Our Terms of Use, Privacy Policy, and Cookie Policy sections

Privacy Policy

Trust-IT Services srl, with registered offices in Via Francesco Redi 10, 56124 Pisa (PI), Italy, VAT and Fiscal Code IT01870130505, PIC 906664821 (“Trust-IT”, “we”, “us”), is committed to protecting the privacy of everyone who uses the POLARIS website at www.polaris-eccch.eu (the “Website”) and its related services. This includes newsletter subscribers, event participants, applicants to the POLARIS calls and the External Evaluators.

This Privacy Policy explains which personal data POLARIS collects, why we collect it, on what legal basis, how long we keep it, who receives it and which rights you have. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the data protection obligations set out in Article 15 of the POLARIS Grant Agreement.

POLARIS receives funding from the European Union’s Horizon Europe programme under Grant Agreement No 101311855 (call HORIZON-CL2-2025-01-HERITAGE-03). Athens Technology Center S.A. coordinates the project, which involves nine beneficiaries and one affiliated entity based in six countries. When personal data reaches the European Commission or its executive agency for grant management purposes, the granting authority processes it as an independent controller under Regulation (EU) 2018/1725 and its own privacy statement.

CONTENTS

1. Data controllers

2. Personal data processed

3. Purposes of processing

4. Legal bases for processing

5. Recipients of personal data: Data Processors

6. Other recipients of personal data

7. International transfers

8. Retention of personal data

9. Data subjects’ rights

10. Security measures

11. Amendments

1. Data controllers

Trust-IT is the data controller for all personal data processed through the Website, the contact form, the newsletter, the requests addressed to the Library Innovation Support Hub and the POLARIS Grants platform. This covers the open calls, the call for External Evaluators and the call for Stakeholder Advisory Group members. Trust-IT holds this role as the partner that manages these activities under the Grant Agreement.

When a consortium partner collects personal data directly, for instance during a pilot workshop or a survey it organises, that partner acts as data controller for that data and gives you a specific information notice at the time of collection. Annex A lists all consortium partners.

You can contact Trust-IT with any question about this Privacy Policy or about how it processes personal data by writing to privacy@polaris-eccch.eu, or through the contact form on the Website. The Data Protection contact for Trust-IT is Michele Nannipieri, reachable at the same address.

2. Personal data processed

When you use the Website, Trust-IT collects and processes information that identifies you, either on its own or together with other information (“Personal Data”). We collect it when you choose to provide it, for example when you apply to a call or subscribe to the newsletter, and through the routine technical operation of the Website.

a. Registration, Contact form, Support Hub requests and newsletter

If you create an account on the Website, when you write to us through the contact form or ask the Library Innovation Support Hub for support, we process your name and surname, email address, organisation, country, gender (collected only where required for the statistical monitoring information POLARIS must provide to the European Commission on project performance and the content of your message. When you subscribe to the newsletter, we process your email address and the other details the subscription form asks for.

b. Open Call applicants

To apply to a POLARIS open call, you create an account on the Grants platform and submit an application. We may ask for your name and surname, professional title, organisation name and type, primary and secondary domain of work or expertise, email address, city and country of residence, postal address, gender, LinkedIn profile and picture. We use gender data only to monitor gender balance and to report aggregated statistics to the granting authority.

Each application also includes the CV of the applicant and of every team member involved in the proposal, with the information a CV normally contains, such as education, professional experience, skills, languages and publications, together with any further information you choose to include in the proposal. For selected applicants, we process the data needed to sign the agreement for financial support and to transfer the funds, such as the details of the legal representative and bank account details.

Mandatory fields are marked as such in the online forms, and we cannot process an application if any of them is left empty. To assess an applicant’s suitability, we may consult professional social media accounts, such as LinkedIn, or professional websites, where these are publicly available or disclosed by the applicant.

c. External Evaluators

POLARIS selects its External Evaluators through a dedicated open call. To apply, you register on the Grants platform, complete the application form and attach your CV. We process your name and surname, contact details, organisation, country, areas of expertise, professional experience and the other information contained in your CV.

