Last Updated: January 2025

1. Data Controller

The data controller responsible for your personal data is:

2. What Data We Collect

When you use our contact form or interact with our website, we may collect the following information:

2.1 Contact Form Data

• Name: To address you properly in our communications
• Email Address: To respond to your inquiry
• Organization: To understand the context of your inquiry
• Inquiry Type: To route your message to the appropriate team
• Subject and Message: The content of your communication

2.2 Technical Data

• IP Address: Automatically collected for security and spam prevention
• Browser Information: User agent string for technical support
• Cookies: See our Cookie Policy below

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• Consent (Art. 6(1)(a) GDPR): When you submit the contact form, you explicitly consent to processing your data
• Legitimate Interest (Art. 6(1)(f) GDPR): To respond to inquiries and improve our services
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with EU funding requirements and reporting obligations

4. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your inquiries and provide requested information
• To communicate about the SmartUrbanity project
• To send newsletters (only if you explicitly subscribe)
• To improve our website and services
• To comply with legal obligations and EU funding requirements
• To prevent fraud and ensure website security

5. Data Sharing and Recipients

Your personal data may be shared with:

5.1 SmartUrbanity Consortium Partners

Data may be shared with our 16 partner organizations across Europe only when necessary for project coordination and only to the extent required. All partners are bound by GDPR and have signed data protection agreements.

5.2 Service Providers

• Email Service (Resend): To send emails
• Database Hosting (Supabase): To store contact submissions securely
• Website Hosting (Vercel): To host our website

All service providers are GDPR-compliant and have data processing agreements in place.

5.3 Legal Requirements

We may disclose your data if required by law, court order, or governmental authority.

6. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Adequacy decisions by the EU Commission
• Privacy Shield framework (where applicable)

7. Data Retention

We retain your personal data for the following periods:

• Contact Form Submissions: Up to 3 years after the project end date (December 2027), or until you request deletion
• Email Communications: As long as necessary for the correspondence purpose
• Newsletter Subscriptions: Until you unsubscribe
• Technical Logs: Maximum 90 days for security purposes

After these periods, data will be securely deleted or anonymized.

8. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

8.1 Right of Access (Art. 15 GDPR)

You can request a copy of all personal data we hold about you.

8.2 Right to Rectification (Art. 16 GDPR)

You can request correction of inaccurate or incomplete data.

8.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You can request deletion of your personal data under certain conditions.

8.4 Right to Restriction (Art. 18 GDPR)

You can request limitation of data processing in specific situations.

8.5 Right to Data Portability (Art. 20 GDPR)

You can receive your data in a structured, commonly used format.

8.6 Right to Object (Art. 21 GDPR)

You can object to processing based on legitimate interests.

8.7 Right to Withdraw Consent (Art. 7(3) GDPR)

You can withdraw your consent at any time without affecting prior processing.

8.8 Right to Lodge a Complaint (Art. 77 GDPR)

You can file a complaint with your national data protection authority.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: SSL/TLS encryption for data transmission
• Access Controls: Strict access limitations to authorized personnel only
• Secure Storage: Data stored in GDPR-compliant data centers
• Regular Audits: Security assessments and vulnerability testing
• Staff Training: All team members trained on GDPR and data protection
• Incident Response: Procedures for data breach notification within 72 hours

10. Cookies Policy

Our website uses cookies for the following purposes:

10.1 Strictly Necessary Cookies

Essential for website functionality. Cannot be disabled.

10.2 Analytics Cookies (Google Analytics)

We use Google Analytics (ID: G-FC52XJHM66) to understand how visitors use our site. This data is anonymized and used only for statistical purposes.

10.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality.

11. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. EU Funding Disclosure

SmartUrbanity is funded by MIMIT, NKFIH, BMFTR, TUBİTAK, Innosuisse, and ANR, under the Driving Urban Transitions Partnership, which has been co-funded by the European Commission. We may be required to share anonymized project data with funding authorities for monitoring and evaluation purposes.

13. Data Protection Officer (DPO)

Each consortium partner organization has designated a Data Protection Officer. For inquiries specific to data processing:

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Posting a notice on our website
• Updating the "Last Updated" date at the top
• Sending an email to registered users (if applicable)

We encourage you to review this policy periodically.

15. Contact Information

16. Specific Provisions for Newsletter Subscribers

If you subscribe to our newsletter:

• You must provide explicit consent by checking the subscription box
• You will receive a confirmation email (double opt-in)
• You can unsubscribe at any time via the link in each email
• Your email will be removed from our mailing list within 48 hours

17. Consent

By using our website and submitting the contact form, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.