it appears in your National ID card or passport, Nationality, Orcid number, PhD awarded date, PhD awarded country, PhD certificate, Scanned PhD certificate document, MSCA mobility, MSCA mobility profs, CV, Data regarding proposal: Proposal acronym, Proposal title, Proposal abstract, Proposal keywords, Selection of primary research area, Selection of a supervisor and alternative supervisor, Selection of a secondment institution.
The above data is necessary for identification of the individual participating in the open calls and to ensure that the individual fulfils the conditions for participating in the SQUASH project and/or for entering into a contract with IJS or with the Faculty of Mathematics and Physics (“SQUASH implementing partner”). Thus, the provision of personal data is necessary for the selection process and entering into the contract. Individuals who do not provide the necessary information may not be able to participate in the selection process and may not be selected. If the individual fails to provide the necessary data upon request, IJS may withdraw from the recruitment procedure. The personal data of our employees, as well as the rights and obligations relating to its processing, will be defined in the employment contract, if and when entered into.
We collect your data so that we can:
- Organise and manage evaluation and selection procedure of the applicants via the application platform (only if you are an applicant to the open calls)
- (Only if you are an applicant to the open calls) We will use your data and share it with the members of the Executive Board to organise the evaluation and selection process; selected referees/evaluators to perform the evaluation process, Governing Board to do the final selection of the applicants following the evaluation ranking list; to our project partner organisations so that any and all reasonable requests for information or follow up may be completed appropriately (e.g. Letter of support of host organisation).
For the purposes of entering into and performance of the contract, some of the above-mentioned personal data may be provided to the SQUASH implementing partner and to SQUASH Associate partners (together “SQUASH project partners”), if the respective individual will be working/cooperating with the SQUASH project partner during the SQUASH project.
The list of SQUASH Associate partners is available on the following website: Slovenian Quantum Science Hub | Discover SQUASH.
If you are applicant to the open calls, the application platform https://join.squash.ijs.si does directly store your data provided in the application platform on Jožef Stefan Institute servers. However, these details are not routinely or directly (automatically) shared with SQUASH project partners.
4.2 Fulfilment of a Legal Obligation
Under the law, we process our employees’ data; this processing is allowed by the labour law and social assistance legislation. Based on the legal obligation for employment purposes, we process mainly the following types of personal data: name, gender, date of birth, personal identity number, tax number, place, municipality and country of birth, nationality, place of residence, etc. The legal basis for the processing of personal data of individuals is also the Exercising of the Public Interest in Culture Act and other legislation governing culture and the meetings industry. In limited cases, the processing of personal data is permissible in the Organisation also on the grounds of public interest.
All sector-specific legislation in force is collected on the website of the competent ministry:
4.3 Legitimate Interests
The legitimate interests of a controller may provide a legal basis for processing, provided that the processing is necessary to pursue the legitimate interests and that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. At any rate, the existence of a legitimate interest is subject to careful assessment in accordance with the General Regulation and other applicable laws.
We process personal data on the basis of our legitimate interests, namely to:
- Carry out the record keeping and periodic reporting which we are obliged to do under our contract with the European Research Executive Agency (“REA”);
- Ensure the publicly funded financing of SQUASH project and thus to facilitate research activities and other activities under the SQUASH project;
- Carry out reviews, audits and investigations of the proper implementation of SQUASH project.
IJS discloses the personal data to the financing organisations (i. e. REA – European Commission, Slovenian Research and Innovation Agency (“ARIS”)) for the periodic reporting purposes, impact evaluation and for checks, reviews, audits and investigations. The data will be provided to the financing organisations to the minimum extent necessary for the purposes of reporting, audits, reviews, investigations and proving eligible costs.
IJS may also process your data to exercise and defend legal claims relating to SQUASH project.
On the basis of legitimate interests, we process the following personal data of the applicants:
Name and surname, E-mail address, Date of Birth, Current institution, Phone number, Address, Country and Current country of residence, Sex as it appears in your national ID card or passport, Nationality, Orcid number, PhD awarded date, PhD awarded country, PhD certificate, MSCA mobility, MSCA mobility proofs, Academic and professional experience, Selection of a Supervisor and Alternative Supervisor, Selection of a Secondment institution, Type of programme, Training activities, Number of months spent on the research training activities, Remuneration etc.
4.4 Processing on the basis of Consent
If there is no legal basis in the law of the Member State to which the controller is subject, contractual obligation or legitimate interest, we may seek consent from the individual. Thus, where the individual gives his or her consent, we may process specific personal data of the individual for the following purposes:
- The e-mail address for information and communication purposes;
- Photos, videos, and other content relating to the individual (e.g., posting of pictures of individuals on our website; recording of interviews) for the purposes of documenting activities and informing the public about our work and events;
- Other purposes to which the individual agrees through giving consent.
