DEDICATION – Privacy and Data Protection Information
Project: Digitization and Equity, Diversity, and Inclusion (EDI) to Enhance Care for Youth with Congenital Anomalies: A Training Program for Healthcare Workers in Delivering Psychosocial Interventions

Program: Erasmus+ KA220-HED – Cooperation Projects in Higher Education

Project Number: 2024-1-SE01-KA220-HED-000245464

Project Period: 2024–2027

Project Coordinator: Kristianstad University, Sweden

Project website: vrdedication.eu

Last updated: October 29, 2026

1. Introduction
The DEDICATION project is committed to protecting personal data and respecting the privacy of everyone participating in the project’s activities.
DEDICATION is co-funded by the European Union through the Erasmus+ program. The project aims to strengthen the knowledge and skills of healthcare professionals in providing psychosocial interventions for young people with congenital anomalies. The project integrates digital learning, virtual reality (VR), person-centered care, and the principles of equality, diversity, and inclusion (EDI).
This privacy notice describes how personal data is collected, used, stored, shared, and protected within the framework of DEDICATION’s activities.
Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, GDPR), applicable national legislation, and the data protection policies of the relevant organizations.
This information applies to individuals participating in DEDICATION’s activities, including healthcare professionals, students, trainers, project representatives, workshop participants, participants in online training courses, and other stakeholders.
When a specific activity requires additional information regarding the processing of personal data, such information will be provided separately.

2. The Project Consortium
DEDICATION is coordinated by Kristianstad University in Sweden and implemented by the following ten organizations within the project consortium:
Kristianstad University, Sweden
Triskelion Norway, Norway
University of Niš, Serbia
Papageorgiou General Hospital, Greece
University of Tartu, Estonia
Association of People with Facial Anomalies (ALA), Bulgaria
Cyprus Association of Individuals with Cleft and Craniofacial Anomalies (Chrysallida), Cyprus
Marie S. Curie Emergency Clinical Hospital for Children, Romania
University Medical Center Ljubljana, Slovenia
Amsterdam University Medical Centers, the Netherlands


The project partners collaborate on the development, implementation, evaluation, and dissemination of DEDICATION’s educational activities. Each participating organization is responsible for complying with applicable data protection regulations when processing personal data.
Depending on the activity, the organizations may act as independent data controllers, joint data controllers, or data processors. Participation in the project consortium does not automatically confer the right to access personal data collected by other project partners.

3. Data Controller Responsibilities and Division of Responsibilities
3.1 Project Coordination
Kristianstad University is the formal coordinator of DEDICATION.
The university is responsible for coordinating the project’s implementation, administration, and reporting in accordance with the Erasmus+ grant agreement.
Kristianstad University is the data controller for processing operations in which the university determines the purposes and essential means of processing personal data.
Other project partners may act as independent data controllers for activities that they organize and administer.

3.2 Joint Control of Personal Data for Web-Based Education
Kristianstad University, Sweden, and Triskelion Norway (a nonprofit organization) are joint data controllers under Article 26 of the GDPR for DEDICATION’s web-based educational activities conducted via the LearnWorlds learning platform.
The organizations jointly determine the purposes and essential means of processing personal data relating to:
• Registration and identification of course participants.
• Access to educational materials.
• Course participation and academic performance.
• Pre- and post-tests.
• Course delivery.
• Certification in Continuing Professional Development (CPD).
• Evaluation of training outcomes.
Triskelion Norway owns and administers the LearnWorlds platform.
Joint responsibility for personal data will continue after Erasmus+ funding ends in 2027, as DEDICATION’s web-based CPD courses will remain available at least through 2032.
Both organizations will uphold their respective obligations under the GDPR throughout this period.
These obligations include, among other things, ensuring an appropriate legal basis for processing, providing privacy notices, protecting personal data, managing retention periods, and responding to requests regarding data subjects’ rights.
The joint controllers will maintain an agreement pursuant to Article 26 of the GDPR that governs their respective responsibilities.
The essential elements of the agreement will be made available to participants.
Participants may exercise their rights under the GDPR with respect to any of the joint controllers.
Designated data protection contact for web-based training: thomas@nilsen.com

3.3 Other Project Activities
For in-person workshops, conferences, dissemination events, and other activities organized by individual project partners, the organizing institution may act as an independent data controller.
When two or more organizations jointly determine the purposes and essential means of personal data processing, appropriate agreements on joint data controller status must be established.
Participants will be informed of which organization is the data controller when their personal data is collected.

