Processing of personal data, GDPR
Here is information on how personal data collected by Luleå University of Technology is processed at the university. The University complies with the General Data Protection Regulation (GDPR).
Luleå University of Technology is responsible for all processing of personal data within its activities. This webpage explains how your personal data is processed within Luleå University of Technology.
- What does the university do with personal data?
- What personal data does the university collect?
- How is your personal data protected?
- Who can access your personal data?
- How long does the university store personal data?
- Rights under the General Data Protection Regulation
- Data to countries outside the EU/EEA
Luleå University of Technology processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, see link below. These rules are referred to below as the General Data Protection Regulation, also known as GDPR.
What does Luleå University of Technology do with personal data?
The university processes personal data in order to fulfill our mission as a government agency and university, i.e. to provide research and education, to interact with society and spread information about the education and events. We also do this to review and develop our activities and to comply with Swedish law.
All processing of personal data within the university takes place to promote these purposes at some stage. The processing must also have a legal basis. Only the personal data needed for the purpose shall be processed.
As an employee, student or external stakeholder, you will receive more detailed information about how your personal data is processed via your contact person, course leader, manager or research leader at the university. If you feel that you have not received information from them, you can contact Luleå University of Technology's data protection officer, see the contact details at the bottom of the page.
What personal data does Luleå University of Technology collect?
At the university, there are various reasons why we process your personal data. The most common reasons are that you are a student, researcher, participant in a study, employee, participant in a conference or other event, if you are applying for a position, or if you have contacted or collaborated with the university for another reason.
Most of this information is collected directly from you. In some cases, we also collect information from other sources, such as the Swedish Tax Agency or the Swedish Board of Student Finance. If this is done and why, we will inform you on a case-by-case basis.
What information we process depends on the reason why we process your personal data, but it may include the following:
- Contact information such as name, address, telephone number and email. Personal identification numbers are processed when necessary to securely establish your identity or to coordinate your data between systems to ensure consistency of information about you.
- Bank and other financial information to pay out money or invoice.
- Personal data collected in the context of participation in a research study.
- Information about study results and other information about your studies at Luleå University of Technology.
- Information about how you use our websites, in order to improve their user-friendliness, for example via cookies.
- Information when participating in conferences or courses.
- Personal data needed for employment or if you apply for a position.
- Images or audio and video recordings from a university event.
How is your personal data protected?
Luleå University of Technology shall ensure that the processing of personal data is protected by appropriate technical and organizational measures. The measures shall be such that they ensure a level of security appropriate to the risk of the processing. The security aspects shall include confidentiality, accuracy and availability, as well as adequate technical protection. For example, only an authorized person has access to the data, the data is encrypted, it is stored in specially protected areas and a copy of the processing is made.
Who can access your personal data?
Much of the information available at Luleå University of Technology constitutes public documents. If your personal data is contained in a public document, anyone who requests the public document can access your personal data, unless confidentiality under the Public Access to Information and Secrecy Act (2009:400) prevents this.
In addition, your data may be disclosed to Luleå University of Technology's partners in research projects, to suppliers or to other parties who need to access them as a result of an agreement between Luleå University of Technology and you, due to a task of public interest, as part of the exercise of public authority or due to a legal obligation that the university has.
A task of public interest is a task that Luleå University of Technology must fulfill according to law or decisions based on law, but which is not directly part of the university's official duties.
When transferring to another party, Luleå University of Technology takes all reasonable legal, organizational and technical measures that may be required to protect your personal data. You will be informed if we plan to disclose information about you to other organizations.
The University will not disclose personal data to other parties without legal support.
How long does Luleå University of Technology save personal data?
We save your personal data only for as long as the purpose of the processing requires, or as long as required by law.
For example, if you are an employee, we process your personal data for as long as necessary to administer the employment relationship.
If you are a student, we process your personal data for as long as you are a student at the university.
If you are a participant in a study, we process your personal data for as long as necessary to ensure the quality of the research.
If you are included in a photo from an event, the image is stored for as long as it is deemed relevant or as long as required by law.
