Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with the ARXIVE project website, contact form, communication activities, open calls, events, stakeholder engagement, and related project activities. 
ARXIVE — Advanced Research and eXploration for Interoperable Value in European Heritage — is a Horizon Europe project contributing to the European Collaborative Cloud for Cultural Heritage. 

1. Data controllers 
The data controller depends on the processing activity. 

1.1 Communication activities, contact form, dissemination and stakeholder engagement 
For ARXIVE communication, dissemination, stakeholder engagement, website contact enquiries, newsletters where applicable, public events, communication campaigns, and related project communication activities, the controller is: 

INOVA+ acts as controller for these activities because it determines the purposes and practical means of ARXIVE communication and dissemination processing. 

1.2 Open calls and Financial Support to Third Parties 
For ARXIVE open calls, including Financial Support to Third Parties, application management, eligibility checks, evaluation, selection, contracting, monitoring, payments where applicable, reporting, audit, and compliance, the joint controllers are: 

  • Gottfried Wilhelm Leibniz Universität Hannover 
  • Welfengarten 1 
  • 30167 Hannover 
  • Germany 
  • Tel.: +49 511 762 – 0 
  • Data Protection Officer: 
  • Gottfried Wilhelm Leibniz Universität Hannover 
  • Datenschutzbeauftragter 
  • Welfengarten 1 
  • 30167 Hannover 
  • Germany 
  • Email: datenschutz@uni-hannover.de 
  • INOVA+ – Innovation Services, S.A. 
  • Rua Dr. Afonso Cordeiro, n.º 567 
  • 4450-309 Matosinhos 
  • Portugal 
  • Email: inova@inova.business 
  • Project privacy contact: contact@arxive-eccch.eu 

LUH and INOVA+ act as joint controllers for open-call processing because they jointly determine essential purposes and means of processing, including the organisation of the open calls, application requirements, evaluation workflow, selection process, contractual follow-up, reporting, and compliance with Horizon Europe obligations. 


1.3 Other ARXIVE consortium partners 
Other ARXIVE consortium partners may receive or process personal data where necessary for project implementation, evaluation, pilots, training, technical support, dissemination, reporting, or audit. Depending on the specific activity, they may act as processors, independent controllers, or joint controllers. 
Where a specific activity requires a different controller arrangement, this will be explained in the relevant form, call text, event notice, consent form, or privacy notice. 

2. Personal data we collect 
We collect only the personal data necessary for the relevant ARXIVE activity. 

2.1 Website access and technical data 
When you visit the website, technical data may be processed automatically, including: 

  • IP address;  
  • date and time of access;  
  • browser type and version;  
  • device and operating system;  
  • pages visited;  
  • referring website;  
  • request URL;  
  • server response status;  
  • technical logs needed for security, maintenance, and troubleshooting.  

This information is processed to deliver the website, maintain security, prevent misuse, resolve technical issues, and ensure the proper functioning of the website. 


2.2 Contact form data 
When you use the ARXIVE contact form, we collect the data you provide, including: 

  • name;  
  • company or organisation;  
  • email address;  
  • message content.  

The current contact form includes fields for name, company, email, and message. Required fields are marked on the form. 
We use this data to respond to your enquiry, manage project communications, route your message to the appropriate ARXIVE team member or partner, and maintain records where necessary. 

2.3 Email and direct communication 
If you contact ARXIVE by email or other communication channels, we may process: 

  • your name;  
  • email address;  
  • organisation;  
  • role or job title;  
  • message content;  
  • attachments;  
  • metadata related to the communication;  
  • any other information you choose to provide.  

Please avoid sending unnecessary sensitive personal data by contact form or ordinary email. 

2.4 Communication, dissemination and stakeholder engagement data 
For ARXIVE communication activities, we may process: 

  • name;  
  • email address;  
  • organisation;  
  • job title or role;  
  • country;  
  • sector or stakeholder category;  
  • communication preferences;  
  • event participation;  
  • public comments, questions, or feedback;  
  • newsletter subscription status, where applicable;  
  • records of engagement with ARXIVE activities, events, campaigns, or consultations.  

This processing is managed by INOVA+ as controller for ARXIVE communication activities. 

