Privacy policy

1. Data Controller

The Data Controller is the Istituto Nazionale di Astrofisica (INAF), the public research institution to which the Arcetri Astrophysical Observatory (OA Arcetri) belongs. INAF is responsible for managing the scientific project website and the server infrastructure hosting the project’s .eu domain.

2. Categories of Personal Data Processed

We collect data for the following purposes: 

• Technical data related to website navigation, including IP addresses and system logs, to ensure the security and proper functioning of the website infrastructure.
• Identification and professional data collected through the online registration form for the project’s Science Team, including first name, last name, institutional affiliation, email address, research area, and year of the PhD.
• Sign up for our mailing list to receive updates on project-related events and communications (email).

No special categories of personal data (Article 9 GDPR) are processed.

3. Purpose and Lawfulness of the Processing

Personal data are processed for the following specific, explicit, and legitimate purposes:

• Technical administration and security management of the scientific project website;
• Management and evaluation of applications to join the project’s “Science Team”;
• Institutional, scientific, and administrative communications strictly related to the activities of the EU-funded project;
• Production of statistical analyses, exclusively in aggregated and anonymised form.

4. Legal Basis

The processing is lawful as it is necessary for the performance of tasks carried out in the public interest or in the exercise of official authority vested in the Data Controller (scientific research), as well as for the fulfillment of obligations arising from the Grant Agreement signed with the European Commission. Furthermore, for the completion of the form, the legal basis is the consent of the data subject.

5. Processing Methods and Security

Processing is carried out in accordance with the principles of lawfulness, fairness, and transparency. The data is:
• Collected for the purposes specified above and not subsequently processed in an incompatible manner.
• Adequate, relevant, and limited to what is necessary for the purposes.
• Accurate and, where necessary, kept up to date.
• Processed in such a way as to ensure adequate security of personal data, including protection, through appropriate technical and organizational measures.

6. Access to Data and Recipients

Access to personal data is restricted to duly authorised personnel of the Data Controller (INAF/OA Arcetri staff involved in the project), strictly limited to what is necessary for the implementation, management, and monitoring of the project. Such personnel are bound by confidentiality obligations.
Given that the project is coordinated by CNRS (France) and funded under a consortium-based EU framework, personal data may be shared, where strictly necessary, with:

• The Project Coordinator (CNRS),
• The Project Scientist (ESO),
• Other beneficiaries of the Grant Agreement,
• The European Commission or relevant EU executive agencies, solely for scientific, administrative, reporting, and audit purposes as required under the Grant Agreement.

7. Data Transfers

Personal data are stored on servers located within the European Union (INAF OA Arcetri infrastructure).
Should data need to be transmitted to the European Commission or EU agencies for monitoring, reporting, or audit purposes, such transfers will occur in compliance with applicable EU data protection rules and the provisions of the Grant Agreement.

8. Data Retention

Personal data will be retained in a form permitting identification of data subjects for no longer than necessary to achieve the purposes for which they are processed.
In particular, data will be retained for the duration of the scientific project, and for the additional period required to comply with financial reporting, monitoring, and audit obligations under applicable EU funding regulations.

9. Rights of Data Subjects

In accordance with Articles 15–22 GDPR, data subjects have the right to request the Data Controller to access, rectify or erase their personal data, restrict processing or object to processing.

10. Data Protection Officer (DPO)

The Data Protection Officer (DPO) of INAF may be contacted at the following email address: rpd@inaf.it.