Sensors have been installed at your university in certain common areas as well as in some group rooms, lecture halls, auditoriums, and office rooms. To better understand how the premises are used, sensor data is collected, analyzed, and processed to enable more data-driven decisions regarding measures to improve utilization, reduce energy consumption, and thereby lower costs for the university. The purpose of the data usage is described in more detail below. The sensors measure, among other things, room temperature, humidity, light intensity, and movement via passive IR technology. This data is used to measure the utilization rate of the premises. All collected information is referred to below as “measurement data.”
Processing of personal data
The measurement data from the sensors cannot directly be linked to a physical person. However, when it comes to data from individual office rooms, it has been assessed that such data constitutes indirect personal data, as it could likely identify individuals when combined with other information (e.g., floor plans with room numbers, vacation lists, and job titles). Akademiska Hus is the data controller for its processing of this measurement data, including collection and analysis. Below you will find more information about how and why your personal data is processed.
Akademiska Hus' processing of personal data
Akademiska Hus has or will have access to measurement data from office rooms and will store, process, and analyze such data, which means we process personal data about you if you occupy a fixed office room. Akademiska Hus does not process personal data of individuals in common areas or student rooms.
This means Akademiska Hus processes data about how office rooms are used, such as whether the light is on and when someone is in the room. Akademiska Hus does not take active steps to identify who is in a room at a specific time and has limited the technical possibilities to identify you.
Who is responsible for the processing?
Akademiska Hus AB, corp. no. 556459-9156, is the data controller for the processing of your personal data for the purposes described below. You can reach us at gdpr@akademiskahus.se.
What is the purpose of the processing?
Akademiska Hus may process indirect personal data about you for the following purposes:
- To collect, analyze, process, and store measurement data that constitutes indirect personal data in order to better understand how the premises are used. This enables more data-driven decisions to improve utilization, reduce energy consumption, and lower costs for both the university and Akademiska Hus.
- The sensors also enable control of parameters related to temperature and indoor air quality. Using actual measurement data allows systems to respond directly to real conditions, improving indoor climate compared to manual regulation based on technical staff’s experience.
- In exceptional cases, Akademiska Hus may share measurement data (including raw data from your office room, which may constitute indirect personal data) with your university, but only upon the university’s own request and solely for the purpose of enabling the university to analyze and improve space usage. As a rule, Akademiska Hus only shares aggregated data with the university, meaning no personal data is processed by the university.
- If you contact us, for example to exercise your rights, we will also process your personal data to handle such complaints or requests.
What is the legal basis for processing?
Akademiska Hus processes your personal data based on a legitimate interest assessment, which constitutes the legal basis under Article 6(1)(f) of the GDPR. We have assessed that our legitimate interest of collecting, analyzing, processing, and storing measurement data outweighs your interest and fundamental rights not to have your personal data processed for this purpose. If you would like more information about this assessment, you are welcome to contact us using the details provided above.
Who has access to your personal data?
Your personal data is processed by Akademiska Hus and our IT providers. These providers act as data processors on our behalf to ensure functioning IT systems and efficient operations. Additionally, we may share your personal data with your university for the purpose of space optimization as described above.
Transfer to third countries
Measurement data will be stored within the EU/EEA and will not be transferred outside of the EU/EEA. If our IT provider transfers data to a third country, Akademiska Hus has entered into the EU Commission’s Standard Contractual Clauses (SCCs) and taken additional measures in accordance with applicable laws and recommendations. The data is encrypted with customer-managed keys and cannot be stored in decrypted form. Measurement data that constitutes personal data is also stored in a time-series database (InfluxDB) within Akademiska Hus’ firewalls for analysis of space usage trends.
How long time is your personal data stored?
Akademiska Hus stores your personal data only for as long as necessary for the stated purposes, and storage time is further limited for our IT providers. During the storage period, it may not be technically or practically possible to determine that the data relates specifically to you, as identification is only possible through cross-referencing with other sources of information.
What rights do you have?
You have certain rights that allow you to influence how we process your personal data. These include:
- Right to lodge a complaint with a supervisory authority: You always have the right to file a complaint with a competent supervisory authority that is located in the EU/EEA country where you reside, work, or where a data protection violation is alleged. In Sweden, the competent authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).
- Right to object to processing: You have the right to object to processing based on legitimate interest. In some cases, we may continue processing despite your objection if we can demonstrate compelling legitimate grounds or if the processing is necessary for legal claims.
- Right to erasure and restriction: Under certain conditions, you have the right to have your personal data erased, for example if the data is no longer necessary for the purposes for which it was collected.
- Right to rectification, restriction, access, and data portability: Since the measurement data from your office room constitutes indirect personal data, it is generally not feasible (because of impossibility) for Akademiska Hus to rectify errors, restrict processing, provide access or copies, or enable data portability.