Last updated: August 21, 2026
Effective: August 21, 2026

About this Privacy Policy

CIRCE – Centre for Interdisciplinary Research on Cancer and Equity in Women – is a research center at Lund University.  CIRCE conducts interdisciplinary research on cancer in women and communicates its research, activities, events, and opportunities for collaboration through CIRCEcenter.org (the “Website”) and related communication channels.

This Privacy Policy explains how personal data may be collected and processed when you visit the Website, contact CIRCE, or otherwise interact with us through services associated with the Website.

This Privacy Policy applies to personal data processed through the Website and related communications.  Personal data processed as part of CIRCE research studies is governed separately by the participant information, ethics approvals, consent procedures where applicable, and other information provided for each individual research study.

Who Is Responsible for Your Personal Data?

Lund University is the data controller for personal data processed through the CIRCE Website.

Data controller:
Lund University
Organization number: 202100-3211
Box 117
SE-221 00 Lund
Sweden

CIRCE is based at Lund University and operates within the University’s framework for data protection and information security.

Personal Data We May Collect

The personal data we collect depends on how you interact with the Website. 

Information You Provide to Us

If you contact CIRCE by email, through a contact form, or through another service provided on the Website, we may process information such as:

• your name;
• your email address;
• your organization or affiliation, if provided;
• your telephone number, if provided; and
• any other information you choose to include in your communication.

Please do not send sensitive personal information, medical records, patient identifiers, biological sample information, or other confidential information through general CIRCE contact channels unless specifically requested through an approved and secure process.

If you subscribe to a newsletter, register for an event, or use another interactive service offered through the Website, we may also collect the information necessary to provide that service.  Information about any additional processing will be provided where appropriate.

Information Collected When You Visit the Website

When you visit the Website, certain technical information may be collected automatically.  Depending on the Website’s technical configuration, this may include:

• IP address;
• browser and device type;
• operating system;
• date and time of access;
• pages visited;
• referring website; and
• other technical information necessary for the operation, security, and maintenance of the Website.

We may also use aggregated or anonymized information to understand how the Website is used and to improve its content and functionality.  Information that has been effectively anonymized so that it can no longer be linked to an identifiable individual is not personal data under the GDPR.

How We Use Personal Data

Personal data collected through the Website may be processed in order to:

• operate, maintain, and secure the Website;
• respond to questions, requests, and other communications;
• administer events, newsletters, or other services you have requested;
• communicate information about CIRCE’s research, activities, events, and opportunities;
• understand how visitors use the Website and improve its content and functionality;
• support CIRCE’s research communication, collaboration, and public-engagement activities;
• fulfil Lund University’s legal and administrative obligations; and
• establish, exercise, or defend legal claims where necessary.

We will not use personal data collected through the Website for purposes that are incompatible with those for which the information was collected.

Legal Basis for Processing

Lund University processes personal data in accordance with the EU General Data Protection Regulation (GDPR), Swedish data-protection legislation, and other applicable laws.

The legal basis for a particular processing activity depends on its purpose and circumstances.

As a Swedish public university, Lund University carries out research, education, and collaboration with society as part of its public mission.  Personal data may therefore be processed when necessary for the performance of a task carried out in the public interest.

In other circumstances, processing may be necessary:

• to comply with a legal obligation;
• to fulfil an agreement or take steps requested by you before entering into an agreement; or
• on the basis of your consent, where consent is the appropriate legal basis.

Where processing is based on consent, you may withdraw your consent at any time.  Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Additional legal requirements apply to the processing of special categories of personal data, including health and genetic information.  Such information used in CIRCE research is handled within the governance and legal framework applicable to the relevant research project and is not governed solely by this Website Privacy Policy.

Cookies and Website Analytics

The Website may use cookies and similar technologies that are necessary for its operation.  Cookies are small files stored on your device that enable websites to function and, depending on the type of cookie, may provide information about how a website is used.

Where cookies or similar technologies that require consent are used, they will not be activated until you have made the relevant choice through the Website’s cookie settings.  You can change your choices through the Website’s cookie settings where available.

Further information about the cookies used on CIRCEcenter.org, their purposes, providers, and retention periods will be provided in the Website’s cookie information or cookie settings.

