Privacy

Privacy notice

The Nordic Institute for AI Risk and Resilience (“NIARR”, “Association”, “we”, “us”, or “our”) is an independent Nordic NGO dedicated to advancing interdisciplinary understanding, responsible AI governance, and societal resilience in an era of increasingly capable artificial intelligence. We are committed to ensuring that privacy and data protection are respected in all activities involving the processing of personal data. We always strive to ensure that your personal data is processed lawfully, fairly, and transparently.

This Privacy Notice explains how we collect, use, store, and share your personal data. It also describes your rights and how you can exercise them.

We encourage you to read this notice carefully. If you have any questions regarding our processing of your personal data, please contact us using the details provided below.

What is personal data?

Personal data means any information relating to an identified or identifiable natural person. Examples include:

Name
Address
Contact information
Photographs
Audio or video recordings
IP addresses
Personal identity numbers
Any other information that can be linked to a living individual

Processing of personal data includes any operation performed on personal data, such as collection, registration, storage, use, disclosure, transfer, or deletion.

Data controller

The Nordic Institute for AI Risk and Resilience determines the purposes and means of the processing of personal data in connection with the activities of the Association. This makes us the data controller for any such processing.

Organisation number: 802558-3892
Email address: info@niarr.eu

How we process personal data

Depending on the nature of your interaction with NIARR, the same personal data may be processed for several related purposes. For example, information collected to administer your membership may also be processed to send you communications related to upcoming events and your personal data may also be retained to satisfy legal, governance and accounting requirements.

Information about our processing of personal data is further specified below.

Membership administration, including volunteers

Purpose: Membership administration
Processing activities: Registration of members
Administration of membership benefits
Handling of membership fees
Administration of participation in Association-related activities, including annual meetings
Communication with members
Categories of personal data: Name
Personal identity number (only when strictly required)
User account information
Billing information
Contact details
Location/city
Employer
Job title
Correspondence related to membership or participation in activities
Legal basis: Performance of a contract (GDPR, Article 6(1)(b))
The processing of your personal data is necessary for entering into, or performing our contract with you.
Retention period: Personal data is processed while you remain a member and retained for up to one year thereafter.
Protocols and participant lists containing names and personal identity numbers as well as other information recorded in meeting minutes may subsequently be archived in accordance with applicable rules which the Association is subject to.
Personal data may also be retained for longer periods where required by law, for example for book-keeping and accounting purposes.
Recipients: Personal data may be shared with:
Accounting and membership administration providers
Service providers used for internal operations, document storage and email
Website hosting and support providers
IT service providers

Administration of events

Purpose: Administration of participation in activities such as training sessions, seminars/webinars, conferences, workshops, or other events arranged by the Association.
Processing activities: Verification of membership status
Administration of participation fees
Distribution of information related to the event
Speaker information, including bio and photographs
Other necessary administration related to the event
Categories of personal data: Name
Personal identity number (where applicable)
Contact details
Organisational affiliation
Payment information
Correspondence related to participation
Legal basis: Performance of a contract (GDPR, Article 6(1)(b))
The processing is necessary for us to fulfil our commitments towards our members and other individuals registered for events arranged by the Association.
Legitimate interest (GDPR, Article 6(1)(f))
The Association has a legitimate interest in processing personal data relating to participants, speakers, and other individuals who do not have a contractual relationship with the Association where such processing is necessary for the administration of events.
Retention period: Data is retained from registration until completion of the activity and for a maximum of two years thereafter.
Depending on the activity concerned, participant lists containing names and personal identity numbers and information included in official minutes may be archived.
Personal data may also be retained for longer periods where required by law, for example for book-keeping and accounting purposes.
Recipients: Personal data may be shared with:
Event administration providers
Accounting providers
Website hosting providers
IT service providers
Event speakers, trainers, and facilitators, where necessary to support the quality and effective delivery of events.

