Describing the aim of the study’s use of data

Aim of the study:

CCI4EU is a European initiative aiming to help Member States and Associated Countries rethink the cancer care culture by funding a more equitable transfer of knowledge to everyone. In the scope of this project, a maturity model is developed alongside the assessment of a country highlight report describing the current collaboration(s) in place integrating cancer care, research, training of care professionals, and education for cancer patients, survivors, and families/carers.

The objective of this survey is to collect information to map the organisation of cancer research and its integration with cancer care and to identify the level of maturity of existing or potential Comprehensive Cancer Infrastructures. As shown in the schematic, Comprehensive Cancer Infrastructures (CCIs) are defined as infrastructures that integrate cancer research, care, and education in the following themes: discovery and translational research, clinical research, outcomes research, patient pathways, early detection, and potential screening and cancer registries.

Respondents completing (part of) this survey on time will be eligible to receive Capacity Building Interventions in Research and Innovation before the end of the project, with no financial cost to themselves. The survey’s responses will contribute to selecting sites that will be shortlisted for receiving one of the nine CCI4EU’s interventions, which will unfold in consultancy and Capacity Building Interventions where a team of up to 10 multidisciplinary experts conducts up to 3 site visits over a period of 19 months to assist development in a CCI by identifying gaps, barriers, and solutions for improvement. This intervention includes funding for a local project manager in each CCI. Other Capacity Building Interventions comprise free attendance at two-day cancer conferences where individual case studies will receive advice, online courses, and training, use of supporting materials from an online platform, and onsite visits for learning and sharing good practices.

Participation in the study is voluntary. You can cancel or interrupt the questionnaire at any time and resume it at a later date (within the overall duration of the survey). The research does not follow any commercial interest. We treat all your data confidential.

How did we get your contact details:

We either received your contact information from CCI4EU partners, from public websites, from previous EU projects to which you might have contributed, or the identified informant might have directed you to the survey (referred you to us/forwarded the link).

How we will use your contact information and data filled in within the project framework:

Your data will be used within the project scope to assess the maturity of your cancer care infrastructures and eligibility for Capacity Building Interventions. The data might be shared with members of the CCI4EU consortium, who might reach out to you until 2026 for additional interviews, surveys, and data analysis leading to selecting Capacity Building Interventions sites as well as analysis to be commented in a report on the actual situation in MSs/ACs across Europe.

In the course of the project, your data will be imported onto a password-protected online web tool used only by members of the CCI4EU consortium to assess the maturity of each participating CCI.

You will be informed and consulted before using any analysis data in further publication and be acknowledged for it.

Further use of the data beyond CCI4EU:

We will retain the data for following EU projects on this topic, for which you might be contacted in the future. Such projects might be conducted by us or other partners in the CCI4EU project consortium.

Support desk:

If you have any unclarity, technical or other question about the CCI4EU survey and how to respond to it, do not hesitate to contact our helpdesk during the time of the survey: CCI4EUSurvey@cci4eu.eu

If you wish to be removed from the list, we invite you to contact CCI4EUSurvey@cci4eu.eu.

Data protection declaration according to the GDPR

The CCI4EU project consortium operates in accordance with the provisions of the European General Data Protection Regulation (EU-GDPR) and all other data protection regulations.

Hereby, you declare your consent to the collection of this data within the scope of this survey.

You can withdraw your consent at any time without giving reasons and without adverse consequences. Likewise, you can terminate your participation in the study at any time without adverse consequences.

If you agree with the procedure outlined above, please confirm it by clicking "Accept". If you do not agree, please close the window.

For further information, see below.

Identity and contact details of the data controller

The joint controllers within the meaning of the General Data Protection Regulation (GDPR) are:

The CCI4EU project consortium: CCI4EUSurvey@cci4eu.eu

Consisting of:

• ORGANISATION OF EUROPEAN CANCER INSTITUTES – EEIG (OECI), Rue d’Egmont 11, Brussels 1000, Belgium, the Coordinator,
• EUROPEAN ORGANISATION FOR RESEARCH AND TREATMENT OF CANCER AISBL (EORTC), Avenue E. Mounier 83, Brussels 1200, Belgium,
• CENTRE INTERNATIONAL DE RECHERCHE SUR LE CANCER INTERNATIONAL AGENCY FOR RESEARCH ON CANCER (IARC), PIC 999520496, the cancer research agency of the World Health Organization (WHO), located at 25 Avenue Tony Garnier, CS 90627 - 69366 LYON CEDEX 07, France,
• DIGITAL INSTITUTE FOR CANCER OUTCOMES RESEARCH – EEIG (DIGICORE), Rue D'Egmont 11, Brussels 1000, Belgium,
• FONDAZIONE IRCCS ISTITUTO NAZIONALE DEI TUMORI (INT), Via Venezian 1, Milan 20133, Italy,
• FUNDACIÓ PRIVADA INSTITUT D'INVESTIGACIO ONCOLÒGICA DE VALLHEBRON (VHIO), Calle Nazaret 115-117, Barcelona 08035, Spain,
• INSTITUT GUSTAVE ROUSSY (IGR), Rue Camille Desmoulins 39, VILLEJUIF 94805, France
• DEUTSCHES KREBSFORSCHUNGSZENTRUM HEIDELBERG (DKFZ), Im Neuenheimer Feld 280, Heidelberg 69120, Germany,
• DEUTSCHE KREBSGESELLSCHAFT EV (DKG), Kuno Fischer Strasse 8, Berlin 14057, Germany,
• ALLEANZA CONTRO IL CANCRO (ACC), Via Giorgio Ribotta 5, Roma 00144, Italy,
• OSLO UNIVERSITETSSYKEHUS HF (OUS), Kirkeveien 166 Tarnbygget, Oslo 0450, Norway
• INSTITUT CURIE (INSTITUT CURIE), rue d'Ulm 26, Paris 75005, France
• KAROLINSKA INSTITUTET (KI), Nobels Vag 5, Stockholm 17177, Sweden
• MASARYKUV ONKOLOGICKY USTAV (MOU), in Zluty Kopec 7, Brno 656 53, Czech Republic
• TECHNISCHE UNIVERSITÄT DRESDEN (TUD), Helmholtzstrasse 10, Dresden 01069, Germany
• UNICANCER, 101 Rue De Tolbiac, Paris 75013, France,
• LUXEMBOURG INSTITUTE OF HEALTH (LIH), 1a Rue Thomas Edison, Strassen 1445, Luxembourg
• SCIENSANO, Juliette Wytsmanstraat 14, Elsene 1050, Belgium
• NARODOWY INSTYTUT ONKOLOGII IM. MARII SKLODOWSKIEJ-CURIE - PANSTWOWY INSTYTUT BADAWCZY (NIO-PIB), UL. W K Roentgena 5, Warszawa 02-781, Poland,
• European School of Oncology - ESO, Via Filippo Turati 29, Milano 20121, Italy
• Orszagos Onkologiai Intezet (OOI), Rath Gyorgy Utca 7-9., Budapest 1122, Hungary
• NETHERLANDS COMPREHENSIVE CANCER ORGANISATION (IKNL), whose administrative offices are at Godebaldkwartier 419, 3511 DT Utrecht, The Netherlands
• EUROPEAN CANCER ORGANISATION (E.C.O.), Rue De La Science 41, Bruxelles 1040, Belgium,
• NARODOWY INSTYTUT ZDROWIA PUBLICZNEGO PZH – PANSTWOWY INSTYTUT BADAWCZY (NIZP PZH PIB), Chocimska 24, Warszawa 00791, Poland
• LATVIJAS UNIVERSITATE (LU), Rainis Boulevard 19, Riga 1586, Latvia,
• Ministry for Health - Government of Malta (MFH), Palazzo Castellania, Merchants Street 15, Valletta VLT 1171, Malta.

Contact details of the data protection officer

The data protection officer of OECI as the coordinator of the CCI4EU project is:

Norbert Maggi

E-Mail: privacy@oeci.eu

Personal data

As defined in the General Data Protection Regulation (GDPR), personal data refers to any information relating to an identified or identifiable natural person. For the survey purposes, this data includes the first and last name, address, e-mail address, phone number (if known), and, as a rule, the IP address.

Extent of personal data processing

Principally, we process personal data only as far as it is necessary to provide a functional survey website and our content and services. We only process personal data of our users after they have given their consent. As far as you have provided us with personal data, we shall use this data exclusively for the purpose of conducting the survey and assessment as outlined above. This personal data will be used to enrich and classify the non-personal data on the cancer infrastructures in your region/country.

Your personal data will not be passed on, sold, or otherwise transferred to third parties unless:

• you have expressly consented to the disclosure of your data.

Your personal data will only be gathered, stored, and processed by and on servers within the European Union.

We do not deliberately collect personal data of minors. We advise parents and legal guardians to watch their children’s activities online.

No automated decision-making processes will be implemented on the basis of the personal data.

Legal basis for the processing of personal data

Provided that we have the users’ consent to process their personal data, Article 6 paragraph 1(a) GDPR is the legal basis for the processing.

When processing personal data is necessary for the performance of a contract, namely the CCI4EU Grant Agreement, to which the data subject is party, Article 6 paragraph 1(b) GDPR is the legal basis for the processing. This also applies to processing operations that are necessary in order to take steps prior to entering into a contract.

