After providing a broad overview of the general objectives and purposes of data processing, we would like to present the specific types of data that may be handled throughout the lifetime of the BEHOLDER project. To ensure seamless and uninterrupted execution of multiple activities and tasks, effective collaboration among participants and full compliance with legal and any other obligations, the project’s partners (consortium members) will collect and process various types of data. Nevertheless, any data collection and processing must be carried out solely for the purposes and on the legal basis set forth in this privacy notice. All consortium members hereby commit to fully comply with these requirements.

Special categories of personal data

Under the GDPR, certain types of personal data are classified as special category data, the collection and processing of which are permitted only under limited circumstances. This category includes information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, data concerning sexual orientation as well as the processing of genetic data or biometric data for the purpose of uniquely identifying a natural person.  The BEHOLDER project is not expected to involve the processing of any data that falls within this special category.

Since the BEHOLDER project collects data on a larger scale from multiple sources and is designed to manage a rather extensive database, it is important to consider potential “what-if” scenarios involving the inadvertent inclusion of special category data. In such unlikely cases, data processing must follow an alternative procedure that ensures the data subject is notified and can exercise their rights as effectively as in any other instance of processing. By establishing a clear procedure for handling such situations, data processors and participating partners are also made aware of their responsibilities. If a partner, a data subject or a third party identifies the presence of special category data, the collector, the Ethics Advisor Board or the Data Protection Officer (DPO) must be notified. The DPO will evaluate the relevance of the disclosed data and determine whether continued processing is necessary, appropriate within the context of the BEHOLDER project, or justified by any of the legal bases outlined below. If the data in question does not meet these criteria, it must be permanently terminated. However, if the further processing of such data is legally justified, the collector is not obligated to delete it. For example, such cases might arise when the data subject gives explicit and informed consent for the processing of their data for a specific purpose.

We would like to reiterate that the occurrence of such situations is highly unlikely, as the BEHODLER project does not collect personal data without the data subject’s knowledge. Regardless of the legal basis for processing, data subjects will always be informed in advance about the scope of the data being collected.

Data protection during the execution of work tasks

Every employee engaged in the BEHOLDER project under a valid employment or other legally binding contract with one of the project partners is obligated to adhere to the following requirements, which are intended to improve the quality of data security. Devices (e.g. phones, laptops, tablets) must be secured with strong PIN-codes or passwords, and an auto-lock mechanism must be enabled when devices are left unattended. Internal meetings within a partner’s organization, especially if personal data is discussed, must not be recorded without an explicit permission. If such recordings are made, they are subjected to the same principles and requirements outlined in this privacy notice.

The collector may maintain logs of data access by its employees and their activities can be monitored within legal boundaries (e.g. data stored on work-related devices can be checked by a supervisor appointed by the controller).

If an employee of the controller is not assigned any work tasks related to the project, access to the data processing connected to the project must be strictly prohibited and effectively prevented.  Even if an employee is involved in the project, they may only access data to the extent and within the scope necessary for carrying out the previously assigned tasks.

In addition, all beneficiaries participating in the BEHOLDER project must maintain records of their employees who are involved in activities related to the implementation of the project and who have been authorized to access classified information. Information from these records may be retrieved if an issue related to unauthorised disclosure or processing arises or if a legitimate interest arises on the part of a consortium member in connection with a beneficiary’s employee (e.g. for the purpose of conducting a legal dispute).

The personal data of employees participating in the BEHODLER project will be processed by the respective consortium member employing them under an employment contract, as well as by the project coordinator (DISSS) at a higher level. The legal basis for this processing includes, on one hand, the fulfilment of contractual obligations (e.g. salary transfers), and on the other, compliance with financial transparency and budgeting requirements, as the BEHOLDER project is funded by the European Union. This data may also be processed by the parties when there is a legal obligation to do so (e.g. reporting to an EU body on the project’s financial status or to submit data to various national authorities).

Consortium management

Members of the BEHOLDER project’s consortium are required to maintain close contact with one another to maximize cooperation and enhance the success of teamwork. To establish effective collaboration, it is necessary to manage the contact information (personal data) of consortium members and, where appropriate, share it with other members of the BEHODLER project. Certain personal data (e.g. phone number, email address) might be shared to facilitate communication or provided to the organizing party when internal meetings or semi-annual assemblies (e.g. General Assemblies), whether held physically or in a hybrid format, are being arranged.  Primarily the project coordinator (DISSS), and additionally any consortium member seeking to communicate with another, reserves the right to collect and process the personal data of the members on the basis of their legitimate interest, limited strictly to what is necessary for effective internal communication.