Marketing of the Association and its activities

Purpose: Promotion of the Association and its activities and publication of material from activities.
Processing activities: Photography at events (in-person and virtual)
Audio and video recording at events (in-person and virtual)
Publication of photographs and recordings in different channels such as our website, presentation material and social media.
Categories of personal data: Images
Audio recordings
Video recordings
Legal basis: Legitimate interest (GDPR, Article 6(1)(f))
We have a legitimate interest in documenting and promoting our activities.
The processing is intended to promote the Association and its activities before, during, and after events. Where recording or photography takes place, participants will be informed.
Reasonable opportunities will be provided for individuals who do not wish to appear in recordings or photographs where practical.
Retention period: Recordings and photographs are retained only while they remain relevant and continue to have informational or news value.
Recordings and photographs published on social media may remain accessible for longer periods, depending on the social media platforms’ policies and practices regarding published content.
Recipients: Personal data may be shared with:
Members
The public (e.g. through social media)
Service providers
Website hosting providers
IT service providers
Public authorities and organisations that provide funding

Communications

Purpose: Managing and maintaining relationships and communications with members, partners, suppliers, sponsors, and other stakeholders in connection with the Association's activities and operations.
Processing activities: Handling enquiries submitted by email, LinkedIn, contact forms or other channels
Distribution of newsletters and other marketing communications
Supplier and sponsor communications
Categories of personal data: Name
Contact details
Any information voluntarily provided by you
Legal basis: Legitimate interest (GDPR, Article 6(1)(f))
We have a legitimate interest in communicating with members and other stakeholders or individuals that we have a relationship with.
Consent (GDPR, Article 6(1)(a))
You may sign up to receive newsletters and other information from NIARR. We process your personal data for as long as you remain subscribed to the newsletter. You may withdraw your consent at any time by using the unsubscribe link included in each newsletter. Once you unsubscribe, you will no longer receive newsletter communications from NIARR.
Retention period: As long as we have an ongoing business relationship with you or until you notify us that you no longer wish to receive invitations from us.
Recipients: Personal data may be shared with:
Internal service providers
Website hosting providers
IT service providers

Surveys, statistics and follow-up activities

Purpose: Improvement and development of the Association's activities and production of statistics.
Processing activities: Distribution of surveys
Compilation of survey responses
De-identification of personal data
Statistical analysis and follow-up
Categories of personal data: Name
Contact details
Organisational affiliation
Job title
Any additional information provided in responses
Legal basis: Legitimate interest (GDPR, Article 6(1)(f))
The processing helps improve and develop the Association and its activities and allows us to provide relevant statistics to members and stakeholders.
Retention period: Data is retained until the compilation and follow-up process has been completed and for a maximum of two years thereafter.
Following this period, data is retained only in anonymised or de-identified form.
Recipients: Personal data may be shared with:
Website hosting providers
IT service providers

Grant and funding applications

Purpose: Applying for grants and funding to support and develop the Association's activities.
Processing activities: Processing necessary for grant applications and reporting requirements.
Categories of personal data: Name
Personal identity number
Other information required for the application
Legal basis: Legitimate interest (GDPR, Article 6(1)(f))
The processing is necessary to secure funding for the Association's activities. Where activities are funded through grants, relevant information will be provided to participants.
Retention period: Personal data is retained for as long as required for the grant process and for no longer than two years after submission of the application.
Recipients: Authorities or other bodies and organisations from which the Association applies for grants and funding.

Transfer of personal data to third countries

As a general rule, personal data is processed within the EU/EEA. However, we use an event management platform provider that processes personal data in the United States. Where personal data is transferred outside the EU/EEA, we ensure that the transfer is conducted in compliance with the GDPR and is subject to a valid transfer mechanism, such as an adequacy decision adopted by the European Commission or appropriate safeguards that ensure an essentially equivalent level of protection to that provided within the EU/EEA.

Embedded video from YouTube

The page “What happens now?” includes a video of Geoffrey Hinton’s Nobel Prize banquet speech, hosted by YouTube and embedded using privacy-enhanced mode (youtube-nocookie.com). No cookies or tracking identifiers are stored on your device until you click play.

