Privacy Policy
Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Last updated: 25 September 2026
This policy explains how personal data of visitors to medconnect-lighthouse.eu are processed. This is the official website of MEDCONNECT, a Horizon Europe project funded by the European Union under Grant Agreement No. 101296089. MEDCONNECT supports the Mediterranean Basin Lighthouse of the EU Mission “Restore our Ocean and Waters”.
This policy applies only to this website. It does not cover other websites that can be reached through links on it.
1. Data controller
The website is managed by MEDSEA Foundation (Mediterranean Sea and Coast Foundation). MEDSEA is the MEDCONNECT beneficiary responsible for communication and dissemination activities (Work Packages 3 and 4), including the project website. MEDSEA acts as data controller for the processing described in this policy.
- Address: Via Piemonte 33, 09127 Cagliari, Italy
- Email: info@medseafoundation.org. For questions about the MEDCONNECT website you can also write to info@medconnect-lighthouse.eu
- Tax code: 92228880925 – VAT number: IT03702320924
MEDCONNECT is coordinated by CMMI – Cyprus Marine and Maritime Institute. The project is carried out by a consortium of partners across the Mediterranean.
2. Data Protection Officer
The appointment of a Data Protection Officer (DPO) is currently in progress. In the meantime, you can contact the data controller at the details in Section 1 for any question about the processing of your personal data or to exercise your rights. This policy will be updated with the DPO’s contact details once the appointment is formalised.
3. Categories of data processed
3.1 Browsing data
The systems and software that run this website collect some data during normal operation, because it is transmitted as part of how Internet protocols work. These data are not collected to identify individual users. However, by their nature they could allow identification if combined with data held by third parties.
This category includes:
- the IP address;
- the date and time of the request;
- the requested resource (URI) and the method used;
- the server response code;
- the referring page;
- browser and operating system information (user agent).
These data are used only to ensure the correct functioning and security of the website. Server log files are kept on the hosting provider’s infrastructure for no longer than 30 days, according to the provider’s rotation schedule. The only exception is when longer retention is needed to investigate offences at the request of judicial authorities.
3.2 Website statistics
The website uses Independent Analytics, a WordPress plugin that produces aggregated statistics on website use: pages visited, referring websites, approximate geographic area (country and city), and device, browser and operating system type.
The plugin runs entirely on the server that hosts this website and does not send data to its developer or to any other third party. It does not use cookies and does not store or read any information on the visitor’s device.
The visitor’s IP address is used only at the moment of the visit, to determine the approximate location, and is not stored. To distinguish unique visits, the plugin combines the IP address, the browser information and a random value (salt) into an irreversible hash. Only this pseudonymous identifier is saved in the website database. The random value is renewed every 24 hours, so the same visitor cannot be recognised across different days.
Statistics are consulted only in aggregated form to monitor the reach of the project’s communication activities. As required by the Grant Agreement, they may be reported to the European Commission and its executive agency CINEA as communication indicators. Only aggregated figures are shared; they never allow individual visitors to be identified.
3.3 Data provided voluntarily
If you contact MEDCONNECT at the email addresses published on the website, we collect your email address and any other personal data in your message. We use these data only to reply to your request. Where needed to answer you, your message may be forwarded to the relevant MEDCONNECT consortium partner.
3.4 Future community and newsletter features
The website will gradually offer ways to join the MEDCONNECT Community, register for events and subscribe to a newsletter. Before any of these features goes live, this policy will be updated or a specific notice will be provided with the relevant form.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Technical operation and security of the website | Legitimate interest of the controller – Art. 6(1)(f) GDPR |
| Aggregated statistics on website use and reporting of communication indicators under the Grant Agreement | Legitimate interest of the controller in measuring the reach of EU-funded communication activities – Art. 6(1)(f) GDPR |
| Replying to requests sent by email | Steps taken at the request of the data subject – Art. 6(1)(b) GDPR – and legitimate interest – Art. 6(1)(f) GDPR |
| Page Insights on the project’s social media pages (Section 12) | Legitimate interest of the controller – Art. 6(1)(f) GDPR |
You can object at any time to processing based on legitimate interest (Section 8). No automated decision-making or profiling takes place.
5. Recipients
Personal data may be processed by authorised staff of MEDSEA Foundation (Art. 29 GDPR). They may also be processed by the following service provider, acting as data processor under Art. 28 GDPR:
- SiteGround Spain S.L. – Calle de Prim 19, 28004 Madrid, Spain – CIF B-87194171. SiteGround provides hosting, domain registration and email services on the basis of a data processing agreement. It uses sub-processors for data centre infrastructure.