The data subject shall have the right to withdraw his or her consent to the processing of personal data at any time. The data subject may request that data processing be suspended, namely by e-mailing or sending a land mail to our address. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
4.4.1. Recording of interviews
Provided that you grant us explicit prior consent, we will record interviews during SQUASH open calls for the purpose of project application evaluation.
The recording is done to facilitate the selection process and to ensure that the interviews can still take place according to the planned timetable, regardless of the possible unavailability of an interviewer/referee/evaluator in the relevant timeslot. Through reviewing the recorded interview, the interviewer/referee/evaluator who will not be present at the interview will still be able to view the recording at a later time and perform their selection/evaluation tasks.
Individuals who apply to SQUASH open calls will therefore be asked to consent to the interview being recorded. The consent shall be given (if any) by filling out and signing a form provided by IJS for each type of the recording. By doing so, the individual agrees to the entire interview being recorded and to IJS using the recording for the purpose of the application, evaluation, and the selection procedure (namely for the purpose of viewing the recording by an interviewer/referee/evaluator who, due to certain personal, technical or other circumstances, was unable to attend the interview). The recording will be deleted promptly after 30 days from our communication of the selection to the candidates, but in any case, no later than within 1 year after the recording was made, providing no legal action is brought against IJS with respect to the selection procedure. The individual has the right to withdraw consent at any time as set forth in section 4.4. of this Personal Data Protection Policy.
If an individual refuses to allow their interview to be recorded, IJS will not record the interview under any circumstances. However, this may affect the duration of the selection process, as an interview date will have to be determined by ensuring the availability of all relevant interviewers/referees/evaluators in the desired timeslot.
4.5 Processing Is Necessary to Protect the Vital Interests of the Individual
The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject. In an emergency, we may search for the individual’s identity document, check whether that person exists in our database, examine his or her medical history or contact his or her family, for which the individual’s consent is not required. All of this applies solely if strictly necessary to protect the vital interests of the individual.
5. Storage and Erasure of Personal Data
We shall store personal data only for as long as necessary to achieve the purpose for which they were collected and processed.
If the data is processed under the law, it is stored for the duration prescribed by law.
Personal data which is processed on the basis of a contractual relationship with the individual is stored for as long as necessary for the contract to be fulfilled and for five years after its termination, except when a dispute arises between the individual and the controller in connection with the contract. In such cases, we keep the data for ten years after the legal effect of a court ruling, arbitration or court settlement, or in the absence of a court case, for five years from the date of the amicable settlement of a dispute.
Unless this Personal Data Protection Policy provides otherwise, we may store the data we process on the basis of the individual’s personal consent until consent has been withdrawn or until a request for data erasure has been submitted. The data is erased within 15 days upon the receipt of a withdrawal of consent or request for data erasure. We may also delete data prior to withdrawal if the purpose of their processing has been achieved or if the law so provides.
Personal data which is processed process on the basis of legitimate interests is stored for the minimal period required by our contract with REA. We store personal data no longer than for five years after IJS receives the final payment from financing organisations. In the event of on-going checks, reviews, audits, investigations, litigation or other pursuits of claims under the agreement with the REA (including the extension of findings), IJS shall keep and process the relevant personal data and other supporting documentation until the end of such procedures.
In exceptional cases, we may refuse a request for erasure of personal data for the reasons specified in the General Regulation, e. g. in case of: the exercise of the right to freedom of expression and information, the fulfilment of a legal obligation to process, reasons of public interest in the field of public health, the purposes of archiving in the public interest, scientific or historical research or statistical purposes, the exercise or defence of legal claims. After the purpose of storing has been served, unless there exist legal grounds, personal data shall be effectively and permanently deleted or rendered anonymous in such a manner that the data subject is not or no longer identifiable.
6. Cookies
The Jožef Stefan Institute’s website works with the help of the so-called cookies. A cookie is a file that stores website settings. Websites store cookies on users’ devices which they access the Internet with to identify individual devices and the settings that users used to access the website. Cookies allow websites to recognize if the user has already visited the website.
Their storage is under the full control of the browser used by the individual – this can limit or completely disable the storage of cookies as desired. Cookies saved by the browser can be deleted by the individual (instructions can be found on the websites of the individual browsers).
Cookies are of fundamental importance for providing user-friendly online services. The SQUASH projects website uses exclusively technical (session, settings) cookies and does not share any such information (cookies), including user identifying information, with any external entity.