4. Personal Data Collected
DEDICATION applies the principle of data minimization. Only personal data necessary for specified and legitimate purposes shall be collected.
Depending on the activity, the following categories of personal data may be processed.

4.1 Registration and Attendance at Events
For meetings, workshops, training sessions, conferences, and outreach activities:
• First and last name.
• Organization or institutional affiliation.
• Country.
• Professional role, when relevant.
• Email address, when necessary.
• Registration and participation information.
• Date of attendance.
• Signature, when required.
Signatures may be collected to document participation and provide a basis for reporting, follow-up, and auditing within Erasmus+.
Signing an attendance sheet constitutes confirmation of participation. It does not constitute consent to photography, publication, or other processing of personal data unrelated to attendance registration.

4.2 Web-Based Training and CPD Courses
For online courses conducted via LearnWorlds:
• First and last name.
• Email address.
• Organization or professional affiliation, when requested.
• Course registration information.
• Course participation and progress.
• Pre- and post-test answers.
• Test scores and results.
• Information regarding course completion.
• Information regarding CPD certification.
Participants’ names are linked to test results to verify that the course has been completed and to determine whether the requirements for a CPD certificate have been met.

4.3 Evaluation and Feedback
DEDICATION may collect information through surveys and feedback forms to evaluate training activities.
This may include:
• Professional background.
• Prior knowledge and experience.
• Knowledge acquired through the training.
• Self-assessed confidence in professional practice and professional work methods.
• Participant satisfaction.
• Feedback on the quality and relevance of the training.
• Suggestions for improvements.
Whenever possible, evaluation results will be anonymized or aggregated at the group level.
When responses can be linked to identifiable individuals, they will be treated as personal data.

4.4 Photography and Recordings
Photographs, video recordings, and audio recordings may be produced during project activities for documentation, educational purposes, and the dissemination of project results.
When individuals can be identified, the material constitutes personal data.
Participants will be informed when photography or recording is planned.
When consent serves as the legal basis, it will be obtained separately.

4.5 Project Communication
Personal data may be processed to communicate with participants and stakeholders regarding relevant activities within DEDICATION.
This may include names, work-related email addresses, institutional affiliations, and correspondence.

4.6 Website and Digital Services
DEDICATION’s website and associated digital services may process technical information necessary for their operation.
Depending on which services are used, this may include IP addresses, browser information, device information, login credentials, cookies, and information about website usage.
Additional information about cookies and relevant third-party services will be provided when applicable.

5. Purposes of Personal Data Processing
DEDICATION processes personal data for the following purposes:
1. To organize and administer project activities.
2. To register participants for training events.
3. To document attendance and participation.
4. To provide access to digital training resources.
5. Administer pre- and post-tests.
6. Track academic progress and course completion.
7. Issue and verify CPD certificates.
8. Evaluate educational activities and learning outcomes.
9. Improve the quality and accessibility of training programs.
10. Comply with applicable reporting and audit requirements under Erasmus+.
11. Communicate with participants and project stakeholders.
12. Document and disseminate project activities and results.
13. Maintain the security and functionality of digital services.
Personal data will not be used for incompatible purposes without an appropriate legal basis.
6. Legal Basis for the Processing of Personal Data
DEDICATION processes personal data in accordance with Article 6 of the GDPR.
The applicable legal basis depends on the processing activity and which organization is responsible for the processing.

6.1 Educational Activities and Project Administration
Article 6.1(e) – Task carried out in the public interest.
When Kristianstad University is the data controller, processing necessary for educational activities and project administration, where applicable, is based on the university’s legally established tasks in the public interest.
This may include organizing educational programs, registering participants, documenting attendance, administering educational activities, and evaluating educational outcomes.
The specific task in the public interest must be supported by relevant Swedish legislation.

6.2 Erasmus+ Reporting and Audit Documentation
Article 6.1(e) – Task in the public interest, where the processing is covered by the legally established tasks of the responsible public institution.
Article 6.1(c) – A legal obligation may apply when the processing is necessary to fulfill a specific obligation under applicable EU law or national legislation.
The existence of an Erasmus+ grant agreement does not automatically mean that Article 6.1(c) constitutes an appropriate legal basis.
The organization acting as the data controller must identify and document the applicable legal basis for each type of documentation.

6.3 Web-Based Training, Tests, and CPD Certification
Kristianstad University and Triskelion Norway are joint data controllers for the relevant web-based training activities.
For Kristianstad University, the proposed legal basis is:
Article 6.1(e) – Task carried out in the public interest.
For Triskelion Norway, the proposed legal basis is:
Article 6.1(f) – Legitimate interest, provided that this is confirmed by an appropriate balancing of interests.
The legitimate interest pursued by Triskelion Norway is the effective administration and implementation of educational activities, participant testing, and CPD certification.
The processing includes the registration of participants, documentation of academic progress, administration of tests, verification of completed courses, and issuance of certificates.
The applicable legal bases will be documented by the joint data controllers.

6.4 Project Evaluation
When Kristianstad University processes personal data for necessary evaluations of educational activities, Article 6.1(e) may apply.
When Triskelion Norway processes personal data for evaluation activities, Article 6(1)(f) may apply, provided that a balancing of interests is conducted.
Other project partners acting as independent data controllers must identify the legal basis applicable to their activities.
Voluntary research or evaluation activities that require additional safeguards will be accompanied by appropriate participant information.

6.5 Photography, Video, and Dissemination
Article 6.1(a) – Consent, where consent constitutes the applicable legal basis.
For the voluntary use of identifiable photographs, videos, or recordings in public communications and dissemination, DEDICATION will, as a general rule, obtain separate consent.
Participants may refuse or withdraw their consent without this affecting their participation in other, unrelated project activities.
When a different legal basis is used, participants will be informed of this.

6.6 Voluntary Communication
Article 6.1(a) – Consent, where applicable.
Participants may voluntarily consent to receiving information that is not necessary for the administration of their participation.
Necessary communications regarding activities for which the participant has registered will be processed based on the legal basis applicable to the activity.

6.7 Website Operation and Security
Personal data necessary for the operation and security of the website may be processed pursuant to Article 6(1)(e) or Article 6(1)(f), depending on which organization is the data controller and the purposes of the processing.
When consent is required by law for non-essential cookies or similar technologies, consent will be obtained before they are activated.
The specific legal basis for each processing activity must be confirmed and documented by the organization acting as the data controller before this privacy notice is published.

7. Web-Based Training via LearnWorlds
DEDICATION provides web-based training activities through the LearnWorlds learning platform.
The platform account is owned and administered by Triskelion Norway.
Kristianstad University and Triskelion Norway jointly determine the purposes and essential means of processing participant data within DEDICATION’s courses.

7.1 Registration and Course Participation
Participants provide identifying information when they register for online courses.
This information is used to create participant accounts, provide access to educational materials, and administer educational activities.

7.2 Pre- and Post-Tests
Participants may take tests before and after training activities.
The tests are used to evaluate learning outcomes and verify that course requirements have been met.
Test responses and results are linked to identifiable participants when necessary for training administration and CPD certification.
Individual test results will only be available to authorized personnel who need the information for legitimate educational, administrative, or evaluation purposes.

7.3 CPD Certification
Personal data is processed to:
• Verify the participant’s identity.
• Confirm that the course has been completed.
• Determine whether certification requirements have been met.
• Generate and issue CPD certificates.
• Maintain the necessary certification records.
Only information necessary for these purposes will be stored.

7.4 Evaluation of Training Outcomes
Test results may be used to evaluate the impact of DEDICATION’s training activities.
Whenever possible, results used for project reporting, publications, and dissemination will be anonymized or aggregated at the group level.
Individual participants will not be identified in publicly reported results without an appropriate legal basis.

7.5 Management of Participant Accounts
Participants manage their accounts via the LearnWorlds platform.
These accounts may also provide access to other courses and resources outside of DEDICATION.
Account management and requests for deletion are governed by the platform’s features, privacy policy, and applicable data protection arrangements.
Participants may use the account management features provided by the platform.
Access to these features does not relieve Kristianstad University and Triskelion Norway of their obligations under the GDPR for the processing operations for which they are jointly responsible.
Deleting a participant account does not necessarily mean that certification data or other information that must be retained by law will be deleted immediately.

7.6 LearnWorlds’ Data Protection Arrangements
LearnWorlds provides the technical infrastructure for web-based courses and the management of participant data.
The joint controllers shall ensure that appropriate data processing agreements and safeguards are in place.
LearnWorlds’ privacy policy and relevant data protection documents are available on LearnWorlds’ official website.

8. Evaluation, Research, and Sensitive Personal Data
DEDICATION evaluates its educational activities to assess their relevance, quality, and effectiveness.
Whenever possible, the collection of identifiable personal data shall be limited.
Anonymous data shall be used when the identification of individual persons is not necessary.
Pseudonymized data that can still be linked to an identifiable person constitutes personal data under the GDPR.

8.1 Special Categories of Personal Data
DEDICATION does not normally require participants to provide sensitive personal data to document attendance or carry out regular training activities.
When special categories of personal data as defined in Article 9 of the GDPR are processed, the organization acting as the data controller must establish both an appropriate legal basis under Article 6 and a valid exception under Article 9.
Additional safeguards must be implemented when required.

8.2 Research Activities
When DEDICATION’s activities involve scientific research, interviews, or evaluations that require additional ethical or legal safeguards, participants will receive supplementary information.
This may include information about the purpose of the research, ethical approval, confidentiality, retention periods, and participants’ rights.
Consent to participate in research and consent as a legal basis under the GDPR are two separate issues.

8.3 Information for Patients and Families
DEDICATION focuses on improving the ability of healthcare professionals to support young people with congenital anomalies and their families.
Identifiable information about patients or family members must not be entered into educational platforms or evaluation forms unless the processing has been explicitly approved and appropriate safeguards are in place.
When clinical examples are used, anonymized or fictional data should be prioritized.

9. Photography, Video, and Dissemination
DEDICATION may document activities through photographs, videos, audio recordings, and other communication materials.
This material may be used for project documentation, reporting, educational activities, and the dissemination of project results.
When individuals can be identified, the organization acting as the data controller must establish an appropriate legal basis for processing and publication.
When consent is required, it will be obtained separately from the confirmation of attendance.
Participants will be informed of the intended purposes and publication channels.
Refusing to consent to voluntary photography or recording will not affect participation in other project activities.
Requests to withdraw consent, objections to processing, or requests for erasure will be handled in accordance with the GDPR.

10. Sharing of Personal Data
Personal data may be shared when necessary for legitimate activities within DEDICATION and when there is an appropriate legal basis.
Recipients may include:
• Authorized staff at relevant partner institutions.
• National Erasmus+ offices.
• Relevant EU authorities responsible for funding and monitoring.
• Authorized auditors.
• Service providers supporting project administration.
• Providers of digital learning platforms and web services.
Access to personal data will be limited to what is necessary for the respective purposes.
Participation in the project consortium does not automatically imply unlimited access to participants’ personal data.
When external service providers process personal data on behalf of a data controller, appropriate agreements must be established in accordance with Article 28 of the GDPR.
Personal data will not be sold to third parties.

11. International Transfers of Personal Data
DEDICATION includes organizations both within and outside the European Economic Area (EEA).
Transfers of personal data between Sweden and Norway take place within the EEA and therefore do not in themselves constitute transfers to third countries under Chapter V of the GDPR.
When personal data is transferred to countries outside the EEA, the organization acting as the data controller must ensure that an appropriate transfer mechanism is in place.
This may include:
• A decision by the European Commission on an adequate level of protection.
• The European Commission’s Standard Contractual Clauses.
• Other transfer mechanisms permitted under the GDPR.
Appropriate technical and organizational safeguards must be applied when required.
This also includes an assessment of personal data transfers to project partners outside the EEA and relevant digital service providers.
Specific international transfers and applicable safeguards: [Insert verified information.]

12. Storage and Security
DEDICATION’s project partners shall implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, or disclosure.
These measures may include:
• Secure institutional storage systems.
• Restricted access to participant registries.
• Appropriate authentication and access controls.
• Secure transmission of personal data.
• Data minimization.
• Anonymization or pseudonymization where appropriate.
• Secure deletion procedures.
• Appropriate contractual safeguards.
Access to personal data will be limited to authorized personnel who need the information for specified purposes.
Completed attendance lists containing names and signatures will be stored securely and will not be made publicly available.

13. Retention Periods for Personal Data
DEDICATION retains personal data only for as long as necessary to fulfill the purposes for which the data was collected, comply with applicable legal obligations, and meet relevant Erasmus+ requirements.
The project has committed to keeping the website and the web-based CPD courses available for at least five years after the project’s completion, that is, at least through 2032.
This commitment does not mean that all personal data collected during the project will be retained for the same period.
Different retention periods apply depending on the category and purpose of the data.

13.1 Erasmus+ Project Documentation
Attendance lists, participants’ signatures, and other documentation required to verify the project’s implementation will normally be retained for five years after the final disbursement of the Erasmus+ grant, subject to the provisions of the applicable grant agreement.
Documentation may need to be retained for a longer period if required by national legislation, institutional archiving requirements, ongoing audits, or other legal obligations.

13.2 Web-Based Training and Participant Accounts
DEDICATION’s web-based CPD courses will be available via LearnWorlds at least through 2032.
During this period, participants can register for courses, access training materials, take tests, and receive CPD certificates.
Participants manage their accounts through the LearnWorlds platform, which may also provide access to other courses outside of DEDICATION.
Account management and deletion requests are governed by the platform’s features and applicable data protection arrangements.
DEDICATION does not apply a separate automatic deletion period for accounts solely based on inactivity.
Personal data collected specifically for DEDICATION will be retained in accordance with the purposes and retention periods specified in this privacy notice.

13.3 Pre- and Post-Tests
Identifiable test responses will be retained for as long as necessary to administer training activities, verify that courses have been completed, and conduct relevant evaluations.
When test information is used for project evaluation, identifiable responses will normally be deleted or anonymized within 12 months after the relevant evaluation has been completed, unless further retention is necessary and legally justified.
Limited information required to verify course completion and certification may be stored separately.
Aggregated or truly anonymized test results may be retained for longer periods.

13.4 CPD Certification Registry
DEDICATION will maintain limited records of issued CPD certificates.
These may include:
• The participant’s full name.
• The course title.
• Date of completion.
• The certificate’s identification number, if applicable.
• Confirmation that the certification requirements have been met.
CPD certification records will normally be retained for five years after the certificate is issued, subject to applicable accreditation requirements, legal obligations, and institutional policies.
Individual test results will not be retained solely for the purpose of verifying certification when less detailed information is sufficient.
Since DEDICATION’s courses will be available at least through 2032, certification data may need to be retained even after this date for participants who complete courses during the final years of the availability period.

13.5 Evaluation Surveys
Identifiable responses to the project’s evaluation surveys will normally be deleted or anonymized within 12 months after the relevant evaluation has been completed, unless further storage is necessary and legally justified.
Anonymous and aggregated evaluation results may be retained for project reporting, dissemination, and future educational development.

13.6 Photographs and Videos
Photographs and video recordings used for legitimate project documentation and dissemination may be retained until 2032, in accordance with the project’s sustainability commitment.
Continued storage or publication after this period requires an appropriate legal basis and a renewed assessment.
When processing is based on consent, the data subject may withdraw their consent at any time.

13.7 Project Website and Educational Resources
DEDICATION’s website and digital educational resources will remain available at least through 2032.
Educational materials that do not contain identifiable personal data may be retained even after this period.
Personal data appearing in published materials will be reviewed regularly to ensure that continued publication is necessary, lawful, and proportionate.

13.8 Project Communication
Personal contact information used for project communication will only be retained for as long as necessary for the respective communication purposes.
When continued communication is voluntary and based on consent, the data subject may withdraw their consent at any time.

13.9 Technical Information from the Website
Technical logs and analytics data will be stored for periods appropriate for security, operational, or analytical purposes.
The applicable retention periods depend on the technologies and services used.

13.10 Review and Deletion
The organizations responsible for processing personal data will regularly review the personal data that is stored.
When personal data is no longer needed and there are no legal or institutional requirements justifying continued storage, the data will be securely deleted or anonymized.
Applicable regulations regarding public records and archiving will be followed.

14. Your Rights Under the GDPR
Individuals whose personal data is processed by DEDICATION have rights under the GDPR.
Depending on the circumstances and the applicable legal basis, these may include:
Right of access: You may request information about what personal data is being processed about you and, where applicable, obtain a copy of it.
Right to rectification: You may request that inaccurate or incomplete personal data be corrected.
Right to erasure: You may request that personal data be erased when the conditions under the GDPR are met.
Right to restriction of processing: In certain situations, you may request that the processing of your personal data be restricted.
Right to object: You may object to processing based on public interest or legitimate interests, subject to applicable legal conditions.
Right to data portability: Where applicable, you may request to receive certain personal data in a structured, commonly used, and machine-readable format.
Right to withdraw consent: When processing is based on consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
These rights are subject to the conditions and exceptions set forth in the GDPR.
For processing subject to joint controllership, participants may exercise their rights with respect to either Kristianstad University or Triskelion Norway.

15. Complaints
Individuals who believe that their personal data has been processed in violation of data protection laws have the right to file a complaint with the competent supervisory authority.
For personal data processing involving Kristianstad University, the relevant Swedish supervisory authority is:
The Swedish Data Protection Authority (IMY)
Individuals may also contact the competent supervisory authority in the country where they normally reside, work, or where the alleged violation took place, as applicable.

16. Is it mandatory to provide personal data?
Certain personal data may be necessary to participate in specific activities within DEDICATION.
For example:
• Your name may be required to document attendance.
• Contact information may be needed for course registration.
• Test results may be required to verify learning outcomes.
• Identifying information may be needed to issue CPD certificates.
When providing personal data is mandatory, participants will be informed of this and of the consequences of not providing the data.
Participation in voluntary activities, including certain evaluations, photography, or communication initiatives, will not be a condition for participation in other, unrelated activities.

17. Automated Decision-Making
The LearnWorlds platform may use automated functions to calculate test results and determine whether predefined course completion requirements have been met.
Such functions do not necessarily constitute automated decision-making within the meaning of Article 22 of the GDPR.
The joint controllers will assess whether any processing falls under Article 22.
Where applicable, participants will be provided with information about the underlying logic, the significance of the processing, and its possible consequences.
Automated testing and certification features: [Confirm the current configuration in LearnWorlds.]

18. Changes to This Privacy Notice
This privacy notice may be updated to reflect changes in project activities, personal data processing, legal requirements, or institutional responsibilities.
The latest version will be published on DEDICATION’s website.
When changes significantly affect how personal data is processed, affected individuals will be notified in accordance with the GDPR.

19. Contact Information
For questions regarding the processing of personal data within DEDICATION, please contact the relevant data controller organization.
Project Coordinator and Joint Data Controller
Kristianstad University
Sweden
Project website: https://vrdedication.eu
Contact person for data protection issues: martin.j.persson@hkr.se
Joint Data Controller – Web-Based Educational Activities
Triskelion Norway
Norway
Contact person for data protection issues: thomas@nilsen.com
Other project partners
For personal data collected directly by another DEDICATION partner acting as an independent data controller, participants may contact the relevant institution.
Contact information for the participating organizations is available on the DEDICATION website.

20. Additional Privacy Information
Additional information regarding the processing of personal data may be provided in connection with specific activities within DEDICATION, including:
• Registration for online courses.
• Knowledge tests and assessments.
• Research and evaluation activities.
• Photography and video recording.
• Specific project events.
• Third-party digital services.
Such information supplements this privacy notice and will be provided when required by applicable data protection laws.