Personal data may also be processed by external providers of website development, maintenance and IT services, acting as data processors under Art. 28 GDPR.
Where necessary to handle a request, data may be shared with other MEDCONNECT consortium partners, only for that purpose. Data may also be disclosed to public authorities where required by law.
Data are not disseminated or disclosed to third parties for any other purpose. An updated list of processors is available on request.
6. Transfers outside the European Union
The website, including the statistics described in Section 3.2, is hosted in a data centre located in Eemshaven, the Netherlands, within the European Union.
The hosting provider belongs to a group that also has infrastructure outside the European Economic Area. Any transfer between group entities is governed by the Standard Contractual Clauses approved by the European Commission (Chapter V GDPR).
7. Retention periods
- Server logs: no longer than 30 days.
- Website statistics: the pseudonymous identifiers cannot be linked to the same visitor after 24 hours. Statistics are kept for the duration of the project and the subsequent period required for reporting and audit under the Grant Agreement.
- Email communications: for the time needed to handle the request and any follow-up. After that, for the retention period required for project documentation under the Grant Agreement.
8. Your rights
Where applicable, you have the right to:
- access your personal data;
- have your data rectified or erased;
- restrict processing;
- data portability;
- object to processing based on legitimate interest (Articles 15–21 GDPR).
To exercise these rights, write to the controller at the details in Section 1.
Please note that the website statistics cannot be linked to you by name or other direct identifiers. Requests concerning these statistics may therefore require additional information to be handled (Art. 11 GDPR).
9. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live, work, or where the alleged infringement took place (Art. 77 GDPR). The lead supervisory authority for the controller is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it. You may also take legal action (Art. 79 GDPR).
10. Cookies
10.1 Technical cookies
This website uses only technical cookies that are strictly necessary for it to work. Under Article 5(3) of Directive 2002/58/EC and Article 122 of the Italian Privacy Code, these cookies do not require consent.
| Name | Source | Purpose | Duration |
|---|---|---|---|
wordpress_test_cookie | WordPress | Checks that the browser accepts cookies | Session |
wordpress_sec_* | WordPress | Secure authentication of authorised staff | Session |
wordpress_logged_in_* | WordPress | Keeps authorised staff logged in | Session |
wp-settings-*wp-settings-time-* | WordPress | Stores administration panel preferences | 1 year |
These cookies are set only for staff who log in to the administration area. They are not set for visitors browsing the public pages.
10.2 No analytics, profiling or third-party cookies
The website does not use analytics cookies, profiling cookies, advertising cookies or third-party tracking tools. The statistics tool described in Section 3.2 works without cookies and without storing or reading any information on your device. For this reason, no cookie consent banner is shown.
If tools requiring consent are introduced in the future, this policy will be updated before they are activated, and a consent management system will be implemented. Examples of such tools are embedded videos, maps or social media content. No such tool will be activated before the user has given consent.
10.3 Fonts and external resources
The fonts used on this website are hosted on the website’s own server. They do not cause connections to third-party servers while you browse.
10.4 Managing cookies through your browser
You can manage or delete cookies at any time through your browser settings. Disabling technical cookies may affect some website features.
11. External links
This website contains links to external websites, including the project’s social media pages and the websites of consortium partners. Those websites have their own privacy policies. MEDSEA Foundation is not responsible for their processing of personal data.
12. MEDCONNECT social media pages
MEDCONNECT has official pages on LinkedIn and Instagram. When you visit or interact with these pages, the platforms collect data about your use of them, such as content viewed, interactions, device information and cookies. The platforms use these data to provide page administrators with aggregated statistics (“Page Insights”).
For the processing of data used for Page Insights, MEDSEA Foundation acts as joint controller under Art. 26 GDPR with:
- LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, under the LinkedIn Page Insights Joint Processing Addendum;
- Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, under the Page Insights Controller Addendum.
All other processing on these platforms is carried out by LinkedIn and Meta as independent controllers, under their own privacy policies:
- LinkedIn: linkedin.com/legal/privacy-policy
- Instagram: privacycenter.instagram.com/policy
13. Changes to this policy
This policy may be updated to reflect changes in legislation, in the website, or in the project’s organisation. The version in force is the one published on this page, with the date of the last update.