Beside internal communication, responding to external opportunities is equally important for the project to succeed. Within the context of project management, methodologies and roles may be defined by the task leader (OpenRemote) to support external research and innovation activities. As part of these activities, ongoing patent and intellectual property rights (IPR) research and the implementation of IPR protection measures might involve processing of relevant personal data, which will be managed in accordance with the applicable data protection requirements detailed in this privacy notice.

Data related to practitioners and citizens

The BEHODER project is built on the principle of close cooperation among various external partners, as its main goal, to create a safer urban environment, can only be effectively achieved through teamwork. Following this approach, the involvement of different stakeholders, partitioners and citizens is essential.

In order to make the results of the research carried out under the BEHOLDER project applicable in real-world settings, the project seeks to engage multiple practitioners (e.g. local government managers, urban planners, general public). The data collector may process the personal data of those involved in the practical aspects of the project for various purposes and on different legal bases. Based on the legitimate interest of the collector, names and contact information of potential external practitioners, may be collected and processed. After contacting a potential practitioner (candidate), an offer to enter into a contract may be made. From this initial preparatory step, which is known to both parties, the legal basis and the extent of data processing will be adjusted accordingly. This means that different categories of data may be collected from the data subject if such processing is necessary for the performance of the contract. The content of the contract concluded between the data subject and a member of the consortium may not be limited solely to ensuring participation but may also include a non-disclosure agreement (NDA).

Stakeholders’ engagement

The BEHOLDER project’s structure was designed to support wide-ranging participation, extending beyond the involvement of various partners and internal consortium members. Success also requires a multi-stakeholder engagement from public and private actors. At the outset, the active engagement of all partners and stakeholders is essential to refine and gather the specific needs we intend to address by the end of the project. Throughout the project’s duration, multiple collaborative workshops (online and hybrid), expos, conferences, and regular consultations will be held to connect the consortium with diverse end-users and stakeholders, while showcasing the project’s progress and achievements. The project aims to conduct multiple user feedback sessions to collect s from practitioners across the field (e.g. to refine the GUI design) and to incorporate stakeholders’ proposals and feedback into ongoing developments, ensuring their perspectives are considered as the project evolves. To establish contact with potential stakeholders (e.g., city authorities) who may be invited to submit proposals in the future, the consortium needs to access a limited set of their personal data (e.g., email addresses and other contact information). This data will be processed based on the consortium’s legitimate interest and will be deleted if no cooperation is established and the data is no longer necessary for future collaboration, or if a new legal basis applies (e.g., a contract is concluded between the parties).

Attendance at the events organised by the project’s partners is voluntary. If individuals choose to attend, their personal data may be collected based on the legal bases of informed consent. At some events short videos and pictures will be taken and posted of the project’s website and/or other social media channels. Mini video interviews with project partners may also be conducted, subject to their informed consent. In these situations, the scope of consent is determined by the individual who gave it, which means that they may agree to certain data processing activities (e.g. participation in a group photograph) while refusing others (e.g. personal interviews).

At events where registration is required, participants may voluntarily register after reading the provided and adequate information published on the website where registration can be submitted. In some cases, participants may also be notified via confirmation emails about the extent of data collection and processing during the event (e.g. that recording may take place). For events open to the public without registration, appropriate information about data collection will still be available. For example, this may include notices posted on the event’s promotional website, announcements displayed on event materials, cautionary signs at the venue, or verbal notifications made during the event. In such situations, the notice informs participants about the possibility of recordings being made during the event. Attendance with awareness and understanding of this possibility is generally interpreted as consent to appear in the recording. Nonetheless, participants must be allowed to define the limits of their consent, being featured in photos and other recordings must not be a precondition for attending the event. If someone does not wish to appear In such media, they must be given the opportunity to express their will explicitly and cannot be compelled to appear in recordings solely on the basis of attending the event.

In certain cases, data collection and processing may also be carried out based on the legitimate interest of the consortium or a third party. For example, this may include collecting data for statistical purposes, such as participation numbers or attendance figures. Data collection may sometimes be required by legal obligations during events, such as when an accident occurs and the appropriate authorities need to be notified.

The project’s partners might reach out to specific stakeholders for direct engagement, although processing of their personal data only occurs if informed consent has been obtained or they have previously entered into a contract.  Even in this case, the collector may only process data that fall within the applicable legal basis.

Website and dissemination materials

To support the adoption and the integration of the BEHOLDER project’s results among relevant stakeholders and the general public, dissemination, exploitation, innovation uptake activities and the maintenance of continuous communication channels must remain a central focus and will not be overlooked. The key communication tools include short videos, infographics, banners, posters and (scientific) publications. While the project aims for constant and regular communication with the public, ad-hoc or emergency communication might also happen if required (e.g. sending out a notification in the event of an unforeseen circumstance).

