# Personal data protection # "How to"s # How to report a data breach **- Who reports**: Any **employee** of DOME's partners, or any data subject that might have been affected by a data breach in a processing activity that relates to the DOME project, who becomes aware of an incident must immediately report the incident. In addition, the identification of an incident may occur through sources internal or external to DOME. - **How and when to communicate** : This communication will be done **within the first 24 hours after the occurrence of the incident **by sending an email to the Privacy Helpdesk to the mailbox . - **What is communicated**: It is essential that as much information as possible is provided in detail to the Privacy Helpdesk staff about what has happened. The communication should contain the following minimum information and answer the following questions: - - When: Day and time when the incident occurred and when it was recorded. - Where: place where the incident occurs. - What: description of what happened in the incident, description of the actual and potential consequences, equipment, systems and data categories affected, facts related to the incident. What kind of personal data was affected (e.g., health data, religion, sexual orientation, data of minors, fingerprints, images, voice or data on union membership). - How much personal data may have been compromised? - Who: companies involved, people involved. - Any other information you consider relevant. # How to request a data removal A data subject might submit a data removal or data erasure request by electronic means at any time. This data removal request will be addressed to the following address : The data subjects will be informed of the need to include in its request's subject "EXERCISE OF RIGHTS DOME", in order for the Partner to be able to identify the processing activity it relates to. Data subjects will also be permitted to act on their rights via postal service requests to a particular Partner, however, in this type of requests they will also necessarily need to include in its subject "EXERCISE OF RIGHTS DOME". In any and all formats, the data subject will necessarily need to specify the data protection right that they are requesting, which will mean that we recommend that the request's subject will actually contain the following phrase : "EXERCISE OF DATA REMOVAL DOME". When the data subject submits the request by electronic means, and unless the data subject requests otherwise, the information necessarily contained in the response will be provided in a commonly used electronic format. **** # How to request a data update A data subject might submit a data update request by electronic means at any time. This data update request will be addressed to the following address: The data subjects will be informed of the need to include in its request's subject "EXERCISE OF RIGHTS DOME", in order for the Partner to be able to identify the processing activity it relates to. Data subjects will also be permitted to act on their rights via postal service requests to a particular Partner, however, in this type of requests they will also necessarily need to include in its subject "EXERCISE OF RIGHTS DOME", as was also obliged in the electronic format. In any and all formats, the data subject will necessarily need to specify the data protection right that they are requesting, which will mean that we recommend that the request's subject will actually contain the following phrase : "EXERCISE OF DATA UPDATE DOME". In the body of the request, they will need to specify the data that they wish to modify, When the data subject submits the request by electronic means, and unless the data subject requests otherwise, the information necessarily contained in the response will be provided in a commonly used electronic format. **** # How to report a provider data breach **- Who reports**: Any **employee** of DOME's partners, or any data subject that might have been affected by a data breach in a processing activity that relates to the DOME project, who becomes aware of an incident must immediately report the incident. In addition, the identification of an incident may occur through sources internal or external to DOME. - **How and when to communicate** : This communication will be done **within the first 24 hours after the occurrence of the incident **by sending an email to the Privacy Helpdesk to the mailbox . - **What is communicated**: It is essential that as much information as possible is provided in detail to the Privacy Helpdesk staff about what has happened. The communication should contain the following minimum information and answer the following questions: - When: Day and time when the incident occurred and when it was recorded. - Where: place where the incident occurs. - What: description of what happened in the incident, description of the actual and potential consequences, equipment, systems and data categories affected, facts related to the incident. What kind of personal data was affected (e.g., health data, religion, sexual orientation, data of minors, fingerprints, images, voice or data on union membership). - How much personal data may have been compromised? - Who: companies involved, people involved. - Any other information you consider relevant. # How to get in touch with the DPO The DOME Project's Data Protection Officer has been set up as a Data Protection Board, made up of representative from a member of each Work Package Leader, as well as representation from the Privacy&Ethics by Design Officer. The Data Protection Board can be reached at . # DOME operator privacy information consent # Information consent form **Information about your involvement and your rights** In this case, your participation will consist on \[FILL WITH SPECIFICS\]. - Your responses to any workshop/webinar/testing lab discussion, or any interview/survey/questionnaire may be recorded and physical copies of such recordings will be safely stored under lock and key by the DOME partner leading the concerned activities. All the original data provided will be kept by DOME for the period strictly necessary to fulfill the purpose for which the data were collected. - Whenever the information you provide is used eventually for the writing of one of the project deliverable, the Consortium will remove your name and all identifying features of that information so that your identity and experiences remain confidential (unless attribution is required and you have consented to it). You can request a copy of the data you have provided. - Any information that might identify you will be removed. Only the team undertaking the project will be able to access such data. Personal information received will be stored in separate files in a secure manner (including password protection where required). Under