General Data Protection Regulation (GDPR) Statement

The INITIATE project ("the Project") is funded by the European Union under Grant Agreement No. 101136775. This statement explains how personal data is collected, used, stored, and protected when you visit the INITIATE website, participate in Project activities (such as surveys, interviews, workshops, or events), or otherwise interact with the consortium, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

The Faculty of Mechanical Engineering and Naval Architecture, University of Zagreb (UNIZAG FSB), acting as the Project Coordinator, is the data controller responsible for personal data collected in connection with the coordination and monitoring obligations of the Project. Each consortium partner acts as a data controller for the personal data it collects directly within its own activities, in accordance with the Project's internal data governance framework overseen by the Data & Ethics Committee (Work Package 7).

What Personal Data We Collect

Depending on how you interact with the Project, we may collect:

• Contact details (name, email address, institutional affiliation) provided when subscribing to newsletters, registering for events, or contacting the Project
• Responses to surveys, questionnaires, and interviews conducted as part of stakeholder engagement activities
• Workshop and meeting participation records, including attendance and signature lists
• Photographs and video recordings taken at Project events and meetings
• Basic institutional information submitted by members of the INITIATE Stakeholder Community

Where possible, data is collected without direct identifiers. Sensitive or personal responses are pseudonymised or anonymised before further processing and analysis.

Purpose and Legal Basis of Processing

Personal data is processed for the following purposes:

• To organise, deliver, and document Project events, meetings, and stakeholder engagement activities
• To fulfil monitoring, reporting, and control obligations towards the European Commission and other competent authorities
• To disseminate and communicate Project activities and results, including through the website, social media, and media outlets
• To support the INITIATE Knowledge Base and Stakeholder Community, enabling collaboration and knowledge exchange

The legal basis for this processing is the consortium's performance of a task carried out in the public interest under the Grant Agreement (Article 6(1)(e) GDPR), and, where applicable, your explicit consent (Article 6(1)(a) GDPR), particularly for the use of photographs, video recordings, and voluntary survey participation.

Data Storage and Security

Personal data is stored in secure, access-controlled environments. Documents, consent forms, and stakeholder records are held on the consortium's internal SharePoint (OneDrive), while code and technical tools are hosted on GitLab/GitHub. The INITIATE Knowledge Base applies encryption-at-rest, access logging, and role-based permissions. Access to personal data is restricted to authorised consortium personnel who require it for the purposes described above, and the consortium follows recognised security standards, including ISO/IEC 27001, to safeguard confidentiality, integrity, and availability of information.

Data Retention

Personal data is retained for the duration of the Project and for the limited period thereafter required to meet legal, audit, and reporting obligations to the European Commission. Data no longer required for these purposes is securely deleted or fully anonymised.

Sharing of Personal Data

Personal data may be shared with:

• Consortium partners, to the extent necessary for coordinated Project implementation and reporting
• The European Commission and other control bodies or competent authorities, where required to demonstrate compliance with the Grant Agreement
• The public, only where you have given explicit consent — for example, photographs or videos published on the Project website, social media channels, or partner communication materials

Personal data is not sold, rented, or shared with third parties for commercial purposes.

Your Rights

Under the GDPR, you have the right to:

• Access the personal data held about you
• Request rectification of inaccurate or incomplete data
• Request erasure of your data, where applicable
• Request restriction of processing
• Object to processing carried out on the basis of legitimate or public interest
• Data portability, where technically feasible
• Not be subject to a decision based solely on automated processing

To exercise any of these rights, please contact the Project Coordinator at the address below. You also have the right to lodge a complaint with your national data protection authority.

Contact

For any questions regarding this GDPR statement or the processing of your personal data within the INITIATE project, please contact:

INITIATE Project Coordination Team — UNIZAG FSB info@initiateproject.eu

Updates to this Statement

This GDPR statement may be updated periodically to reflect changes in Project activities, data management practices, or applicable legislation. The current version applies as of the date of publication on the INITIATE website. This statement reflects the data management and governance practices described in the Project's Data Management Plan (D7.3, Mid-Term version).