1. We are the controller - how do you contact us?
The LEGO Foundation is the data controller for the processing of the personal data that we have received about you. You can find our contact information below:
LEGO Fonden
Højmarksvej 8, st.
7190 Billund
Denmark
CVR-nr.: 12458339
e-mail: [email protected]
If you have any questions about our processing of your information, you are always welcome to contact us.
You can contact our Administration officer if you have a request, comment, or a question about this Privacy Policy, please contact:
LEGO Fonden
Att.: Tina Bache
Højmarksvej 8, st.
7190 Billund
Denmark
Email: [email protected]
2. The purposes and legal basis for the processing of your personal data
We process your personal data for the following purposes:
- Administrate and donate LEGO® MRI models
- The legal basis for processing your personal data is contract or assessment prior to entering a contract with you based on the GDPR art. 6(1)(b)
- Deliver donations
- Fulfillment of contract by delivering the LEGO® MRI Model is based on the GDPR art. 6(1)(b)
- Perform survey
- The legal basis is your consent GDPR art. 6(1)(a)
3. Categories of personal data
We process the following categories of ordinary personal data about you:
- Name
- Place of work
- Work email
- Work phone
- Country
- Survey answers (only consent)
4. Recipients or categories of recipients
We transfer your personal data to the following recipients:
We transfer the personal data to providers of various services (data processors) who process the personal data on behalf of the LEGO Foundation and in accordance with our instructions. We use data processors to deliver: IT systems, web solutions, software, support, or consultancy services.
Moreover, we may disclose your data to auditors, lawyers, and other advisers as well as public authorities where required by legislation.
We disclose your personal data to the following recipients:
- LEGO System A/S for delivery of donated LEGO® MRI Models you can find the privacy policy of LEGO System here: https://www.lego.com/legal/legal-notice/privacy-policy-full/.
5. Transfer to recipients in third countries, including international organizations
We transfer, store, and process your data (including personal data and content) both inside and outside Denmark. Wherever in the world your personal data is transferred, stored, or processed by us or by a supplier on our behalf, we will take reasonable measures to protect your personal data.
In some cases, we will transfer your personal data to countries outside the EU/EEA. If your personal data is transferred to countries outside the EU/EEA, such transfer will be made on the following legal basis:
- Binding company rules
- The country has been approved as a so-called ‘safe’ non-EU/EAA country.
- If the country has not been approved as a ‘safe’ non-EU/EEA country, we transfer data based on standard provisions adopted by the European Commission (Standard Contractual Clauses) or based on any other contract that has been approved by the competent authority.
We use Microsoft Azure with data storage within the EU/EEA. However, data may be transferred or accessed from locations in third countries. Should this be the case, the transfer basis will be the standard contractual clauses of the European Commission.
6. Where your personal data comes from
The data you have provided in the signup form.
7. Storing your personal data
We store your personal data as follows:
If the hospital receives a donation (LEGO ® MRI Model) and you do not wish to receive a survey from us, we delete your data 6 months after the donation. We will keep the name of the hospital and department to be able to handle future inquiries.
If the hospital receives a donation (LEGO ® MRI Model) and you wish to receive a survey from us, we delete your signup information after the survey has been completed. We keep your consent for 5 years as this is the limitation period set out in the Danish Data Protection Act. We will keep the name of the hospital and department to be able to handle future inquiries.
If you are not eligible for a donation or not one of the first 600 applicants, we will delete your data when the donations have been completed.
8. Automatic decisions, including profiling
We do not use automatic decisions.
9. The right to withdraw consent
You have the right to withdraw your consent at any time. You can do this by contacting us using the contact information shown above in point 1.
If you choose to withdraw your consent, it does not affect the legality of our processing of your personal data on the basis of your previously announced consent and up to the time of withdrawal. Therefore, if you withdraw your consent, it will only take effect from that point on.
10. Your rights
Under the Data Protection Regulation, you have several rights in relation to our processing of information about you.
If you wish to exercise your rights, please contact us.
You have the right to access the information we process about you, as well as a number of additional information.
You have the right to have incorrect information about yourself corrected.
In special cases, you have the right to have information about you deleted before the time of our general deletion occurs.
In some cases, you have the right to have the processing of your personal data restricted. In future, if you have the right to have the processing restricted, we may only process the data – other than storage – with your consent, or for the purpose of establishing, asserting, or defending legal claims, or to protect a person or important public interest.
In some cases, you have the right to object to our or lawful processing of your personal data.
In some cases, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have that personal data transferred from one data controller to another without hindrance.
You can read more about your rights in the Danish Data Protection Agency's guidance on the rights of data subjects, which you can find at www.datatilsynet.dk.
11. Cookies
We use cookies on our website.
See more in our cookie policy here https://learningthroughplay.com/cookie-policy/
12. Links to other websites, etc.
Our website may contain links to other websites or to integrated sites. We are not responsible for the contents of the websites of other companies or for the practices of such companies regarding the collection of personal data. When you visit other websites, you should read the owners' policies on the protection of personal data and other relevant policies
13. Complaint to the Danish Data Protection Agency
You have the right to lodge a complaint with the Danish Data Protection Agency if you are dissatisfied with the way we process your personal data. You can find the Danish Data Protection Agency's contact information at www.datatilsynet.dk.
This Privacy Policy was last updated on 15. February 2022.