Privacy & Legal Notice

Section 2

Privacy notice

The UPLIFT consortium is committed to protecting your privacy. When personal data are processed, the rules laid down in Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) are observed. This privacy notice explains what personal data are collected, why, how they are used, and your rights.

Data controllers

For personal data processed through this website (newsletter subscriptions, contact requests, social media interactions and similar), the data controller is the Fédération Européenne des Géologues (EFG), acting as Communication and Dissemination Lead of the UPLIFT consortium and operator of the website infrastructure and social media channels.

For project-level personal data processed in the framework of consortium operations and reporting (e.g. partner contacts, contractual data), GFZ Helmholtz-Zentrum für Geoforschung, as Project Coordinator, acts as the controller. The two organisations cooperate closely and may, depending on the activity, act as joint controllers within the meaning of Article 26 GDPR.

What personal data we collect

We may collect personal data about you in the following situations:

• Newsletter subscription (when launched) — name and email address.
• Event registration — name, email address, organisation, and any other information you provide when registering for a UPLIFT event (workshop, webinar, conference).
• Contact requests — name, email address, and the content of your message when you contact us through the website or by email.
• Surveys and feedback — any information you voluntarily provide.
• Strictly necessary website data — minimal technical information (such as IP address, browser type and operating system) used solely to operate and secure the website. This includes security event logs maintained by the Wordfence security plugin to detect and block malicious activity. No analytics cookies are currently set.

Why we collect personal data — purposes and legal bases

How long we keep your personal data

• Newsletter subscribers — until you unsubscribe, or up to 24 months after the end of the project, whichever comes first.
• Event registration data — up to 12 months after the event, then deleted or fully anonymised.
• Contact request correspondence — up to 24 months after the last interaction.
• Survey and feedback data — anonymised as soon as practicable, and at the latest at the end of the project.
• Records required for Horizon Europe audit purposes — kept for the period required by the Grant Agreement (typically up to 5 years after the final payment).

Who has access to your personal data

Your personal data are accessed only by:

• Authorised staff of EFG (for website and communication operations) and GFZ (for project coordination).
• Service providers acting as data processors on our behalf, under written data-processing agreements (Art. 28 GDPR) where applicable, namely:
  • ICDSoft — website hosting (data centre located in the European Union).
  • Defiant Inc. (Wordfence) — website security plugin. Most processing runs locally on our hosting environment; limited technical data (e.g. IP addresses associated with attempted malicious activity) may be transmitted to Wordfence in the United States for threat-intelligence purposes.
  • Newsletter platform — to be confirmed before the newsletter sign-up goes live; this notice will be updated accordingly.
• Authorised staff of the European Commission and its agencies (notably CINEA), where required for reporting, monitoring or audit purposes under the Grant Agreement.

We do not sell your personal data and we do not share them with third parties for their own marketing purposes.

International data transfers

Personal data collected through this website are processed primarily within the European Union and the European Economic Area. The following limited transfers may occur:

• Switzerland. Three UPLIFT consortium partners (Geo-Energie Suisse AG, Solexperts AG, ETH Zürich) are based in Switzerland. Switzerland benefits from a European Commission adequacy decision, so transfers to these partners are permitted without additional safeguards.
• United States. Limited technical data (e.g. IP addresses associated with attempted malicious activity) may be transferred to Defiant Inc. (Wordfence) for website-security purposes. Such transfers rely on appropriate safeguards under Chapter V of the GDPR (the EU-US Data Privacy Framework or EU Standard Contractual Clauses).

Should other transfers occur in the future (for example through the choice of a non-EEA newsletter platform), this notice will be updated and appropriate safeguards under Chapter V of the GDPR will be put in place.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete personal data (Art. 16);
• Erase your personal data (Art. 17);
• Restrict processing of your personal data (Art. 18);
• Data portability — receive your data in a structured, commonly used format (Art. 20);
• Object to processing based on legitimate interest (Art. 21);
• Withdraw consent at any time, where processing is based on consent (Art. 7(3)) — without affecting the lawfulness of processing carried out before withdrawal;
• Not be subject to automated individual decision-making, including profiling (Art. 22). UPLIFT does not carry out automated decision-making or profiling.

To exercise any of these rights, contact us at privacy@uplift-horizon.eu. There is no charge for handling such requests, unless they are manifestly unfounded or excessive.

You also have the right to lodge a complaint with a data protection supervisory authority:

• For website and communication-related processing handled by EFG (Belgium) — the Autorité de Protection des Données / Gegevensbeschermingsautoriteit (APD/GBA) — www.autoriteprotectiondonnees.be.
• For coordination-related processing handled by GFZ (Germany) — the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg) — www.lda.brandenburg.de.
• You may also lodge a complaint with the supervisory authority of your country of residence.

Is providing your personal data mandatory?

Providing personal data through this website is always voluntary. However, certain services (such as the newsletter or event registration) cannot be delivered without the relevant data.

Section 4

Accessibility statement

Our commitment

The UPLIFT consortium is committed to making this website accessible in line with the principles of the Web Content Accessibility Guidelines (WCAG) 2.2, Level AA, as a target conformance level. Accessibility is part of our wider commitment to inclusive communication, set out in Task 7.2 of the UPLIFT Grant Agreement.

What we do to be accessible

• Use semantic HTML structure with proper headings, landmarks and lists.
• Provide descriptive text alternatives for informative images and logos.
• Ensure sufficient colour contrast between text and background.
• Support keyboard navigation, including a “Skip to main content” link.
• Use a responsive layout that adapts to mobile, tablet and desktop screen sizes.
• Avoid auto-playing media and intrusive animation.

Known limitations

This is the first iteration of the UPLIFT website. Some content (PDF deliverables, embedded illustrations, technical figures from the Grant Agreement) may not yet be fully optimised for assistive technologies. The full project website will undergo a more detailed accessibility review as deliverables are published.

Reporting an accessibility issue

If you encounter any accessibility barrier on this website, or need information in an alternative format, please contact us at comms@uplift-horizon.eu. We aim to respond within 15 working days.