Technical cookies:
| Name: | Purpose: |
| cookieyes-consent | Stores information on whether the user provided its consent for the use of cookies or not.
|
| pll_language | Stores information (for 24 hours) on whether the user selected a language other than Slovene language. |
| rl_user_id | Stores information on the “user ID” (session number) in order for the system to recognise the same user. |
7. Subcontracting the Processing of Personal Data and Data Output
The processing of personal data may be entrusted to a subcontractor on the basis of a data processing contract. The data entrusted to a subcontracted processor, in particular Auditing services and other legal and business consultancy providers, Infrastructure maintenance providers (video surveillance, security services), Information systems maintenance providers, E-mail and software service providers, Cloud services, may be processed exclusively on behalf of the controller, within the limits of the powers expressly conferred upon the processor, which shall be recorded in a written contract or other legal act, and in accordance with the purposes set out in this Personal Data Protection Policy.
We do not transmit personal data to third unauthorized parties. Subcontracted processors may process personal data only within the framework of our instructions and may not use it for any other purposes.
IJS as the controller does not transfer personal data to third countries (outside the Member States of the European Economic Area – EU members, as well as Iceland, Norway and Liechtenstein) and to international organisations, except to:
- the USA, whereby relations with US subcontracted processors are regulated on the basis of standard contractual clauses (standard contracts adopted by the European Commission) and/or binding corporate rules (adopted by the organisation and approved by the EU supervisory authorities);
- a third country where a SQUASH project partner is located, if such transfer is necessary to enable cooperation between the selected applicant and the said SQUASH project partner, whereby relations with such subcontracted processors are regulated on the basis of standard contractual clauses (standard contracts adopted by the European Commission) and/or binding corporate rules (adopted by the organisation and approved by the EU supervisory authorities).
For the purposes of better review and control over the subcontracted processors and for the sake of the regularity of contractual relationships, we keep a list of subcontracted processors, which specifies all the processors with whom we have entered into a contractual relationship.
8. Data Protection and Data Accuracy
We dedicate great efforts to ensuring information security and security of infrastructure (premises and application/systems software). Our information systems are protected by antivirus programs and firewalls, among others. We have put in place appropriate organisational and technical security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and against other unlawful and unauthorized forms of processing.
The individual has the sole responsibility for providing his or her personal data securely and for ensuring the data is accurate and authentic. We make great efforts to ensure that the personal data we process is accurate and, if necessary, updated, and may therefore occasionally contact the individual for data validation.
9. Rights of a Data Subject
In accordance with the General Regulation, the individual may exercise the following personal data protection rights:
- The right of requesting information concerning whether we have collected his/her personal data and, if so, which data we have collected and on what basis, as well as the purposes of its use;
- The right to access his/her personal data, enabling him/her to receive a copy of the personal data collected and stored by the Organisation and determine whether the data is processed lawfully;
- The right of rectification: data subject has the right to obtain from the Organisation the rectification of incomplete or inaccurate personal data concerning him/her;
- The right to erasure of personal data when no reason exists for further processing or where he/she exercises his/her right to object;
- The right to object to further processing of personal data, where we refer to the legitimate commercial interest (including the legitimate interest of a third party) on grounds relating to his/her particular situation;
- The right to obtain from the controller restriction of processing which means suspending the processing of data, for example if a data subject wishes to establish the accuracy or verify the grounds for further processing of personal data;
- The right to transmit to another controller the personal data concerning him or her, where technically feasible;
- The right to withdraw the consent given for the collection, processing and transfer of personal data for a particular purpose; Upon receipt of a notice of withdrawal of consent, we shall cease to process personal data for the purposes initially set out, unless we have other legal basis to do so lawfully.
If a data subject wishes to exercise any of the above rights, the data subject may e-mail the request to us. We shall reply to a data subject’s request without undue delay, i.e. within one month at the latest. If this time limit were extended (up to two additional months at the most), taking into account the complexity and number of requests, the data subject shall be informed thereof. Access to personal data and acquired rights is free of charge for the data subject. However, a reasonable charge may be made if the data subject’s request is manifestly unfounded or excessive, especially if submitted repeatedly. In such a case, we may also refuse the request. When exercising rights under this title, we may need to request certain information from the data subject to assist us in verifying the identity of the data subject, which is only a security measure to ensure that personal data is not disclosed to unauthorized persons.
If a data subject has reasonable belief that his or her rights have been infringed, he or she may contact the supervisory body (Information Commissioner) for protection, assistance and/or to lodge a complaint.
Contact information:
- Information Commissioner (Informacijski pooblaščenec)
- Address: Dunajska 22, 1000 Ljubljana, Slovenia
- Mail : ip@ip-rs.si
- Telephone: +386 (0) 1 230 97 30
- Website: https://www.ip-rs.si/.
For any questions regarding the processing of personal data, the individual may always contact us by sending an e-mail.
10. Changes to the Personal Data Protection Policy
You will be informed of any changes to the Personal Data Protection Policy via a specific notice on our website or by email.
By using the website, the individual confirms that they accept and agree to the full content of this Privacy Policy.
This Personal Data Protection Policy is valid as of May 30, 2025.