Privacy policy

Last updated: 10 October 2026

This policy explains which personal data the CLIMINVEST APP (the "APP", https://app.climinvest-horizon.eu) processes, why, and what your rights are. The APP is the project management tool of the CLIMINVEST project (Grant Agreement 101212947), used only by the members of the project consortium.

1. Who is responsible for your data

Contact for privacy matters: privacy@gftinnovation.eu

2. Why we process your data, and on which basis

We process your data only to run the CLIMINVEST project: to let you log in to the APP, to know who does what in the consortium (organisation, role, duties, tasks), to send project communications (mailing lists and notifications such as deliverable review requests), to organise meetings, actions, reporting and deliverables, and to document the work done towards the European Commission as required by the Grant Agreement.

The legal basis is your consent, given on the consent form when you join the APP (Art. 6(1)(a) GDPR), and the obligations of the consortium partners under the Grant Agreement and Consortium Agreement (Art. 6(1)(b) and (c) GDPR). The access logs and the security data are processed for our legitimate interest in keeping the APP secure (Art. 6(1)(f) GDPR). Your data is never used for marketing, sold or used for profiling.

3. Which data we process

  • Identity and contact: name, surname, gender (if given), professional e-mail address, phone number (if given), picture (if given), your organisation (partner).
  • Role in the project: your role, your duties (e.g. Reviewer, Administrative, Legal signatory), the tasks, work packages, pilots and deliverables you are involved in, your mailing list memberships.
  • LinkedIn profile link: only if you add it and tick its consent box. Removing it from your profile withdraws that consent.
  • Account and security: password (stored only as a hash), Google account address if you use Google sign-in, second-factor data (passkey public keys, authenticator app secret, recovery codes stored as hashes), consent and validation dates, last access.
  • Content you create: reports, efforts and planning, actions, messages, minutes, deliverable documents you upload and your review comments. These are project records and carry your name.
  • Technical logs: the server records each request (IP address, date and time, page requested, browser) in access and error logs, kept for 180 days.

Most data is provided by you. The Coordinator or your organisation may enter your name, organisation and e-mail address to invite you; you are then asked for your consent. We do not collect data about you from other sources.

4. Who can see your data

  • Consortium members: logged in users of the APP can see the profiles of the other members (name, organisation, role, duties, professional contacts, LinkedIn link if given) and the project records they work on. The data is not shared outside the consortium without your permission.
  • Administrators of the APP (Coordinator and the APP operator) can see and correct all data.
  • The European Commission and its reviewers receive the project deliverables and reports, which may include your name as author or contributor, as required by the Grant Agreement.
  • Service providers (processors) that run parts of the service on our behalf, under data processing agreements:
    • Google Cloud, europe-west1: hosting of the APP and its database;
    • Google (Google Workspace): project mailing lists, sending of e-mails, Google sign-in;
    • Microsoft 365 (SharePoint of GFT Italia Srl): the deliverable documents are written in the reserved project SharePoint owned by GFT Italia Srl, outside the APP; the APP only links to it.

5. Transfers outside the European Union

Google is based in the United States. Where your data is transferred to them, the transfer is covered by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

6. How long we keep your data

  • Your account is kept while you take part in the project. If you withdraw your consent with your consent link, your account is deleted immediately and you are removed from all project mailing lists.
  • After the end of the project the data is kept for 5 years after the final payment, as required by the Grant Agreement for audits and then deleted.
  • Project records you authored (reports, deliverables, minutes) are part of the project documentation and are kept for the same period, also after your account is deleted.
  • Technical logs are kept for 180 days.

7. Cookies

The APP uses only a session cookie, needed to keep you logged in; it is deleted when you close the browser. There are no statistics, advertising or tracking cookies. If you use Google sign-in, Google sets its own cookies during the sign-in, under Google's privacy policy.

8. Security

The APP is accessible only to authorised users, over encrypted connections (HTTPS). Passwords and recovery codes are stored only as hashes, and you can protect your account with a passkey or an authenticator app. Project files are served only to logged in users with the right permissions. If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours where required, and inform you without undue delay if the breach is likely to result in a high risk to your rights.

9. Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy of it;
  • correct it: most data can be changed directly in your profile;
  • have it deleted, and withdraw your consent at any time, with your consent link (ask the Coordinator for it) or by writing to us; the withdrawal does not affect the processing done before it;
  • restrict or object to its processing;
  • receive your data in a structured, machine readable format (data portability);
  • lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or the Garante per la protezione dei dati personali (Italy).

To exercise your rights write to privacy@gftinnovation.eu. We may ask you to confirm your identity, and we answer within one month.

10. Changes to this policy

If this policy changes, the new version is published on this page with its date, and material changes are announced to the users by e-mail. If a change requires your consent, we will ask for it again.