Before evaluating any proposal, each evaluator signs a contract with provisions on conflict of interest and confidentiality. Once you are selected, we process the data needed to sign that contract and to pay your remuneration, such as bank account. We also keep records of your evaluation activity, including the proposals assigned to you, your scores and your comments.

d. Stakeholder Advisory Group candidates

Candidates to the Stakeholder Advisory Group apply through the Website. We process the same categories of data described in section 2.b, to the extent that the application form asks for them. The names and affiliations of the selected members will be published on the Website.

e. Events, webinars, photos and video recordings

When you register for a POLARIS event or webinar, we may ask for your name, organisation, email address, country, the dates you will attend and any dietary or accessibility requirements (see section 2.g). For online events on Zoom, the platform also processes your name, email address and technical data about your connection.

We take photos and record videos during events, and we may record entire sessions. These materials can show your image and include your voice, your presentation and any messages you post in the chat.

f. Pilot and co-creation activities

The three POLARIS pilots, run by the British Library, the Laboratory for the Study of Hellenic Music of NKUA and the Biblioteca Malatestiana through Rete delle Reti, involve librarians, researchers, students and citizens in co-creation workshops, hackathons, surveys and annotation campaigns. Participation is always voluntary and based on your informed consent.

The partner organising each activity collects the data it needs, such as your name, contact details, professional profile and your answers or contributions, and gives you a specific information notice. Research data is anonymised before it is shared or deposited in open repositories such as Zenodo. Third parties funded through the open calls act as controllers for the personal data they collect within their own projects.

g. Special categories of Personal Data

When you register for an event, we ask whether you have dietary or accessibility requirements. This information may qualify as data concerning your health or data revealing your religious or philosophical beliefs, which are special categories of personal data under Article 9 GDPR. We process it only with your explicit consent and only to meet your request. Surveys carried out as part of the POLARIS gender and inclusion analysis may include optional questions on sensitive aspects, and in that case the survey itself asks for your explicit consent.

Free text fields on the Website and on the Grants platform could also lead you to disclose, inadvertently or not, more sensitive information, such as your racial or ethnic origin, political opinions, trade union membership or data concerning your health or sex life. Please do not share this kind of information unless you consider it strictly necessary. If you choose to share it, Trust-IT needs your explicit consent to process it.

h. Other persons’ Personal Data

Some fields on the Website and on the Grants platform allow you to submit information about other people, for example the CVs of your team members or details of colleagues in a free text message. In that case you act as an independent data controller for that information and take on the related legal obligations and responsibilities.

As Trust-IT does not collect this information directly from those people, you must make sure you have their consent, or another appropriate legal basis, before sharing it with us, and you must inform them about this Privacy Policy. You will indemnify Trust-IT against any complaint, claim or demand for compensation brought by those people in relation to the data you provided.

i. Browsing data

Like any website, the Website collects technical information about its visitors as part of its routine operation. This includes your IP address, country, the domain names and type of your device, the addresses of the resources you request, the time and method of each request, the size of the file received and the status code returned by the server. Although Trust-IT does not collect this information to link it to specific users, it may still allow them to be identified, so it counts as Personal Data.

We use this information to compile statistics on the use of the Website, to make sure it works correctly, to restore it after technical failures and to detect faults or abuse. Except for this last purpose, we keep browsing data for no longer than 60 business days.

j. Cookies

The Website uses cookies. The Cookie Policy section of this document explains which cookies we use and how you can manage them.

3. Purposes of processing

Trust-IT uses your Personal Data, collected through the Website and the Grants platform, for the following purposes:

1. to answer your enquiries, handle your requests to the Library Innovation Support Hub, manage your account on the website and the Grants platform and help you if you lose your login details (“Service Provision”);
2. to send you the POLARIS newsletter and other updates on project news, calls, events and results (“Newsletter”);
3. to check the eligibility of applications to the open calls, the External Evaluators call and the Stakeholder Advisory Group call, to evaluate and select them, to sign agreements and contracts, to pay financial support and remuneration, and to monitor and mentor the funded projects (“Applications”);
4. to publish information on the funded projects, namely the name of the organisation, the title of the project and the amount of financial support received, and to report on the calls and their results to the granting authority (“Transparency and Reporting”);
5. to process your registration for events and webinars, organise your participation and track attendance (“Events/Webinars”);
6. to use photos, videos, recordings and presentations from events, in print and digital form, on the Website, on the POLARIS YouTube, LinkedIn and Bluesky channels, in the newsletter, on Zenodo, in news articles and in other communication and dissemination materials (“Photos and Recordings”);
7. to run co-creation workshops, hackathons, surveys and annotation campaigns within the pilots, and to analyse their results (“Pilot Activities”);
8. to comply with the legal and contractual obligations of Trust-IT and the consortium, including those set out in the Grant Agreement on data protection, record keeping, financial support to third parties and checks, reviews and audits (“Compliance”);
9. to understand how visitors use the Website and to improve it (“Analytics”);
10. to prevent and detect any misuse of the Website or the Grants platform and any fraudulent activity, including through internal audits (“Misuse/Fraud”).

