Privacy and Data Protection Policy

This Privacy Policy explains how the Life-Nitrazens project protects your privacy and ensures the security of your personal information. It also informs you of your rights under the General Data Protection Regulation (GDPR) and applicable national legislation.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?

The personal data collected will be processed under a joint controllership arrangement pursuant to Article 26 of the GDPR by the relevant entities within the Life-Nitrazens consortium. Their respective responsibilities have been established through an internal joint controllership agreement.

This means that the following Life-Nitrazens partners have jointly determined the purposes and means of the processing:

• University of Burgos (UBU). Project coordinating entity.
• CITA (Centro de Investigación y Tecnología Agroalimentaria de Aragón). Territorial and scientific partner.
• Fundación Ibercivis. Partner responsible for communication, the Life-Nitrazens website and the Geonity app.
• University of Coimbra. Territorial and scientific partner in Portugal.
• Asociación de Empresas Tecnológicas Innovalia. Partner responsible for the Nitrate Data Platform.
• Osoigo S.L. Partner responsible for the Nitrate Data Platform.
• Fundación Patrimonio Natural de Castilla y León (FPNCyL). Territorial partner.
• Comunidad General de Riegos del Alto Aragón. Territorial partner.
• Aguas do Centro Litoral, S.A. Territorial partner.
• Municipality of Soure. Territorial partner.
• Associação de Beneficiários da Obra de Fomento Hidroagrícola do Baixo Mondego.

The essential aspects of the joint controllership agreement are available to data subjects upon request.

Independent controllers and organisational autonomy in relation to events. All activities are carried out within the objectives of Life-Nitrazens. However, where a partner entity independently organises an event or dissemination activity using its own registration systems and infrastructure, that entity will act as the data controller for that specific processing activity.

In such cases, the relevant information will be provided in the event registration form or announcement, together with a reference to the privacy policy of the organising entity.

Single Point of Contact: To facilitate communication with data subjects, the following email address has been designated for any enquiries or requests to exercise data protection rights: life-nitrazens@ibercivis.es

Data Protection Officer (DPO):

As project coordinator, the University of Burgos (UBU) centralises advanced legal enquiries through its Data Protection Officer at: dpd@ubu.es. However, you have the right to contact the Data Protection Officer of any of the joint controllers.

2. WHAT DATA DO WE PROCESS AND HOW DO WE COLLECT IT?

We collect information at different levels depending on your degree of involvement in the project:

• Registration data for ambassadors and participants: first name, surname, email address, telephone number, organisation, geographical area of activity and municipality.
• Citizen science data collected through the Geonity app: GPS location of the sampling point, technical water parameters, date and time of sampling, and technical device metadata.
• Communication data: telephone number provided voluntarily for inclusion in WhatsApp channels.
• Multimedia data: images, videos and voice recordings collected at events, workshops or field activities, always with prior consent.
• Website browsing data: anonymised IP address, technical cookies and analytical cookies relating to behaviour on the website.

3. FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?

We process your data in order to fulfil the scientific and environmental objectives of the Life-Nitrazens project.

1. Participation management: we process your first name, surname, email address, telephone number and geographical area in order to register you as a participant or ambassador, send sampling kits and assign you to territorial nodes.
2. Scientific research: we collect the location of sampling points and technical water parameters in order to analyse the presence of nitrates in water and prepare scientific studies within the framework of the project.
3. Coordination and communication: we facilitate contact between ambassadors, nodes and participants through messaging channels in order to support the proper implementation of the campaigns.
4. Dissemination: images or recordings may be used on official channels to raise awareness of the project.
5. Reporting and accountability: project activities are documented for the European Commission and to publicise milestones achieved through social media and the media.
6. Technological improvement: Ibercivis, as the entity managing the Geonity app and the Life-Nitrazens website, together with OSOIGO and INNOVALIA, will process technical data to ensure the maintenance and security of the app and web platforms.

Please note that the project does not carry out user profiling or make automated decisions based on your personal data.

4. WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR DATA?

The processing of your data is based on:

• Article 6(1)(b) GDPR — performance of a contract or legal relationship: to manage your voluntary participation in the project and the operational communication required for this purpose, including through WhatsApp.
• Article 6(1)(a) GDPR — informed consent: for optional purposes such as sending newsletters and using your image or voice in dissemination materials.
• Article 6(1)(e) GDPR — performance of a task carried out in the public interest: to conduct scientific and environmental research in the general interest.
• Article 6(1)(c) GDPR — compliance with a legal obligation: to meet public funding reporting requirements and comply with audits by the European Commission.

In accordance with Article 13(2)(e) of the GDPR, you are informed that providing the data marked as mandatory is necessary in order to manage your participation. If you do not provide these data, we will not be able to process your application.

5. PRIVACY BY DESIGN: GEOLOCATION AND ANONYMITY

One of the core principles of LIFE NITRAZENS is to protect the privacy of participants and the water sources being sampled.

• Pseudonymisation: scientific data are separated from personal data and stored in different repositories. Researchers work only with coded scientific data.
• Reduced location precision: public maps will not display exact coordinates where these correspond to private homes. In such cases, the data will be aggregated at municipal level in order to avoid identifying private properties or sensitive sampling points that may be linked to an individual.

6. ACCESS TO AND DISCLOSURE OF DATA

Your personal data will only be accessible to the persons and entities whose involvement is necessary for the successful implementation of Life-Nitrazens. The following levels of access apply:

• Consortium team acting as joint controllers. Within the consortium, specific authorised staff members are appointed. Only these designated individuals may access the information for communication purposes, scientific validation, technical support for the app and administrative management.
• Project ambassadors. As territorial intermediaries acting on behalf of the consortium, project ambassadors will receive your name and telephone number only where this is necessary for the performance of the collaborative relationship under Article 6(1)(b) GDPR and for the operational coordination of the campaigns. Ambassadors are subject to a formal confidentiality undertaking and a duty of secrecy.
• European Union and supervisory bodies. Due to the legal obligations arising from funding under the LIFE Programme, the data may be audited by the European Commission or financial control agencies in order to verify the implementation of the project.
• International transfers through WhatsApp. The use of this platform means that your telephone number may be processed by Meta Platforms, Inc. in the United States under the Standard Contractual Clauses approved by the European Commission.

7. HOW DO WE PROTECT THE INFORMATION AND HOW LONG DO WE RETAIN THE DATA?

• Security. We apply encryption protocols and restricted access controls to ensure that no unauthorised person outside the project can access your data.
• During the project. The data will remain active for the duration of Life-Nitrazens.
• After the project. Once the project has ended, the data will be blocked and retained for a period of five years in order to comply with legal audits by the European Commission.
• Erasure and anonymisation. After this period, identifying data will be destroyed. Only fully anonymised scientific data will be retained for historical and research purposes.

8. WHAT ARE YOUR RIGHTS?

You have the right to:

• Know what personal data we process about you (right of access).
• Correct inaccurate data (right to rectification).
• Request the deletion of your data where they are no longer required (right to erasure or right to be forgotten).
• Object to certain processing activities (right to object).
• Request the restriction of processing in specific circumstances (right to restriction of processing).
• Not be subject to a decision based solely on automated processing, including profiling.
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before consent was withdrawn.

To exercise these rights, you may send an email to life-nitrazens@ibercivis.es, stating which right you wish to exercise and providing proof of your identity, such as the email address used when registering or, where necessary, a copy of your identity document.

If you believe that your request has not been handled properly, you have the right to lodge a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (AEPD) (https://www.aepd.es/).

9. MINIMUM AGE FOR PARTICIPATION

Independent participation in the project and the registration of personal data are restricted to persons aged 14 or over.

Children under the age of 14 may take part in citizen science activities only under the strict supervision of, and through the account of, a parent or legal guardian, who will be responsible for the accuracy of the data provided.