2.5 Open-call and FSTP application data 
If you apply for an ARXIVE open call or Financial Support to Third Parties opportunity, LUH and INOVA+ may jointly process: 

  • applicant name and contact details;  
  • organisation name, address, country, website, and legal status;  
  • applicant role or position;  
  • proposal or application content;  
  • eligibility information;  
  • declarations and confirmations;  
  • supporting documents;  
  • CVs, biographies, team profiles, and professional background information;  
  • budget, financial, administrative, and contractual information;  
  • VAT, tax, registration, or banking information where required for selected applicants;  
  • evaluation scores, reviewer comments, ranking, moderation notes, and selection decisions;  
  • conflict-of-interest information;  
  • due-diligence information;  
  • communication records related to the application;  
  • reporting, monitoring, audit, and compliance records.  

You should not include special-category personal data, such as health data, political opinions, religious beliefs, or other sensitive information, unless it is specifically requested and necessary. 

2.6 Events, webinars, workshops and training activities 
If you register for or participate in ARXIVE events, webinars, workshops, training sessions, consultations, or stakeholder activities, we may process: 

  • name;  
  • email address;  
  • organisation;  
  • role or job title;  
  • country;  
  • attendance details;  
  • dietary or accessibility information, where relevant and voluntarily provided;  
  • questions, comments, feedback, or survey responses;  
  • photographs, recordings, screenshots, or chat contributions, where applicable.  
  • If an event is recorded or photographed, participants will be informed in advance or at the event. 

2.7 Social media and external platforms 
ARXIVE may maintain or link to social media pages, including LinkedIn or other external platforms. If you interact with ARXIVE through these platforms, the platform provider may also process your personal data under its own privacy policy. 
ARXIVE is not responsible for the independent data processing of external platforms. 

3. Purposes of processing 
We process personal data for the following purposes: 

  • operating, maintaining, and securing the ARXIVE website;  
  • responding to contact form enquiries and email communications;  
  • managing ARXIVE communication, dissemination, exploitation, and stakeholder engagement activities;  
  • sending project updates or newsletters, where applicable;  
  • organising events, webinars, workshops, consultations, training activities, and surveys;  
  • managing open calls and Financial Support to Third Parties;  
  • checking applicant eligibility;  
  • evaluating, ranking, and selecting open-call proposals;  
  • communicating with applicants, beneficiaries, evaluators, reviewers, experts, and partners;  
  • preparing agreements, grant documents, and administrative records;  
  • monitoring funded activities and project outputs;  
  • processing financial, contractual, audit, and reporting information;  
  • complying with Horizon Europe, EU funding, audit, and legal obligations;  
  • preventing fraud, conflicts of interest, misuse, or security incidents;  
  • documenting ARXIVE activities and results;  
  • protecting the rights, interests, and legal position of the ARXIVE project, LUH, INOVA+, and relevant project partners.  

4. Legal bases for processing 
Depending on the activity, we rely on one or more of the following legal bases under the General Data Protection Regulation. 

4.1 Consent — Article 6(1)(a) GDPR 
We may rely on consent for: 

  • optional newsletters or mailing lists;  
  • optional event photography, recording, or publication of identifiable images;  
  • optional surveys;  
  • non-essential cookies or analytics, where used;  
  • any other processing where consent is requested.  
  • You may withdraw consent at any time. Withdrawal does not affect processing carried out before withdrawal. 

4.2 Contract or pre-contractual steps — Article 6(1)(b) GDPR 
We may rely on this basis where processing is necessary to: 

  • assess an open-call application;  
  • take steps before entering into a funding or beneficiary agreement;  
  • manage a grant, FSTP arrangement, or other contractual relationship;  
  • communicate with applicants or beneficiaries about contractual obligations.  


4.3 Legal obligation — Article 6(1)(c) GDPR 
We may process personal data to comply with legal obligations, including: 

  • EU funding rules;  
  • financial and accounting obligations;  
  • audit and reporting duties;  
  • record-keeping obligations;  
  • anti-fraud and compliance requirements;  
  • obligations imposed by competent public authorities.  

4.4 Public interest — Article 6(1)(e) GDPR 
LUH may rely on this basis where processing is necessary for tasks carried out in the public interest, including research, innovation, university, and publicly funded project activities. 