A publicly available, open-access BEHOLDER website will be created and launched by the project to reach the general public and share information on the project’s objective(s). Upon visiting the website, cookies and similar tracking technologies will be used to enhance functionality and to analyse usage. These trackers might collect certain types of personal data (e.g. IP-address, browsing behaviour). The website clearly distinguishes between different categories of cookies, such as essential (strictly necessary) and non-essential (e.g. preference, marketing) ones. Essential cookies ensure the functionality of the website and cannot be disabled via the cookie consent tool. They are used based on legitimate interest, as the website and its specific services (e.g., logging in) would not function correctly without them. The use of non-essential cookies requires the visitor’s informed consent, which must be obtained prior to the activation of any such cookies.

Before accessing our website, visitors will be provided with accurate and specific information about the categories of data each cookie tracks and the purpose of such processing, presented in plain and easily comprehensible language. A cookie consent popup will inform visitors about their option to give informed consent, the extent of data processing while browsing the pages of the website and the opportunity to access more detailed information about trackers used. Visitors will be able to manage their cookie preferences at any time through the website settings. Non-essential cookies, which require consent, which require consent, will cease data tracking if visitors withdraw their consent.

Beside the website, several social media channels (e.g. LinkedIn, YouTube channel) will be set up to produce, publish and post content in accordance with the project’s progress status. For example, recordings made at the events, as mentioned above, will be posted on these platforms.  SFC is responsible for developing and maintaining both the website and the media channels, who therefore primarily has access to the personal data necessary for their smooth operation (e.g. data tracked by cookies), Nevertheless, all partners will have the opportunity to provide partner introduction, posts on project activities and post news on their own or the project’s media account. In this case, if another consortium member has a legitimate interest, they might also gain access to the acquired data. For example, a guest who created an account on the website could receive an invitation to an event from any member via the email address provided or get notified through their social media account.

Dissemination activities have a fundamental importance throughout the BEHOLDER project to share the benefits with the general public and receive feedback. Engagement of stakeholders, the scientific community and public actors (e.g. inventors, NGO’s) is essential for the exploitation and dissemination of the project’s outcomes. We aim to motivate and incentivise stakeholder to initiate further cooperation, conduct market analysis and to carry out needs assessment. During these activities the consortium might collect data of the potential participants based on its legitimate interest and reach out to them to offer the possibility of entering into a contract to qualified candidates. The requirements for such data processing are identical to those applied when the consortium seeks to engage with external practitioners.

To properly inform the interested public, the BEHODLER project will distribute an electronic newsletter at regular intervals. Subscription to the newsletter will be available online via our website. When a data subject signs up, certain types of data must be provided in order for the project members to establish contact with the individual. The processing of this data is based on informed consent given electronically by the data subjects themselves. Subscribers to the newsletter will have the option to unsubscribe at any time. By unsubscribing, data subjects withdraw their consent, and their data related to the newsletter will be deleted.

Scientific community and publications

The support and involvement of the scientific community are vital to the success of the BEHOLDER project. Multiple research institutions will be approached in order to request their insights and collaboration in advancing the project. To enhance their engagement, several scientific conferences and dedicated workshops will be organized. Participation in these types of events will be subject to the same data collection regulations as previously outlined.

Publications of research outcomes will be ensured in high-impact journals. Since the BEHOLDER project is implemented within the framework of the Horizon programme, it adheres to the established principles such as Open Science. Researchers publishing their work under the project must comply with transparency, accessibility and reproducibility promoted by Open Science. For example, open access to research data implies that the data supporting publications will be shared in repositories like Zenodo after appropriate safeguards for personal data security have been applied. When individuals are involved in a research-focused part of the project, we ensure that their data is anonymized or pseudonymized before publication whenever possible. Participants will be informed about the potential for open publication, and only data necessary to validate or understand the research findings is made publicly available. Research publications will not include personally identifiable information unless explicit and informed consent has been obtained, such consent can be withdrawn at any time for future use. Prior to the release of any external publications, SFC will present a detailed publication and quality assurance process to which our research partners will be informed and adhere. This quality assurance process is subjected to internal peer reviews and the approval of the project coordinator. During these quality assessments, it is possible that the project coordinator or other members of the consortium may gain access to a researcher’s personal data. However, even in such cases, these data will not be processed beyond what is necessary for the processors’ legitimate interest (e.g. storing email addresses for future cooperation), for fulfilling contractual obligations (e.g. transferring agreed remuneration to a bank account specified in the contract), or for complying with legal obligations (e.g. submitting data to tax authorities after payment has been made).