4. Legal bases for processing

Trust-IT relies on the following legal bases for each of the purposes listed in section 3:

1. Service Provision: the processing is necessary to perform a contract with you (Art. 6(1)(b) GDPR). Giving us your data is not mandatory, but without it we cannot provide the service you request.
2. Newsletter: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without affecting the lawfulness of the processing carried out before withdrawal.
3. Applications: the processing is necessary to take steps at your request before entering into a contract, and to perform that contract once signed (Art. 6(1)(b) GDPR). Without your data we cannot consider your application.
4. Transparency and Reporting: compliance with the obligations deriving from the Grant Agreement and the EU rules on financial support to third parties (Art. 6(1)(c) GDPR), together with our legitimate interest in giving visibility to the results of the calls (Art. 6(1)(f) GDPR).
5. Events/Webinars: the processing is necessary to handle your registration and attendance and therefore to perform a contract with you (Art. 6(1)(b) GDPR). Attendance tracking relies on our legitimate interest in managing and reporting on events (Art. 6(1)(f) GDPR).
6. Photos and Recordings: your consent (Art. 6(1)(a) GDPR). Giving it is optional. If you do not consent, we will not use images or audiovisual footage of you for the purposes described above.
7. Pilot Activities: your informed consent (Art. 6(1)(a) GDPR), collected by the partner organising the activity.
8. Compliance: the processing is necessary to comply with legal obligations (Art. 6(1)(c) GDPR).
9. Analytics: your consent, given through the cookie banner (Art. 6(1)(a) GDPR).
10. Misuse/Fraud: our legitimate interest in the security and sound administration of the Website, the Grants platform and the calls (Art. 6(1)(f) GDPR).

Special categories of personal data (section 2.g) are processed only on the basis of your explicit consent (Art. 9(2)(a) GDPR).

5. Recipients of personal data: Data Processors

Your Personal Data may be shared with the following entities, which process it on behalf of Trust-IT under a data processing agreement to provide or support the Website and its services (“Data Processors”):

• COMMpla Srl, Via Francesco Redi 10, 56124 Pisa, Italy, VAT 01958380501, info@commpla.com, which developed and operates the POLARIS Grants platform and supports the management of the calls;
• Sendinblue SAS (Brevo), Paris, France, registered with the Paris Trade and Companies Register under number 498 019 298, which manages the newsletter;
• Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, managing webinar service, with Personal Data Residency in Europe;
• Google Ireland Limited; Gordon House Barrow Street, Dublin 4 DUBLIN, D04 E5W5 Ireland, managing the Google Analytics service for European based website.;
• the External Evaluators, individually contracted and bound by confidentiality and conflict of interest obligations, each of whom accesses only the proposals assigned to them.

More information on these processors and on the relevant data processing agreements is available on written request to privacy@polaris-eccch.eu.

6. Other recipients of personal data

Your Personal Data may also be shared with the following persons and entities (“Recipients”):

• the POLARIS consortium partners listed in Annex A, to the extent they need it for their tasks, such as managing and mentoring the funded projects, running the Library Innovation Support Hub, organising events and coordinating the Stakeholder Advisory Group, which Rete delle Reti and IFLA lead;
• the granting authority, meaning the European Commission or its executive agency, which receives information on the calls and on the funded third parties as required by the Grant Agreement and acts as an independent controller;
• the EU bodies entitled to carry out checks, reviews, audits and investigations under Article 25 of the Grant Agreement, such as the European Commission, the European Anti-Fraud Office (OLAF), the European Court of Auditors and the European Public Prosecutor’s Office;
• persons, companies or professional firms that advise Trust-IT on accounting, administrative, legal and tax matters, which typically act as data processors;
• persons authorised by Trust-IT to process Personal Data for the activities described in this Policy, who are bound by confidentiality obligations;
• public entities, bodies or authorities, where applicable law or a binding order requires it.