When you click play, the video player is activated and connects to the servers of YouTube and Google. At this point, Google receives your IP address, browser technical information, and request headers. YouTube will also store functional data in your browser: entries in local storage (such as player preferences and captions state) and an IndexedDB database. YouTube may also set cookies, for example if you are signed in to a Google account.

By clicking play, you consent to this data processing (GDPR, Article 6(1)(a)). Your consent covers that viewing session only: the site does not remember it, and the connection is not re-established on a page reload or a later visit unless you click play again. NIARR does not receive or access this data; YouTube processes it in accordance with its own privacy policy.

You can withdraw your consent at any time, as easily as you gave it: clicking “Stop the video and disconnect from YouTube” right below the player removes the YouTube player from the page and terminates the connection. Leaving the page does the same.

Any data YouTube has stored in your browser during playback remains there until deleted, as one website cannot clear another website’s storage. You can remove it at any time by clearing site data for niarr.eu and youtube-nocookie.com (or Google) in your browser’s privacy and storage settings.

Google’s privacy policy

Your rights

The General Data Protection Regulation (GDPR) gives you a number of rights in relation to your personal data. If you wish to exercise any of your rights, please contact NIARR using the contact details provided in this privacy notice.

In summary, you have the right to:

know whether we process personal data about you and receive information about that processing;
access the personal data we hold about you;
have inaccurate or incomplete personal data corrected;
have your personal data erased in certain circumstances;
object to our processing of your personal data in certain circumstances;
request that we restrict the processing of your personal data in certain circumstances;
withdraw any consent you have given;
receive certain personal data in a structured, commonly used and machine-readable format (data portability); and
lodge a complaint with a supervisory authority.

Further information about these rights is provided below.

Right to information and access

You have the right to know whether NIARR processes personal data about you. If we do, you have the right to receive information about the personal data we process, the purposes of the processing, the categories of personal data concerned, and any recipients of the data.

You also have the right to obtain a copy of the personal data we process about you.

Right to rectification

You have the right to request that inaccurate personal data be corrected and incomplete personal data be completed.

Where appropriate, we will inform recipients of your personal data about any corrections, unless this proves impossible or involves a disproportionate effort.

Right to erasure

You have the right to request that we erase your personal data in certain circumstances, including where:

the personal data is no longer necessary for the purpose for which it was collected;
you withdraw consent and there is no other legal basis for the processing;
you successfully object to the processing;
the personal data has been processed unlawfully; or
erasure is required to comply with a legal obligation.

This right is not absolute and may be subject to exceptions under applicable law.

Right to object

Where we process your personal data on the basis of NIARR's legitimate interests, you have the right to object to that processing based on your particular circumstances.

If you object, we will assess whether we have compelling legitimate grounds to continue the processing. If not, we will stop the processing concerned.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes. If you do so, we will stop processing your personal data for those purposes.

Right to restriction of processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, including where:

you contest the accuracy of the personal data;
the processing is unlawful but you do not want the data erased;
we no longer need the personal data, but you require it for the establishment, exercise or defence of legal claims; or
you have objected to processing and we are considering your objection.

Where processing has been restricted, we may still process the data in limited circumstances, such as for the establishment, exercise or defence of legal claims or where required by law.

Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of any processing carried out before the consent was withdrawn.

Right to data portability

Where processing is based on your consent or a contract with you and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.

You also have the right, where technically feasible, to have that data transmitted directly to another controller.

Right to lodge a complaint

If you have concerns about how NIARR processes your personal data, we encourage you to contact us first so that we can try to address your concerns.

You also have the right to lodge a complaint with a supervisory authority. In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You may also lodge a complaint with the supervisory authority in the EU/EEA country where you live, work, or where you believe an infringement of data protection law has occurred.

Changes to this privacy notice

NIARR may update this Privacy Notice from time to time. The latest version will always be available on our website.

Where changes materially affect ongoing processing activities, we will provide appropriate notice through our website and, where applicable, by email.