Deletion of data and storage period

The personal data of the data subject will be deleted or locked once the purpose for which they have been stored ceases to apply (finalisation of the project purposes). Personal data may be stored for a longer period if provided for by European or national legislators in EU regulations, laws, or other rules to which the controller is subject. The data will also be locked or deleted once a storage period specified in the above-mentioned rules has expired unless further retention of the data is necessary to enter into or fulfil a contract.

Rights of the data subject

If your personal data are being processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:

1. Right of access

You have the right to obtain confirmation as to whether or not we are processing your personal data.

Where this is the case, you have the right to obtain the following information from the controller:

1. the purpose for which your personal data are being processed;
2. the categories of personal data that are being processed;
3. the recipients or categories of recipients to whom your personal data have been or will be disclosed;
4. the projected period for which your personal data will be stored or, if not possible, the criteria used to determine that period;
5. the existence of the right to request from the controller rectification or erasure of your personal data or restriction of processing of personal data concerning you or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where personal data are not collected from the data subjects themselves, any available information as to their source;
8. the existence of automated decision-making, including profiling, referred to in Article 22 paragraph 1 and paragraph 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to obtain information as to whether or not your personal data are being transmitted to a third country or an international organization. In this context, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

Your right of access may be restricted in so far as the right is likely to render impossible or seriously impair the achievement of research or statistical purposes, and the restriction is necessary to achieve these purposes.

2. Right to rectification

You have the right to obtain the rectification and/or completion of inaccurate or incomplete personal data concerning you from the controller. The controller must rectify the data immediately.

Your right to rectification may be restricted in so far as the right is likely to render impossible or seriously impair the achievement of research or statistical purposes, and the restriction is necessary to achieve these purposes.

3. Right to restriction of processing

You have the right to demand the restriction of the processing of personal data concerning you where one of the following conditions applies:

1. you contest the accuracy of personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
4. if you have objected to processing pursuant to Article 21 paragraph 1 GDPR and the verification of whether the legitimate grounds of the controller override your grounds is pending.

Where processing of personal data concerning you has been restricted, such personal data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Where processing has been restricted under one of the above conditions, you will be informed by the controller before the restriction of processing is lifted.

Your right to restriction of processing may be restricted in so far as the right is likely to render impossible or seriously impair the achievement of research or statistical purposes and the restriction is necessary to achieve these purposes.

4. Right to erasure

a) Obligation to erase data

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay. The controller is obliged to erase these data without undue delay where one of the following grounds applies:

1. the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. you withdraw consent on which the processing is based according to Article 6 paragraph 1(a), or Article 9 paragraph 2(a) GDPR, and where there is no other legal ground for the processing;
3. you object to the processing pursuant to Article 21 paragraph 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 2 paragraph 2 GDPR;
4. the personal data concerning you have been unlawfully processed;
5. the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
6. the personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8 paragraph 1 GDPR.

b) Notification of third parties

Where the controller has made personal data concerning you public and is obliged pursuant to Article 17 paragraph 1 GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, must take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

c) Exceptions

The right to erasure does not apply where the processing is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation that requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the area of public health in accordance with Article 9 paragraph 2(h) and (i) as well as Article 9 paragraph 3 GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 paragraph 1 GDPR in so far as the right referred to in subsection a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5. for the establishment, exercise or defence of legal claims.

5. Right to be informed

Where you have asserted your right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to inform each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about who these recipients are.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, unless

1. the processing is based on consent pursuant to Article 6 paragraph 1(a) or Article 9 paragraph 2(a) GDPR or on a contract pursuant to Article 6 paragraph 1(b) GDPR; and
2. the processing is carried out by automated means.

Furthermore, in exercising the right to data portability, you have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The rights and freedoms of other persons may not be affected by such transmission.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

On grounds relating to your particular situation, you have the right to object to the processing of your personal data according to Article 6 paragraph 1(e) or (f) GDPR at any time, including profiling based on those provisions.

The controller may no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89 paragraph 1 GDPR, you have the right to object to processing of personal data concerning you on grounds relating to your particular situation.

Your right to object may be restricted in so far as the right is likely to render impossible or seriously impair the achievement of research or statistical purposes and the restriction is necessary to achieve these purposes.

8. Withdrawal of consent

You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

1. is necessary for entering into, or performance of, a contract between you and a data controller;
2. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
3. is based on your explicit consent.

However, these decisions may not be based on special categories of personal data referred to in Article 9 paragraph 1 GDPR, unless Article 9 paragraph 2(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

Regarding the cases referred to in (1) and (3), the data controller must implement suitable measures to safeguard your data rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged informs the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.