4.5 Legitimate interests — Article 6(1)(f) GDPR 
INOVA+ and, where applicable, other non-public project partners may rely on legitimate interests for: 

  • responding to enquiries;  
  • managing stakeholder communications;  
  • maintaining project records;  
  • organising dissemination and engagement activities;  
  • securing systems and preventing misuse;  
  • managing project collaboration;  
  • protecting legal and operational interests.  
  • Where we rely on legitimate interests, we balance those interests against your rights and freedoms. 

5. Contact form processing 
When you submit the contact form, INOVA+ processes your personal data as controller for ARXIVE communication activities. 
The data is used to: 

  • receive and understand your enquiry;  
  • reply to you;  
  • forward your request internally or to another ARXIVE partner where necessary;  
  • keep a record of the communication where appropriate;  
  • improve project communication and stakeholder engagement.  
  • Your enquiry may be shared with LUH or other ARXIVE partners if this is necessary to answer your request. For example, a technical question, open-call question, pilot-related question, or consortium-specific question may need to be handled by the relevant partner. 

6. Open calls and Financial Support to Third Parties 
For ARXIVE open calls and FSTP processes, LUH and INOVA+ act as joint controllers. 
Personal data submitted through open-call forms or platforms is processed to: 

  • receive and register applications;  
  • verify completeness and eligibility;  
  • assess applications against published criteria;  
  • manage expert evaluation and review;  
  • carry out moderation, ranking, and selection;  
  • document decisions;  
  • notify applicants of outcomes;  
  • prepare agreements with selected applicants;  
  • administer financial support;  
  • monitor implementation;  
  • collect deliverables, reports, and evidence;  
  • meet Horizon Europe reporting and audit obligations;  
  • prevent fraud, conflicts of interest, and misuse of funds;  
  • respond to complaints, appeals, or legal claims.  

Open-call applications may be reviewed by authorised ARXIVE staff, LUH, INOVA+, consortium partners, external evaluators, independent experts, reviewers, project officers, auditors, or competent authorities, where necessary. 
Open-call decisions are not made solely by automated means. Human review is involved in eligibility, evaluation, ranking, and selection. 

7. Recipients of personal data 
Personal data may be shared with: 

  • INOVA+, for communication activities and open-call management;  
  • LUH, for project coordination, open-call management, compliance, and reporting;  
  • ARXIVE consortium partners, where necessary for the relevant project activity;  
  • external evaluators, reviewers, experts, advisory board members, or assessors;  
  • selected service providers, including website, hosting, email, form, event, survey, communication, cloud, or open-call platform providers;  
  • the European Commission, European Research Executive Agency, project officers, reviewers, auditors, or other EU bodies where required;  
  • financial, legal, accounting, or audit advisers;  
  • public authorities, courts, or regulators where legally required.  
  • We do not sell personal data. 

8. International transfers 
Personal data is processed primarily within the European Economic Area. 
If personal data is transferred outside the EEA, we will ensure that an appropriate transfer mechanism is in place, such as: 

  • an adequacy decision;  
  • Standard Contractual Clauses;  
  • additional safeguards where required;  
  • another lawful GDPR transfer mechanism.  

9. Retention periods 
We keep personal data only for as long as necessary for the relevant purpose. 
Indicative retention periods are: 

Category Retention 
Website technical logs For a limited technical/security period, unless longer retention is needed to investigate misuse or incidents 
Contact form enquiries Until the enquiry is resolved, plus a reasonable period for project record-keeping unless longer retention is required 
General project communications For the duration necessary to manage the communication and project activity 
Newsletter or mailing list data Until you unsubscribe or withdraw consent, unless evidence of consent must be retained 
Event registration data Until the event is completed and any reporting or follow-up is finished 
Event recordings/photos For the period stated in the event notice or consent form 
Open-call applications For the duration of evaluation, selection, reporting, audit, and possible dispute periods 
Selected FSTP beneficiaries For the duration of the funded activity and the additional period required by Horizon Europe, financial, audit, and legal rules 
Financial and contractual records For the legally required accounting, audit, and funding retention period 

Where statutory, contractual, EU funding, audit, or legal obligations require longer retention, the relevant data will be kept for that required period. 
After the retention period expires, personal data will be deleted, anonymised, or securely archived where legally required. 

