PERSONAL DATA PROCESSING POLICY

In compliance with article 13 of EU Regulation 2016/679 (GDPR – General Data Protection Regulation), laying down provisions for the protection of persons and other subjects regarding the processing of personal data, the Consortium of Project Partner Organisations hereby informs you of the following:

1. Data Controller

The Data Controllers are the Partner Organisations that constitute the Consortium under Grant Agreement No. 869227. All information relating to the Consortium and its Partners is published on the official web page: https://www.inhabit-h2020.eu/project-partners/. As coordinator of the project, the University of Cordoba is the point of contact for all matters concerning data processing and can be reached at: inhabit.coord@uco.es.

2. Data Processed and Purposes of Processing

To carry out the Project’s research activities, the web app collects user information, including specifically:

  1. email address
  2. city 
  3. gender (with a “Prefer not to say” option)
  4. level of education
  5. date of birth
  6. occupation
  7. nationality
  8. localisation
  9. cookie ID
  10. IP address

Name and surname are not collected nor processed.

The data collected, as well as any responses to surveys and questionnaires, will only be processed in aggregate form for statistical purposes and for the research activity carried out by the Consortium as part of the Project. In particular, the email address is only requested in order to register with and use the web app, and it will not be used for any other purposes.

The legal basis is the data subject’s explicit wish to participate in the Project and, consequently, their consent.

The data referred to in points I and J will also be processed to verify and ensure the proper functioning of the web app and to prevent any unlawful use of or damage to the web app. In this case, the legal basis is the data controller’s legitimate interest in protecting their business, as well as in defending their interests and rights in legal proceedings, where required.

3. Provision of data

Given the purpose of the processing, the provision of data is necessary to subscribe to the web app and participate in the research project. Therefore, any refusal to provide the requested data will make it impossible for the data subject to subscribe to the web app, and the Data Controller will be exempt from any liability for failure to fulfil their obligations.

4. Processing methods and data retention time

The processing of data may be carried out using both paper and electronic media, by implementing appropriate physical and IT security measures to ensure the integrity, availability, and confidentiality of all data.

The data will be stored in aggregate form throughout the duration of the project and, subsequently, within the studies and reports prepared as part of the research. In any case, it will not be possible to trace any information back to a specific data subject.

5. Special categories of personal data

The Data Controller will not process any of the information defined as “special categories of personal data” in Articles 9 and 10 of EU Regulation no. 2016/679, i.e., personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic or biometric data, data concerning health or sex life or sexual orientation of a person.

6. Automated decision-making 

The Owner does not use any automated decision-making processes, including profiling, as set out in Article 22, paragraphs 1 and 4, of EU Regulation no. 679/2016.

7. Data Transfer and Confidentiality

The data is processed within the EU or in countries that ensure an adequate level of protection in accordance with the provisions in force, entering into agreements where necessary and/or adopting the standard contractual clauses developed by the European Commission.

The data provided will not be subject to dissemination and project researchers will only be able to access the information in an aggregated and anonymised form.

The data may also be accessed by individuals providing support and advice for the technical and operational management of the web app and by individuals whose right to access the data is recognised by law or by orders issued by the authorities.

8. Rights of the Data Subject

The Data Subject may, at any time, exercise the following rights under article 7 of Legislative Decree 196/2003 and articles 15 to 22 of EU Regulation no. 2016/679:

  1. request confirmation of the existence or otherwise of their personal data;
  2. obtain information about the purposes of the data processing, the categories of personal data, the recipients or categories of recipients to whom the personal data has been or will be disclosed and, whenever possible, the retention period;
  3. obtain the correction and deletion of the data or the portability of data, i.e., receive their data from a Data Controller in a structured, commonly used, and machine-readable format, in order to transfer such data to another Data Controller without restraints;
  4. obtain restriction of the data processing or object to such treatment at any time, including the case of processing for direct marketing purposes;
  5. object to an automated decision-making process concerning individuals, including profiling;
  6. withdraw consent at any time, without prejudice to the lawfulness of any data processing based on consent given prior to revocation;
  1. submit a complaint to a supervisory authority, which for Spain, considering the reference to the University of Cordoba, is the Spanish Data Protection Agency (Agencia Espanola Proteccion Datos: https://www.aepd.es/es)

You can exercise your rights by sending a written request to the Project Partner Organisations listed on the official website at this link: https://www.inhabit-h2020.eu/project-partners/ and, in particular, to the University of Cordoba, which is the contact point for all matters concerning data processing, at the following email address: inhabit.coord@uco.es.

Last updated: September 2023

eu