Protection of personal data

Purpose and scope

The Institut du Cerveau et de la Moelle épinière fundation is a private foundation recognized as a public utility by decree on September 13, 2006. Its aim is to support and develop research into the brain and spinal cord, and it is headquartered at Hôpital Pitié Salpêtrière, 47 boulevard de l'Hôpital, 75013 Paris. Paris Brain Institute is particularly committed to protecting the personal data and privacy of all those with whom it interacts via all digital or paper media, including its website www.icminstitute.org. In accordance with the applicable legal and regulatory provisions, in particular Law no. 78-17 of January 6, 1978 relating to information technology, files and freedoms, known as the “Information Technology and Freedoms” Law, as amended, and European Regulation no. 2016/679/EU of April 27, 2016 (applicable since May 25, 2018) on data protection (“RGPD”), the Institut du Cerveau, as data controller, processes and protects the personal data it collects. In addition, L'Institut du Cerveau has appointed a Data Protection Delegate, who is the main contact for the Commission Nationale de l'Informatique et des Libertés (CNIL) and the association's point of reference on personal data protection issues, with the CNIL and those affected by personal data processing. 

Publics

The audiences concerned by this policy include employees and candidates, as well as staff working for Paris Brain Institute, foundation partners, patrons, donors, prospects, testers, visitors to our premises, visitors to our website(s), partners, researchers, ... anyone in contact with the Brain Institute. The processing of health data for research purposes in the field of health is not covered by this policy and will give rise to a specific institutional policy. 

Nature, relevance and proportionality of data collected

The personal data that may be collected by Paris Brain Institute, regardless of the medium, includes the following:

• Identification data: surname, first name, title, age/date of birth, photograph,
• Contact data: postal address, e-mail address, telephone number,
• Transactional data: bank details, amount and date of donation or invoice,  
• Connection data: date, time, IP address, technical identifiers, software and hardware, cookies,  
• Life data: interests, personal or professional life, family, etc.

Only data that is adequate, relevant and limited to what is necessary for the purposes for which it is processed should be collected and processed. We take great care to ensure the accuracy of your personal data by regularly updating it.  March 2022 Policy for the protection of your personal data 3/7 Depending on the purpose, this data may be mandatory or optional, as specified at the time of data collection. Optional data is collected to get to know you better and to enable us to send you personalized communications and offers tailored to your expectations and profile (donors, researchers, visitors, etc.). Your data may be collected directly from you (via the contact form, donation form, application form, etc.) or indirectly (e.g. via partners or subcontractors, etc.).

Processing purposes

The mission of Paris Brain Institute is to understand how the healthy brain functions, and the causes and mechanisms of nervous system diseases, with a view to rapidly developing treatments and applying them to patients as quickly as possible.  

• To fulfill its mission, the Institut du Cerveau collects personal data for the following main purposes:  
• Ensuring the Institute's internal and external communications,
• Manage subscriptions: newsletter,
• Manage applications (job, internship, volunteer),
• Inform you of your requests (information, exercise of personal data protection rights, etc.),
• Provide you with access to information and services,
• Manage our events (seminars, conferences, etc.),
• Ensure proper administrative management of donations,
• Inform and solicit you for fund-raising campaigns,
• Manage and monitor the processing of bequests and donations,
• Meet legal and administrative obligations imposed by regulations and contracts,
• Manage relations with the Institute's suppliers,
• Collect data for statistical purposes (e.g. site traffic analysis),
• Guarantee the security of information systems and premises.

Should we use your personal data for purposes other than those defined, we undertake to keep you informed.

Legality of treatment

Depending on the processing carried out on your data, the Brain Institute relies mainly on one or more legal bases likely to make the processing of your data lawful.

• The consent of the data subject to the processing of his/her data (e.g. for your subscription to our newsletter),
• The legitimate interest pursued in the context of our activities and missions (e.g. to solicit you as part of fund-raising campaigns),
• Compliance with a legal obligation to which we are subject (e.g. to manage our accounting or human resources),
• Performance of a contract. 