10. Cookies and similar technologies 
The ARXIVE website may use cookies or similar technologies. 
Strictly necessary cookies may be used to operate the website and provide essential functions. 
Non-essential cookies, including analytics, tracking, embedded media, or third-party cookies, will only be used where legally permitted and, where required, after consent. 
More information should be provided in the ARXIVE Cookie Policy. 

11. Security 
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction. 
These measures may include: 

  • access controls;  
  • role-based permissions;  
  • confidentiality obligations;  
  • secure storage;  
  • encryption where appropriate;  
  • system monitoring;  
  • backup and recovery procedures;  
  • data minimisation;  
  • secure deletion procedures;  
  • internal policies and staff instructions.  

No online transmission is completely secure. You should not send unnecessary sensitive information through contact forms or ordinary email. 

12. Your rights 
Subject to the conditions set out in GDPR, you may have the right to: 

  • access your personal data;  
  • request correction of inaccurate or incomplete data;  
  • request deletion of your personal data;  
  • request restriction of processing;  
  • object to processing;  
  • withdraw consent where processing is based on consent;  
  • request data portability where applicable;  
  • lodge a complaint with a supervisory authority.  

To exercise your rights, contact the relevant controller listed in Section 1. 
For communication activities and contact form enquiries, contact INOVA+. 
For open calls and FSTP processing, you may contact either LUH or INOVA+. The joint controllers will coordinate as necessary to respond to your request. 

13. Supervisory authorities 
You may lodge a complaint with your local data protection authority. 
For LUH, the competent supervisory authority is: 

  • Der Landesbeauftragte für den Datenschutz Niedersachsen 
  • Prinzenstraße 5 
  • 30159 Hannover 
  • Germany 
  • Email: poststelle@lfd.niedersachsen.de 
  • For INOVA+, the competent Portuguese supervisory authority is: 
  • Comissão Nacional de Proteção de Dados — CNPD 
  • Portugal

14. Children 
The ARXIVE website, open calls, and project activities are not directed at children. 
We do not knowingly collect personal data from children through the website. If you believe that a child has provided personal data, please contact us so that appropriate action can be taken. 

15. External links 
The ARXIVE website may contain links to third-party websites, platforms, social media pages, or services. 
Those third parties process personal data under their own privacy policies. ARXIVE, LUH, and INOVA+ are not responsible for the independent data-processing practices of external websites or platforms. 

16. Changes to this Privacy Policy 
We may update this Privacy Policy to reflect changes in ARXIVE activities, open calls, website functions, technologies, legal requirements, or data-processing practices. 
The updated version will be published on this page with a revised “Last updated” date. 
  
>> Short notice for the contact form 
Use this next to the submit button: 
By submitting this form, you agree that INOVA+ – Innovation Services, S.A., as controller for ARXIVE communication activities, will process your name, company, email address, and message to respond to your enquiry and manage related project communication. Your message may be shared with LUH or other ARXIVE partners where necessary to answer your request. Further information is available in the ARXIVE Privacy Policy. 

Short notice for open-call forms 
Use this next to the open-call application submit button: 
By submitting this application, you acknowledge that Gottfried Wilhelm Leibniz Universität Hannover and INOVA+ – Innovation Services, S.A. act as joint controllers for the processing of personal data in connection with ARXIVE open calls and Financial Support to Third Parties. Your data will be processed for application registration, eligibility checks, evaluation, selection, contracting, communication, monitoring, reporting, audit, and compliance with Horizon Europe and applicable legal obligations. Your data may be shared with authorised ARXIVE partners, evaluators, reviewers, experts, project officers, auditors, service providers, and competent authorities where necessary. Further information is available in the ARXIVE Privacy Policy. 

Short controller wording for the website footer 
For ARXIVE communication activities, including the contact form, the controller is INOVA+ – Innovation Services, S.A. For ARXIVE open calls and Financial Support to Third Parties, the joint controllers are Gottfried Wilhelm Leibniz Universität Hannover and INOVA+ – Innovation Services, S.A. Full details are available in the Privacy Policy.