The information on funded projects described under “Transparency and Reporting”, as well as the photos and recordings published with your consent, will be publicly available on the Website and on the POLARIS communication channels.

When you follow or interact with POLARIS on social media, the platforms act as independent controllers under their own privacy policies. These are LinkedIn Ireland Unlimited Company for LinkedIn, Bluesky Social PBC for Bluesky.

7. International transfers

We process most Personal Data within the European Union and the European Economic Area. Transfers outside this area take place in two cases.

The British Library, a POLARIS partner, is based in the United Kingdom. On 19 December 2025 the European Commission renewed its adequacy decision for the UK under the GDPR, which applies until 27 December 2031, so transfers to the UK require no additional safeguards.

Brevo stores newsletter data on servers located in the European Union. We do not knowingly transfer Personal Data outside these arrangements.

8. Retention of personal data

Personal Data processed for Service Provision is kept for as long as we need to handle your request. Where the exchange concerns project activities, we keep it for the record keeping period that applies to Compliance.

Personal Data processed for the Newsletter is kept from the moment you give your consent until you withdraw it.

Personal Data processed for Applications is kept for five years after the payment of the balance of the POLARIS grant, as Article 20 of the Grant Agreement requires. This applies to all applicants, successful or not, to the External Evaluators and to the Stakeholder Advisory Group candidates. We keep the data longer if audits, reviews, investigations or litigation are still ongoing at the end of that period.

Personal Data processed for Events/Webinars is kept for the time needed to organise and report on the event, and then for the record keeping period that applies to Compliance.

Photos and Recordings are kept for the duration of the project and the following record keeping period. You can withdraw your consent at any time, and from that moment we will stop any new use of the materials in which you appear.

Personal Data processed for Pilot Activities is kept as set out in the information notice of the partner organising the activity. Anonymised datasets no longer contain Personal Data and may remain available in open repositories.

Personal Data processed for Compliance is kept for the period required by the specific legal obligation or by the Grant Agreement. Browsing data is kept for no longer than 60 business days, except where we need it to investigate faults or abuse. Personal Data processed to prevent Misuse/Fraud is kept for as long as strictly necessary for that purpose.

More information on retention periods is available on written request to privacy@polaris-eccch.eu

9. Data subjects’ rights

As a data subject, you are entitled to exercise the following rights towards Trust-IT at any time:

1. access your Personal Data, obtain a copy of it and receive information on how we process it;
2. have inaccurate or incomplete Personal Data corrected or updated;
3. request the erasure of your Personal Data where you consider the processing unnecessary or unlawful;
4. request the restriction of processing where you consider the data inaccurate, unnecessary or unlawfully processed, or where you have objected to the processing;
5. receive the Personal Data you provided in a structured, commonly used and machine readable format, and have it transmitted to another controller (data portability);
6. object to processing based on legitimate interest, on grounds relating to your particular situation;
7. withdraw your consent at any time where processing relies on it, without affecting the lawfulness of processing carried out before withdrawal.

You can exercise these rights by writing to privacy@polaris-eccch.eu or through the Website contact form. You can unsubscribe from the newsletter at any time using the link at the bottom of every email, and you can update most of the data you provided on the Grants platform directly from your account.

If you believe we process your Personal Data unlawfully, you can lodge a complaint with the competent supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it). You can also contact the supervisory authority of your country of residence. For activities run by the British Library, the competent authority in the UK is the Information Commissioner’s Office (ico.org.uk).

10. Security measures

Trust-IT and the consortium partners involved in the processing apply appropriate technical and organisational measures to protect Personal Data against unauthorised access, alteration, disclosure or destruction, in line with Article 15 of the Grant Agreement. Only people who need Personal Data to implement, manage and monitor the relevant activity can access it, and they are bound by confidentiality obligations.

11. Amendments

This Privacy Policy entered into force on 01/10/2026.

Trust-IT, on behalf of the POLARIS consortium, may amend or update this Privacy Policy, in whole or in part, for example following changes in the applicable law or in project activities. Changes become binding once published on the Website, so we invite you to check this page regularly to stay informed on how we collect and use Personal Data.

Annex A. POLARIS Consortium

Coordinator: Athens Technology Center S.A. (ATC). The full consortium is composed of beneficiaries (“BEN”) and one affiliated entity (“AE”):