Privacy & data collection notice

This notice covers DEMO ATLAS public browsing, coordinator access requests, authenticated coordinator workspaces and administration functions. The legal identity, postal address and any appointed data protection contact of the production operator must be completed before public launch in the deployment configuration.

Privacy contact: Privacy contact to be configured by the platform operator before public launch.

Public browsing uses project and demonstration-site information with coordinator names, coordinator emails and private contact fields removed from the public browser dataset.

An access request may collect project acronym, coordinator name, coordinator email, pilot/demonstration-site type, geographic coordinates, country, optional notes, activity descriptions, completion percentage and up to five submitted images. The system also records the submission time, the privacy-notice version accepted, security-relevant request metadata and a privacy-protected network fingerprint for rate limiting.

Authenticated accounts additionally use username, password hash, session records, password-reset records, audit events, project drafts, publication timestamps and administrator review decisions.

Data is processed to evaluate coordinator access requests, protect the platform against abuse, maintain authenticated accounts, manage and publish verified project information, respond to account recovery requests and document administrative decisions.

The production operator is responsible for selecting and documenting the appropriate GDPR legal basis for each processing purpose, including legitimate interests, contractual/organisational necessity or consent where applicable. The survey records acknowledgement of this privacy notice; that acknowledgement is not presented as blanket consent for processing that may rely on another lawful basis.

Coordinator email addresses, coordinator names used for account administration, passwords, access-request review material and unpublished drafts are not intentionally exposed in the public atlas. A coordinator can publish project content, site descriptions, coordinates and selected images using the explicit “Confirm & publish” action.

Passwords are stored as salted one-way scrypt hashes. Authentication uses opaque server-side sessions in HTTP-only cookies. Password-reset links expire after 30 minutes and sessions are configured for a seven-day maximum lifetime. Login, survey and recovery endpoints use rate limits.

Access requests, project records and audit information should be kept only for the period necessary for platform operation, accountability and applicable legal obligations. The production operator must define and document concrete retention periods before launch and apply them operationally.

The deployment may rely on hosting, database and transactional-email providers configured by the operator. The operator is responsible for completing processor agreements, transfer safeguards and the final list of subprocessors applicable to the production environment.

Where the GDPR applies, individuals may have rights of access, rectification, erasure, restriction, objection, portability and the right to lodge a complaint with the competent supervisory authority, subject to the conditions and exceptions in applicable law. Requests should be directed to the production privacy contact shown above.

The secure coordinator and administrator areas use an essential HTTP-only session cookie required for authentication. The portal does not require advertising cookies for these functions. If analytics or other non-essential tracking is added later, the operator must update this notice and implement any consent mechanism required by applicable law.