1. Introduction

This Privacy and Cookie Policy explains how personal data is processed when you use the following NEUROCLIMA services operated by ITML CY (IOTAM Internet of Things Applications and Multi Layer Development Ltd):

• NEUROCLIMA Hub [https://hub.neuroclima.eu/]
• NEUROCLIMA Single Sign-On (SSO) [https://sso.neuroclima.eu/]
• NEUROCLIMA Lens [https://lens.neuroclima.eu/]

These services are developed and provided in the context of the NEUROCLIMA EU-funded project(Grant agreement ID: 101137711):

• The Hub is a public gateway to selected NEUROCLIMA applications and resources.
• The SSO service provides authentication for NEUROCLIMA applications that require login.
• Lens is an authenticated application for exploring and interacting with NEUROCLIMA-related content and results.

This policy applies only to these services. Other NEUROCLIMA applications may be operated by other organisations and may be subject to separate privacy and cookie policies.

2. Who we are and how to contact us

Controller: IOTAM Internet of Things Applications and Multi Layer Development Ltd. (ITML CY).

Address: 106 Georgiou Griva Digeni Str., 3101 Limassol, Cyprus

Email: info[at]itml[dot]com[dot]cy

3. What data we process

Depending on which service you use, we may process:

• technical and access data, such as IP address, browser and device information, timestamps, visited pages or routes, and security logs;
• authentication and account data needed for access control, such as name, username, email address, and role;
• session and token data needed to maintain secure access to protected applications;
• cookie consent data, such as your consent choices and related timestamps;
• limited analytics and usage data, if you consent to statistics cookies.

Search queries and filter selections in Lens and in the Hub Tools & Activities page may be processed transiently in order to return and display results during your active use of the service. We do not intend to maintain a persistent personal search history or user profile based on that activity, except to the extent that limited temporary browser/session state or ordinary technical and security logs are necessary to operate, secure, and troubleshoot the services.

4. Why we use the data

We use personal data to:

• provide and operate the Hub;
• authenticate users and manage secure access through SSO;
• provide Lens and its functionality;
• maintain security, prevent misuse, and troubleshoot issues;
• understand service usage and improve the services, where analytics consent has been given;
• comply with applicable legal obligations.

Where required under applicable law, we rely on:

• legitimate interests for operating, securing, and maintaining the services;
• performance of a contract for authenticated access and protected functionality;
• consent for statistics cookies and related analytics;
• legal obligation where processing is required by law.

5. Cookies and analytics

The services use cookies and similar technologies in a limited way.

We use necessary cookies for core functionality, secure sessions, authentication, and storing your cookie preferences.

With your consent, we also use statistics cookies to understand how the services are used and to improve them.These are used only for page-based statistics, usability analysis, technical monitoring, and service improvement.

We do not intentionally use cookies or analytics for advertising, retargeting, cross-site behavioural marketing,or commercial profiling.

We do not currently use cookies to store optional user preferences such as theme, personalization, or saved items,unless such features are introduced in the future.

Cookie consent is managed through Cookiebot by Usercentrics. You can accept or refuse non-essential cookies andwithdraw consent at any time through the cookie settings made available in the services.

6. Sharing of personal data

We do not sell personal data and do not share personal data for advertising purposes.

Where necessary, personal data may be processed or disclosed in the following limited cases:

• through the SSO service, to protected NEUROCLIMA applications that require authentication and authorisation;
• through Cookiebot/Usercentrics, for consent management and proof of consent;
• where disclosure is required by law or necessary to protect the security, rights, or integrity of the services.

7. Hosting and international transfers

The services and associated data are hosted in the EU region.

The authentication service and analytics service are self-hosted and self-managed within the project infrastructure in the EU. We do not intend to transfer personal data outside the European Economic Area in the normal operation of these services. If this changes, we will ensure that any transfer is made in accordance with applicable data protection law and subject to appropriate safeguards.

8. Personal data retention and security

We do not collect or retain your personal data longer than is necessary for the purposes described in this policy and in accordance with applicable legal and operational requirements.

Indicative retention period: 15 months

We use technical and organizational measures in accordance with good practice to ensure appropriate security of your personal data against accidental or unlawful loss, alteration, theft, unauthorized disclosure or access, unauthorized use and against all other unlawful forms of processing. The information provided to us by you will be stored in the main information system and access to information will be allowed on a need-to-know basis.

9. Your data protection rights

Subject to applicable law, you may have the right to:

• access your personal data;
• request correction of inaccurate data;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

To exercise these rights, please contact us using the details in section 2.

10. Other NEUROCLIMA applications

The Hub may provide access to other NEUROCLIMA applications, including Lens, Bot, Deliberate, Learn, and Play.

Where you leave the services covered by this policy and access another application or website, that application or website may be governed by a separate privacy and cookie policy, especially where it is operated by another organisation.

11. Changes to this policy

We may update this Privacy and Cookie Policy from time to time. The updated version will be published through the relevant service and will indicate the updated date.