Sharing Personal Data

Personal data may be accessible to authorized Lund University employees and others who require access in order to perform their duties.

Lund University may also use external service providers to provide services such as website hosting, technical support, communications, event administration, or website analytics.  Where another organization processes personal data on behalf of Lund University, appropriate contractual and data-protection safeguards are used as required by law. 

Personal data may also be disclosed when required by applicable law or pursuant to a lawful request from a competent authority.

We do not sell personal data.

Transfers Outside the EU/EEA

Personal data is processed primarily within Sweden and the European Union/European Economic Area (EU/EEA).

If a service used by the Website involves the transfer of personal data to a country outside the EU/EEA, Lund University will ensure that the transfer is carried out in accordance with applicable data-protection law and that appropriate safeguards are in place where required.

Public Access to Official Documents

Lund University is a Swedish public authority and is therefore subject to the Swedish principle of public access to official documents (offentlighetsprincipen)

This means that communications and other documents received or created by Lund University may become official documents and may be disclosed upon request.  Before information is disclosed, an assessment is made to determine whether any information is protected by confidentiality under applicable Swedish law.

This may affect, for example, emails or other communications that you send to CIRCE.

How Long We Keep Personal Data

Personal data is retained only for as long as necessary for the purposes for which it is processed, subject to applicable legal requirements.

Because Lund University is a Swedish public authority, certain documents and information may also need to be retained in accordance with Swedish rules concerning official documents, records management, and archiving.

Retention periods therefore depend on the type of information, the purpose of the processing, and applicable legal and archival requirements.

Security

Lund University takes appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

Access to personal data is limited according to need and appropriate security measures are applied based on the nature of the information and the risks associated with its processing.

No method of transmitting information over the Internet or by email can, however, be guaranteed to be completely secure.  You should therefore avoid sending sensitive personal data or confidential information through ordinary email or general Website contact forms unless specifically instructed to do so.

Your Rights

Under the GDPR, you have rights concerning the processing of your personal data.  Depending on the circumstances and the legal basis for processing, these may include the right to:

• request information about whether Lund University processes personal data about you;
• obtain access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing;
• receive certain personal data in a portable format where the right to data portability applies; and
• withdraw consent at any time where processing is based on consent.

These rights are subject to limitations and exceptions under applicable law.  In particular, Lund University’s obligations as a Swedish public authority concerning official documents and archiving may affect whether information can be deleted.

To exercise your rights or ask questions about personal data processed in connection with CIRCE, contact:

CIRCE
Email: circecenter@med.lu.se

You may also contact Lund University’s Data Protection Officer:

Data Protection Officer
Lund University
Box 117
SE-221 00 Lund
Sweden
Email: dataskyddsombud@lu.se

Lund University will respond to requests concerning your data-protection rights without undue delay and in accordance with the time limits established by applicable law.

Complaints

If you have concerns about how Lund University processes your personal data, you are welcome to contact CIRCE or Lund University’s Data Protection Officer.

You also have the right to lodge a complaint with a competent data-protection supervisory authority.  In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Links to Other Websites

The CIRCE Website may contain links to websites operated by other organizations, including research institutions, healthcare organizations, patient organizations, funding bodies, journals, and other third parties.

This Privacy Policy applies only to personal data processed by Lund University in connection with the CIRCE Website.  When you visit another organization’s website, that organization’s privacy policy and data-processing practices apply.

Social Media

CIRCE may maintain accounts on third-party social-media platforms.  When you visit or interact with CIRCE through a social-media platform, personal data may also be processed by the operator of that platform in accordance with its own terms and privacy policy.

The CIRCE Website may provide links to these services. 

Changes to This Privacy Policy

We may update this Privacy Policy when the Website, our activities, or applicable legal requirements change.

The current version will always be published on CIRCEcenter.org, together with the date on which it was last updated.  Where appropriate, significant changes will be communicated through the Website or other suitable channels.

Contact

Questions about this Privacy Policy or CIRCE’s handling of personal data in connection with the Website can be sent to: 

CIRCE
Email: circecenter@med.lu.se

For questions concerning data protection at Lund University, you may contact:

Data Protection Officer
Lund University
Box 117
SE-221 00 Lund
Sweden
Email: dataskyddsombud@lu.se