GDPR notice

FORTHEM Alliance

The legal grounds and purpose for data processing

Data processing is necessary in order to implement an agreement (FORTHEM Consortium agreement from 3rd December 2019) involving a user and to carry out appropriate measures preceding this agreement on the basis of a user’s application (GDPR EU 2016/679, Article 6, Section 1b). Personal data can be processed also based on your implied or specific consent (GDPR, Article 6, Section 1a, or Article 9, Section 1a). In addition, the processing of personal data may be necessary to protect the data subject’s vital interests in a crisis situation (GDPR, Article 6, Section 1d).

The FORTHEM Alliance and its universities process personal data concerning mobility and other activities. All data is submitted by a user while applying for different types of mobility. A user’s personal data are used during: 1) making pre-selections at one’s home university, 2) making selections of participants in the host-university, 3) making accommodation reservations for the mobility and 4) reporting to the financing organization (e.g. to bodies that grant funding to universities for student mobility, such as the European Commission).  

Personal data processed

  1. First name , Surname
  2. User’s card- ID number/ student card number
  3. Home University
  4. Residential address
  5. Contact info (Email address)
  6. Study field/ department at home university
  7. Study cycle
  8. Type of mobility/ other FORTHEM activity
  9. Motivation letter
  10. Curriculum Vitae
  11. Bank account ( requested if the scholarship transfer is planned)
  12. Additional documents attached to the application

The process of accessing users’ personal data

  1. University of Latvia (hosting the online application form on the FORTHEM web-page) is processing one’s personal data through a special secure TEAMS channel.  
  2. Personal data of a user at home and host universities are processed according to internal GDPR at the respective university.
  3. Personal data are transferred to the third parties related to the organization of the mobility/other activity programme only with the purpose to achieve the objectives of the planned event and with a user’s clear approval.
  4. As all the mobility and other activities are planned to take place in EU countries, no data is transferred outside the EU/EEA.
  5. Personal data are kept on application portal, at home and host universities within the FORTHEM project period till December 2022 (according to the partner university internal regulations, personal data could be kept within the home university files from  5 to 10 years).

Rights of a user according to GDPR EU 2016/679
A user has the following rights within the data processing process:

  1. right to access their personal data;
  2. right to rectify their personal data (remember to keep one’s contact information up to date);
  3. right to erase their personal data in some cases;
  4. right to object and to restrict the processing in some cases (e.g. for the purposes of direct marketing);
  5. right of notification so that a data controller informs any third-party recipients of the data about the request for rectification or erasure, or restriction of processing of their personal data;
  6. right for data portability in some cases ( e.g. to receive their data in such a form that allows transferring them to another system);
  7. right to be informed of any information security breaches causing a major risk;
  8. right to lodge a complaint with a supervisory authority.

Any questions about the data rights should first be addressed to the user’s home University’s Data Protection Officer or the FORTHEM project manager at their home university.

A user can withdraw their consent to process their personal data with the purpose of use defined in this privacy notice by sending an email to the FORTHEM project manager at their home university. Please state that the message is in reference to the application process for a certain mobility or other activity. Withdrawing consent has no impact on any processing carried out before the consent was withdrawn.
General description of technical and organizational protection
A data controller takes the necessary measures to secure the processing of personal data in accordance with the national legal framework of the respective university.

A data controller will take appropriate technical and organizational measures against unauthorized or unlawful processing of personal data and against accidental loss or damage to personal data.

A user: a person who applies for the FORTHEM mobility and other activities and whose personal data is processed.
A data controller is the University of Latvia as a host of the FORTHEM web page, a home and a host university (
A third person/party: any person who is not a user or a data controller, who receives data for further processing in case there is a certain need to achieve the objective of the planned activity.

GDPR notice is available on the FORTHEM web page (,  and  it is the user’s responsibility is to be acquainted with this notice in every case when they apply for mobility or other FORTHEM activities and further personal data processing is planned.