the General Data Protection Regulation 2016/679, the Consortium has an obligation to inform you of the purpose of the collection, use, storage and retention of the information you have provided. The project will only collect information that is relevant to its activities. Personal information will be stored on internal servers, and accessible only to the partners involved in DOME. The project will not transfer your personal information to third parties (i.e., people outside the project). The partners will password-protect any and all records with personal data. All computers will also have password protection to prevent access by unauthorised users. Only members of the project staff will have access to the passwords. - This project conforms to European Commission guidelines and comply with the current legislation. - Your responses may result in unexpected and secondary findings, i.e., some information that was not the focus or primary purpose of the question(s). In such cases, you may opt out of your consent for DOME's use of the unexpected findings. Otherwise, DOME will manage the unexpected findings in the same way as the principal findings, e.g. any use of such information will be anonymised. The Consortium will report unexpected findings to the project's Privacy and Ethics Officer (PEO) and, if necessary or if the PEO so chooses, it can evaluate unexpected findings. *In the unlikely event that project staff incidentally collect information or data that appears to disclose criminal or illegal activity, the project staff will follow the relevant legislation in the country where the project activity is being carried out.* You have the following rights:
**Your Rights** **GDPR relevant article(s)**
You can withdraw your consent to the DOME project for its processing of your personal data at any time. Article 7
You can request access to your personal data processed by the DOME project, and information about the processing. Article 15
You have the right to receive the personal data that you have provided to the DOME project in a structured, commonly used, machine readable format, where the project has processing this data in an automated way. Article 20
If your personal data held by DOME is inaccurate, you can request that it be rectified and that this amendment should be processed without undue delay. Similarly, if you feel your personal data is incomplete, you have the right to its completion and can provide a supplementary statement. Article 16
You have the right to be "forgotten" by requesting that your personal data be erased. Article 17
You can request that the processing of your personal data be restricted in certain circumstances, such as where you are contesting its: accuracy; lawfulness; or that the processing of your personal data is no longer necessary for the purposes you gave your consent. Article 18
You have the right to lodge a complaint with a supervisory authority. Article 57
If you have any questions about this activity you can discuss it directly with the team and staff members carrying it out. Alternatively, you can contact **Panagiotis Bouklis (**[**panagiotis.bouklis@eurodyn.com**](mailto:panagiotis.bouklis@eurodyn.com)**)**. You are also free to contact Giovanni Frattini, DOME Project Coordinator, with any queries relating the project itself. The Coordinator's email address is [Giovanni.Frattini@eng.it](mailto:Giovanni.Frattini@eng.it) Concerning the exercise of your rights, please kindly send an email to [privacy.helpdesk@dome-project.eu](mailto:privacy.helpdesk@dome-project.eu). THE DOME PROJECT STAFF # DOME Informed Consent Form ** ** **PARTICIPANT INFORMED CONSENT FORM ** Thank you for attending this activity organised on behalf of the DOME Project by \[institution\]. During this task, notes will be taken and you will be asked to provide your opinions and feedback in your professional capacity. All data collected is confidential and the results will be completely anonymous. The objectives of the Project will be explained and you will have the opportunity to ask questions about the research. By signing the attached informed consent form, you confirm that you understand that you are consenting to participate in the DOME project funded by the European Union (Grant Agreement number 101084071) and coordinated by Engineering Ingegneria Informatica SpA. You confirm that you are aware that the purpose of the activities in which you are participating is to develop a cloud services marketplace for EU users from the private and public sector. In particular: 1. I confirm that I have read and understood the attached participant information sheet and have had the opportunity to ask questions. 2. I understand that my participation is voluntary and that I am free to withdraw at any time without explanation. Furthermore, I have the right to change my mind about participating in the project within one week after finishing this activity. 3. I understand that the project partners will treat confidentially all information I provide them with and it will be anonymous. 4. I agree to have the name of my organisation stated for the DOME project. 5. I understand that my participation should not result in any potential harm or discomfort or benefit. 6. I understand that activity is conducted also on the basis of a questioning technique and that I have the right to refuse to answer certain questions. 7. I agree that notes are taken during the activity to facilitate the collection of my opinions and feedback. 8. I consent to the project team contacting me, if required, as a follow-up to the research/engagement activity. 9. I understand that the project can be published and presented, but my anonymity will be preserved. 10. I confirm that I have been given the contact details of the partner team in charge of my involvement in the project, and I have been informed that I am free to contact Giovanni Frattini, DOME Project Coordinator, with any queries relating to my data or the project itself. The Coordinator's email address is Giovanni.Frattini@eng.it 11. I agree to participate in this DOME Project activity. Name of the participant: .................................................................................... Email: .............................................................. Tel: ................................................................. Signature of the participant: ................................................... Date................................... Name of the staff member: ................................................................................. Email: .............................................................. Tel: .................................................................. Signature of the staff member: .................................................. Date........................