Security measures taken to ensure data confidentiality, integrity and availability

We undertake to process your data securely in order to guarantee its confidentiality, integrity and availability. To this end, we undertake to take appropriate physical, technical and organizational measures to guarantee a level of security appropriate to the risks to individuals. Security measures are reviewed on a regular basis, and adjusted to take account of changing risks. We attach great importance to working only with subcontractors and partners offering sufficient guarantees to comply with French and European regulations on the protection of personal data, and ensure that the service is formalized in a contract defining the obligations of the parties in terms of data protection. 

Limited data retention

We store your personal data for a period strictly necessary for the purposes for which it was collected and processed. When the retention periods expire, your data is deleted or made anonymous so that it can be used without infringing your rights. Nevertheless, your data may be archived beyond the stipulated periods for statistical or scientific research purposes, in accordance with regulations and subject to the necessary authorizations where applicable.

Recipients of your personal data

Paris Brain Institute only communicates the data it collects to its internal departments authorized by virtue of their functions and to its appointed subcontractors insofar as this is strictly necessary to achieve the purpose(s) of the processing. All persons having access to data are bound by a written and signed obligation of confidentiality. The Institut du Cerveau requires all its subcontractors who process or are likely to process personal data on its behalf to comply with the regulations in force, and to guarantee their obligations to the public and the authorities.

• Special cases of data exchanged with other associations

In order to limit fundraising management costs, the Institut du Cerveau may share your data with external partner organizations. You have the right to object to exchanges with other associations for their own fund-raising campaigns by exercising your right to object to the exchange directly with the Donor Service. 

Transfer outside the European Union

As a matter of principle, Paris Brain Institute endeavors not to transfer personal data outside the European Union or to a country that does not offer an equivalent level of protection. Nevertheless, Paris Brain Institute may outsource some of its processing operations, and may therefore transfer data outside the European Union. In the event of such transfers, Paris Brain Institute undertakes to take all contractual, technical and organizational measures to guarantee an adequate level of protection for your personal data and to provide you with access to the documents authorizing the transfer.

Your rights concerning your personal data

In accordance with applicable laws and regulations on the protection of personal data, you have a number of rights in relation to your Data, namely:

• A right to be informed you have the right to be informed in a concise, transparent, intelligible and easily accessible manner of how your Data is processed,
• The right to object to / consent to the processing of your Data, depending on the nature of the processing,
• a right of access to the information concerning you, in order to verify its accuracy and, if necessary, to rectify, complete or update it. Ex: change of address),
• The right to have your data deleted,
• The right to limit data processing: the right to temporarily block the use of your data, i.e. to prevent any operation from being carried out on it,
• A right to data portability: the right to recover the data you have provided in a commonly used and machine-readable form, for your personal use or for transmission to a third party of your choice. This right only applies when the processing of your Data is based on your consent, on a contract and when this processing is carried out by automated means.

You also have the right to define what happens to your personal data after your death. To exercise your rights or if you have any questions about the Institut du Cerveau's personal data protection policy, you can send a request to the attention of our Data Protection Officer:

• Using the rights request form, available by clicking here: https://institutducerveau-icm.org/fr/gerer-mes-donnees-personnelles/,
• By post: DPO, Institut du Cerveau, Hôpital Pitié-Salpêtrière, 47 bd de l'Hôpital, 75013 Paris,
• By e-mail: dpo@icm-institute.org. 

Paris Brain Institute undertakes to respond to requests made through these three channels within 30 days. You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés - CNIL - the French personal data protection authority, 3 Place de Fontenoy - TSA 80715, 75334 PARIS CEDEX 07 or online at https://www.cnil.fr “ if, after contacting us, you are not satisfied with the follow-up we have given to your requests and/or the processing of your data. Request form for exercising rights - collection of funds The information collected in this form is processed as part of the management of requests you may make to exercise the rights you have concerning your personal data. The data collected on this form is kept for the time required to process the request, and is recorded in a register of “requests to exercise rights” in compliance with current regulations and on the basis of legal obligation. The data is intended exclusively for the Donors Department and Paris Brain Institute Data Protection Officer. If a copy of your proof of identity is required to exercise a right, it will be kept for two (2) months. 

Modification of the privacy policy

Paris Brain Institute reserves the right to change the Privacy Policy at any time to take into account changes in new regulations and its uses.