Regarding public documents, personal data in these are handled in accordance with the Freedom of the Press Act (1949:105), the Archives Act (1990:782) and the National Archives' regulations. In many cases, this means that your personal data may be stored for between five years and forever in Luleå University of Technology's central archive.
Data to outside the EU/EEA
Luleå University of Technology may transfer personal data to third countries outside the EU/EEA, especially in the case of international research projects or e.g. exchange studies. The university will then take all reasonable legal, organizational and technical measures necessary to achieve an adequate level of protection for your personal data. You will also be informed of this.
Rights under the General Data Protection Regulation
The Data Protection Regulation gives you as an individual a number of rights against Luleå University of Technology, as follows.
The right of access
You have the right to request an answer to whether Luleå University of Technology processes personal data about you, and to receive a free copy of the personal data processed. If you want to request extracts repeatedly, the university will charge a fee to cover the administrative costs of this. In connection with such a request, the University will also provide further information about the processing, such as its purpose, categories of personal data processed, foreseen storage time, etc.
The right to rectification
You have the right to request that your personal data at Luleå University of Technology be corrected if it is incorrect. You can, for example, do this with a supplementary statement to your contact person, course leader, manager or research leader at the university. Luleå University of Technology is obliged to correct your personal data without undue delay. The university is not obliged to correct your data if they are only processed to document completed research.
The right to erasure ("the right to be forgotten")
You have the right to have your personal data deleted from Luleå University of Technology's system, if the personal data is no longer needed to fulfill the purpose for which it was collected. This may for example be the case if you drop out of your education and want us to delete your personal data.
There may be provisions that require Luleå University of Technology not to delete your data, such as the rules on public documents or on documentation of research or studies. If your personal data has been disclosed to another party, the University will take all reasonable steps to notify those parties of your request for erasure.
If Luleå University of Technology cannot erase your data for legal reasons, we will limit the processing of your data to only what is necessary to fulfill the University's obligations.
The right to restriction of your personal data
You have the right to request that the processing of your personal data is restricted, which means that we ensure that we only process your personal data for certain specific purposes. Luleå University of Technology will restrict processing in the following cases:
- If you claim that the personal data is inaccurate and the university needs time to check the accuracy of the data.
- Luleå University of Technology no longer needs the data, but you request that we continue to store it because you need it to defend legal claims.
- If you object to processing carried out by Luleå University of Technology. In this case, the processing is limited until a balance has been struck between your reasons for the objection and the university's compelling legitimate reasons.
- If you believe that we should delete the personal data, but we cannot do this for any reason.
The right to object to processing
You have the right to object to Luleå University of Technology's processing of your personal data in certain cases, for example in research or educational activities. The university will then cease the processing if we do not have compelling reasons to continue with it, or if the processing is required to safeguard the university's legal claims.
Students' personal data
Information on how the University processes students' personal data can be found at
Personal data and our online forms
For each web form there is a unique text that describes what data we collect, the purpose of the collection and how long we will save your data.
By completing the web form, you agree that your data is collected and processed by Luleå University of Technology. We apply the privacy legislation in force at any given time in all processing of personal data. The legal basis for processing your personal data is your consent.
The personal data we process about you is not shared with anyone outside Luleå University of Technology unless we are required to do so by law. We ensure that the service providers we use for our administration are secure and reliable.
The data controller is Luleå University of Technology, 971 87 Luleå. Telephone: 0920-49 10 00. Organisationsnummer: 202100-2841.
You have the right to contact us if you want information about the data we have about you, to withdraw your consent, to request correction, transfer or to request that we limit the processing, to object or request deletion of your data. The easiest way to do this is to contact us on 0920-49 10 00.
Questions about data protection
If you have questions about data protection, you can always contact the university's data protection officer at dataskydd@ltu.se.
- Regulation (EU) 2016/679 of 27 April 2016 of the European Parliament and of the CouncilRegulation
External link, opens in new window.(EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
- The Swedish Authority for Privacy Protection's - IMY
External link, opens in new window.
If you have a complaint about the university's handling of your personal data, you can contact The Swedish Authority for Privacy Protection's
Updated: