What personal data will we collect and why?  

​​

"Personal data" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (GDPR, Article 4.1). 

​

Legacy requirements: AQUASERV is a 5-year project running from 01/04/2024 to 31/03/2029. Still, a follow-up project of a similar nature (promotion of access to research infrastructures through transnational access) may take place. In that case, re-use of personal data will be considered, mainly to ensure seamless dissemination of results. The delay of five years mentioned below for storage of personal data is the delay set by the European Commission for a possible audit of the AQUASERV project, for which the effectiveness of our activities may need to be proven, for which personal data on users, experts, project members may be required.

  

The following paragraphs detail the conditions of data collection by the AQUASERV project for different categories of data subjects. 

​

Transnational Access (TA) applicants 

​​

Who are they? TA applicants are individual scientists applying to the AQUASERV Transnational Access programme, which offers "free of charge" access to the research infrastructures operated by AQUASERV project members. Applications to TA will be made online through ARIA, a web platform Instruct-ERIC provides and maintains. 

​

• Data collection circumstances: Registration, submission, and administration of a project on the ARIA web-based application system. 

• Data categories: Name, Surname, professional contact details, gender, nationality, project outline, project results, CV. 

• Purpose of processing: Project evaluation, provision of infrastructure services, reporting of results and dissemination. 

• Legal basis: legitimate interest 

• Data controller: EMBRC-ERIC 

• Data processors:  

• Instruct-ERIC (Data storage and processing under a Data Processing Agreement with CCMAR and EMBRC-ERIC) 

• EMBRC-ERIC (management of TNA) 

• Individual experts, Selection panel (bound by confidentiality agreement) 

• INRAE (Knowledge management and dissemination) 

• CCMAR (Knowledge management and dissemination) 

• EAS (Knowledge management and dissemination) 

• UVIGO (Knowledge management and dissemination) 

• UPV/EHU (Knowledge management and dissemination) 

• LUKE (Knowledge management and dissemination) 

• UGE (Knowledge management and dissemination) 

• Infrastructure managers of the project (feasibility and Implementation of access, reporting of access) 

• Data transfer outside of the EEA: This may happen if external reviewers are recruited outside the EEA. All reviewers will be bound by a confidentiality agreement that ensures they do not transfer personal data. USTIR and Instruct-ERIC are out of the EEA (UK) but operate within the UK GDPR policy, which was recognised as equivalent to GDPR by an adequacy decision on the 28th of June 2021. UiB, NTNU, and IMR from Norway and Tubitak from Turkey must comply with the European regulation 2016/679 on data protection (GDPR). 

• Duration of data conservation: 5 years after the end of the project (reporting and legacy requirements). 

​

TA Users 

​

TA users are TA applicants selected by AQUASERV for funding. Additional data is needed from these users to organise their access to research infrastructure.  

• Data collection circumstances: Administration of access to the research infrastructure (after a project has been selected and accepted).  

• Data categories: Name, surname, professional contact details, gender, nationality, date of birth, project outline, project results, CV, proof of employment (working contract), ID documents, banking details, as required by local administration.  

• Purpose of processing: Authorisation to enter and use the facilities and reimbursement of travel costs.  

• Legal basis: to be determined by each data controller. 

• Data controller: the home institution of the research infrastructure accessed (see list of DPOs before). 

• Data processors: The data controller will provide the users with a list of data processors. 

• Data transfer outside the EEA: Some TA users may originate outside the EEA. USTIR and Instruct-ERIC are out of the EEA (UK) but operate within the UK GDPR policy, which was recognised as equivalent to GDPR by an adequacy decision on the 28th of June 2021. Similarly, UiB, NTNU, and IMR from Norway and Tubitak from Turkey must comply with the European regulation 2016/679 on data protection (GDPR). 

• Duration of data conservation: Five years after the end of the project (needed for reporting, audit and legacy requirements). Data will be removed from the ARIA system at the end of the project and transferred to CCMAR, which will keep and erase them after five years. 

 

​

Expert reviewers, selection panel members

​

Expert reviewers are individual scientists who are asked to review TA proposals submitted to AQUASERV. Internal expert reviewers are from within the AQUASERV consortium, unlike external expert reviewers from outside the consortium. The Selection panel members are Executive Committee members and individual scientists chosen by their expertise and commitment to participate in the AQUASERV Selection Panel, which makes decisions on financing TA projects based on expert reviews. 

​

• Data collection circumstances: Registration on the ARIA web-based TA management system (all). CCMAR will collect personal contact details, ID documents, and banking information to enable payments to external expert reviewers and external selection panel members.  

• Data categories: For all: Name, Surname, gender, professional contact details, professional qualifications (CV). For expert reviewers, selection panel members external to the consortium: personal contact details, ID documents, and banking information (data collected and processed by CCMAR).  

• Purpose of processing: Participation in the project evaluation workflow on the ARIA system operated by Instruct-ERIC, as well as financial compensation for those external to the consortium.  

• Data transfer outside of the EEA: Expert reviewers and selection panel members will be bound by a confidentiality agreement that ensures they do not transfer any personal data.  

• Legal basis: legitimate interest 

• Data controller: CCMAR (for data processed by Instruct-ERIC), CCMAR (for data related to payment of external panel members and reviewers) 

• Data processors:  

  • Instruct-ERIC (Data storage and processing under a Data Processing Agreement with EMBRC and CCMAR) 

  • CCMAR (management of TA, finances) 

• Data transfer outside of the EEA: Expert reviewers and selection panel members will be bound by a confidentiality agreement that ensures they do not transfer any personal data (Template as Annex A). USTIR and Instruct-ERIC are out of the EEA (UK) but operate within the UK GDPR policy, which has been recognised as equivalent to GDPR by an adequacy decision on the 28th of June 2021. 2.3. USTIR and Instruct-ERIC are out of the EEA (UK) but operate within the UK GDPR policy, which was recognised as equivalent to GDPR by an adequacy decision on the 28th of June 2021. UiB, NTNU, and IMR from Norway and Tubitak from Turkey must comply with the European regulation 2016/679 on data protection (GDPR). 

• Duration of data conservation: 5 years after the end of the project (reporting, audit and legacy requirements). 

 

 

Project members

​

Project members are employees of the AQUASERV Project partners who have been declared as having a role in the project (scientific, technical or administrative).  

• Data collection circumstances: data provided by the primary contact of each partner at the project building stage and amended upon necessity (changes in personnel) throughout the project. Each partner shall inform the coordinator of changes in the project members when they happen and review their project member list in January each year.  

• Data categories: Name, surname, professional contact details, gender, professional qualification.  

• Purpose of processing: Project administration, reporting, provision of project information 

• Legal basis: legitimate interest 

• Data controller: CCMAR (for data processed by Instruct-ERIC), CCMAR (data processed by EMDESK, management software). 

• Data processors: CCMAR (management of the project). 

• Data transfer outside of the EEA: Yes. A European Commission adequacy decision covers data accessed by the University of Stirling (UK). When accessed by UiB, NTNU, and IMR from Norway and Tubitak from Turkey, they must comply with the European regulation 2016/679 on data protection (GDPR). 

• Duration of data conservation: Five years after the end of the project (reporting, audit and legacy requirements) 

 

​

Digital communication users 

​

Any visitor connecting to the AQUASERV website and/or subscribing the project newsletter.  

• Data collection circumstances: Connection to the AQUASERV-RI.EU website (cookies); subscribe to the newsletter by clicking a link and ‘opting in’.  

• Data categories: Analytical data is collected on an aggregated basis for all visitors to the website. The data collected through Google Analytics is anonymised and is therefore not personally identifiable. For communication and dissemination, news, events, and the project newsletter will be shared via email using Mailchimp. Users can sign up for this e-newsletter and project news via the “Subscribe to news” link on the website homepage. To sign up, it is required that you provide your email address and your first and last name. Optionally, further details, such as organisation name and stakeholder group, may be provided. The Mailchimp privacy policy can be viewed at https://mailchimp.com/legal/privacy/. A cookies banner will be added to enable the selection of user-accepted cookies.  

