Privacy
Last updated 27.07.2026.
Orion Research Foundation Information Notice.
Orion Research Foundation (“we”, “our”, “us” and “Foundation” is committed to protecting your privacy in compliance with all applicable regulations and ensuring the security of your personal data. This privacy notice explains how we collect, use, and protect your personal information.
Contact Details
Data Controller: Orion Research Foundation sr. (0564489-2)
c/o Orion Oyj,
Orionintie 1a PL 65
02101 Espoo
Representative
Siiri Mäkelä,
tutkimussaatio@orionpharma.com
1. What data do we collect about you?
Application data
- Surname
- First Name
- Title or Occupation
- Gender
- Home Address
- Phone
- ORCID ID
- Personal Identification Number
- Curriculum Vitae
- Name of the Supervisor or Unit Manager
- Location / Place of Study
- Research plan
- Budget
- Previous Grants from the Last Three Years and Pending Applications
Finance Data
- Bank Account Number
- Payment Date
- Payment Amount in Euros
- Receipt Number
User survey data
- Optional applicant survey answers
2. How do we use your data?
We process grant applications and awarded grants by the Orion Research Foundation for various purposes and we ensure compliance with statutory reporting obligations. We do not use automatic decision-making processes. We process your data for following purposes:
Application evaluation and grant management: The grant provider uses your data to evaluate your application for a grant.
Payment of grants: The grant provider needs certain information to be able to pay out grants.
Tax and insurance management: The grant provider has a statutory obligation to report, among other things, the personal identification numbers of the grant recipients to the Tax Administration in the annual report of paid grants, and to a mandatory insurance provider in Finland for arranging mandatory insurance if the conditions are met.
Communication and transparency: The grant provider can contact the applicants and grant recipients. The grant provider gives out a public statement every year on the grants it has given out to ensure transparency and to communicate with the public.
Archiving and internal accounting: The foundation holds archives to keep a historical record of it’s grants.
Feedback and service development: The foundation uses feedback provided by applicants and grant recipients to better understand the needs of the research community and to improve its services, grant processes, communications, and overall operations.
3. Legal Basis
We process your data based on the following legal grounds:
| Consent of the data subject (EU General Data Protection Regulation Article 6.1.a) / 9.2.a) (special categories of data) | Application data for Application evaluation and grant management Financial data for Payment of grants User survey data for Feedback and service development Application data (name, title, project name, project organization) and Financial data (grant sum) for Communication and transparency |
| Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract / (EU General Data Protection Regulation Article 6.1.b) | N/A |
| Compliance with the controller’s legal obligations based on binding law / (EU General Data Protection Regulation Article 6.1.c) | Application data (name, personal identification number, contact information) and Financial data (except for account number) for Tax and insurance management |
| Legitimate interests of the controller or a third party (the legitimate interest to be identified, such as direct marketing) (EU General Data Protection Regulation Article 6.1.f). | Application data (name, title, project name, project organization) and Financial data (grant sum) for Archiving and internal accounting |
4. How do we share your data?
We may share your data with the following recipients:
- Application data and Financial data with: our platform service provider Utdelningsstiftelsen för Svenska kulturfonden sr.
- Application data and Financial data with: The Finnish Tax Administration, MELA (The Farmers’ Social Insurance Institution), The Finnish Ministry of Education and Culture’s Research Information Hub
5. How long do we store your data?
We will retain your personal data for no longer than is necessary for the purposes defined in this Statement.
| Type of data | Retention period |
| Application data | If a grant is not awarded, application is deleted within a year (1). If a grant is awarded, application is deleted after ten (10) years. The retention period for Application data (name, title, project name, project organization) for Archiving and internal accounting purposes is not limited. User profiles are deleted after two (2) years of inactivity on the profile. |
| Financial data | Ten (10) years from collection. The retention period for Financial data (grant sum) for Archiving and internal accounting purposes is not limited. |
| Survey data | Survey data is stored for a maximum of five (5) years. The data may be anonymized earlier and, in any case, no later than at the end of the retention period. Once the data is anonymized it is retained only as aggregated statistical information, and the retention period is not limited. |
6. What are your rights and options?
You have the right to:
Access your data: You can request information and a copy of your personal data that we have collected and stored in connection with our services / this information notice.
Rectify inaccurate data: In order to keep your data up-to-date and accurate, you can request us to modify your data by contacting us as descripted in chapter 10.
Erase your data: You can contact us if you think the processing of your personal data is unlawful and your data should be erased. We shall erase or anonymize your personal data without undue delay in accordance with the retention periods detailed in chapter 7 if the data in question is erroneous, unnecessary, incomplete or obsolete as regards the purpose of the processing.
Restrict processing: If you want to restrict our processing of your personal data, please contact us.
Withdraw consent: You can withdraw any consent that you may have given us for data processing activities. After withdrawing your consent, we will no longer process your personal data for purposes the consent was asked for.
Please note that withdrawal of consent does not render the processing of personal data performed prior to such withdrawal unlawful.
The data subject person may object to personal data being processed when applying, but this means that the processing of the application is disrupted.
7. Cookies and Tracking Technologies
Orion Research Foundation website uses only technically necessary cookies. For information on how Rimbert uses cookies, please read Cookies.
8. Security Measures
We have implemented appropriate measures to ensure the level of security around your personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage to it.
When processing applications and data, the privacy of the applicants shall not be put at undue risk. The documents are only handled by persons whose duties require it. Persons with access to personal data are under professional secrecy.
Rimbert is an application and processing system for grants, which is maintained and owned by Utdelningsstiftelsen för Svenska kulturfonden sr. The Orion Research Foundation sr. has a right to license the programme. The license does not include access to the programme code, nor does it allow transfer of use to a third party. The right to use also does not entail a right to make changes to the system.
Applications, data, and application appendices shall be protected by Utdelningsstiftelsen för Svenska kulturfonden sr. from unauthorised access.
The applicants’ connections to the web service for the application and processing of grants is protected by SSL encryption which Utdelningsstiftelsen för Svenska kulturfonden sr. is responsible for.
Utdelningsstiftelsen för Svenska kulturfonden sr. has an agreement with Hetzner Online GmbH who is responsible for storing the service and register in Hetzner Finland Oy’s cloudservice. Both Hetzner Online GmbH and Hetzner Finland Oy are ISO27001 certified, certifying that they have established and implemented an appropriate Information Security Management System (ISMS). Password protected administrator access to the register is only given to named individuals by Utdelningsstiftelsen för Svenska kulturfonden sr.
We have agreed on security-related measures with the third parties we share your personal data with to ensure that it is treated by those third parties in a way that is consistent with how we safeguard your personal data.
We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable supervisory authority where we are legally required to do so.
9. Changes to this Notice
We reserve the right to change this notice from time to time. We will review this notice periodically and update it accordingly if we change our processes materially. We may make changes to this notice when we believe it is reasonable to do so e.g. to comply with legal or regulatory requirements.
10. Contact Us
If you wish to use your rights as a data subject described in chapter 6, or if you have any questions or concerns, please contact us at tutkimussaatio@orionpharma.com
Please note that we will contact you to verify your identity in order to proceed with your request if you wish to use your data subject rights.