• Purpose of processing: Analytical data collected on the website is used to track/monitor communication engagement on the project website and used to inform project reporting necessary for the EC. Email addresses collected from a subscription list will be used to share project news, events, updates and newsletters.  

• Legal basis: consent 

• Data transfer outside the EEA: How will we deal with information outside the EEA? 

• Duration of data conservation: The mailing list will be maintained throughout the project. In the event of another AQUASERV project in the future, all those subscribed to news for AQUASERV will have the opportunity to ‘opt-in’ to receive the next project’s news into the future. 

 

AQUASERV Stakeholder´s databases

​

• Data subjects: All persons registered in the AQUASERV Stakeholders database 

• Data collection circumstances: The first records will be obtained from partners of AQUASERV (typically, previous users, important contacts, members,…), and then specific data mining protocols, presence in conferences and industry fairs, participation in policy events, will be used to identify additional contacts. Data will also be collected from subjects requesting to be informed of AQUASERV development, as well as upon registration, submission and administration of a project on the ARIA web-based application system. 

• Purpose of processing: Inform potential TA users and stakeholders about the project, evaluate project impact, and build a roadmap for blue bioeconomy research infrastructures. 

• Legal basis: public interest task of INRAE, as AQUASERV WP4 leader, to enable the completion of the tasks listed under “purpose of processing” 

• Data controller: INRAE (contact: aquaserv-database@inrae.fr) 

• Data processors:  

  • CCMAR (for communication, promotion, dissemination) 

  • UGE (for impact evaluation) 

  • LUKE, EHU (for foresight/roadmap) 

  • to be completed 

• Data transfer outside of the EEA: No 

•  Duration of data conservation: 5 years after the end of the project (reporting and legacy requirements) 

 

Training Course and Staff Mobility Applicants and Participants

​

Who are they? Applicants and participants to AQUASERV Staff Mobility programme and training courses.  

​

• Data collection circumstances: Administration and selection processing associated with applying and participating in AQUASERV training courses and the Staff Mobility programme. 

• Data categories: Name, surname, professional contact details, nationality and country of residence, gender, date of birth, organisation name, organisation type, position/job title, research infrastructure they belong to, if any, qualification, research category and previous relevant experience, CV, ID documents, banking details, as required by local administration (for processing of travel/mobility grants). 

• Purpose of processing: Give access to the e-Learning Platform, logistics for on-site and online courses, and staff mobility, reporting, and contact purposes. Data on training participants is always anonymised for reporting purposes. 

• Legal basis: consent 

• Data controller: UGent (EMBRC-BE) and Uvigo (EMBRC-ES). 

• Data processors: UGent (EMBRC-BE) and Uvigo (EMBRC-ES). 

• Data transfer outside the EEA: No data will be transferred outside the EEA. 

• Duration of data conservation: Five years after the end of the project (reporting, audit and legacy requirements). In the case of individual user data on the e-learning Platform, there is no real reason to delete their profiles since they can continue to use their lifelong learning paths/CVs from the platform. 

​

Brokerage events participants (stakeholders)

 

Participants in AQUASERV brokerage events (in person or online)  

• Data collection circumstances: Administration and processing associated with planning an event and informing interested parties.  

• Data categories: Name, Surname, professional contact details, nationality, gender, organisation name, organisation type, position/job title.  

• Purpose of processing: event organisation, reporting of attendance and categories of attendees, follow-up with parties interested in the innovations presented at the brokerage events.  

• Legal basis: consent 

• Data controller: CCMAR (through EMDESK) 

• Data processors: CCMAR (through EMDESK) 

• Data transfer outside the EEA: No data will be transferred outside the EEA. 

• Duration of data conservation: Five years after the end of the project (reporting, audit and legacy requirements). ​​