Privacy Policy
Stay updated with the latest policies from the AENAON project.
Privacy Policy
1. Who We Are and What This Policy Covers
This Privacy & Cookies Policy explains how the AENAON Consortium collects and processes personal data through the AENAON project website (“the Website”). Zelus IKE acts as data controller for the AENAON website, providing website content management and WordPress administration support. It may access WordPress user accounts, contact form submissions, newsletter records, event registration data, technical logs or other Website data where necessary for website maintenance, content publication or technical support.
AENAON (Ex-Ante cybersecurity Federated Digital twin-based Cyber Range and managed security services for offshore wind farms) is funded under the Digital Europe Programme, Grant Agreement No. 101249723.
This Policy does not cover the AENAON Open Call portal. A separate Open Call Privacy Notice applies to applicants, evaluators, and sub-grantees, available at https://aenaon-project.eu/open-calls/.
| Data Controller | Zelus IKE, Michalakopoulou56, 115 28 Athens, Greece |
| Data Protection Officer Contact | Dpo@aenaon-project.eu |
| Open Call processing | Governed by a separate Open Call Privacy Notice |
| Legal framework | Regulation (EU) 2016/679 (GDPR); Law 4624/2019; Article 15 of Grant Agreement No. 101249723. |
The internal allocation of responsibilities between consortium partners is set out in the AENAON Consortium Agreement (Section 11). Zelus IKE determines the purposes and means of the processing of personal data through the AENAON website and acts as data controller for that processing. Where service providers process personal data on behalf of Zelus IKE for website operations, this is governed by appropriate data protection arrangements, including Article 28 GDPR processor terms where applicable.
2. Personal Data We Collect and Why
We collect personal data only for specific, explicit and legitimate purposes and only to the extent necessary. Where legitimate interest is used as a legal basis, it has been balanced against the rights and reasonable expectations of data subjects.| Activity | Data Categories | Purpose | Legal Basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Newsletter subscription | Email address, name and organisation (optional); subscription status; consent records; unsubscribe history | Sending AENAON project updates, news, events and result highlights to subscribers | Art. 6(1)(a) GDPR — consent opt-in; withdrawable via unsubscribe link in every email | Until unsubscription, withdrawal of consent, or discontinuation of the newsletter service |
| General contact form | Name, email, organisation (where provided), content of message | Responding to general enquiries about the AENAON project (non-Open-Call enquiries) | Art. 6(1)(f) — legitimate interest in responding to enquiries about a publicly funded project | 2 years from receipt, unless follow-up correspondence is ongoing |
| General event and webinar registration | Name, organisation, email; dietary or accessibility requirements (where voluntarily provided) | Organising AENAON dissemination events, webinars, training and showcase activities | Art. 6(1)(b) — pre-event steps at the data subject’s request; Art. 6(1)(f) — legitimate interest in project dissemination | 12 months after the event; dietary/accessibility data deleted immediately after the event |
| Website technical operation and security logs | IP address, browser/user-agent, timestamps, requested resources, error/security logs | Ensuring the proper functioning, integrity and security of the Website; detecting errors, abuse, unauthorised access or security incidents. | Art. 6(1)(f) — legitimate interest in network and information security | Up to 90 days, unless extended for security-incident investigation |
| Cookie consent management | Consent ID, consent status per category, timestamp, browser/device technical identifiers | Recording and managing user cookie preferences; demonstrating compliance with consent requirements | Art. 6(1)(c) — legal obligation under Article 7(1) GDPR (proof of consent) | Up to 12 months from last consent action (CookieYes default) |
| Publication of project content | Names of authors of publications, deliverables or news items (where applicable) | Project visibility and dissemination under Article 17 of the Grant Agreement | Art. 6(1)(c) — visibility obligation under the GA; Art. 6(1)(f) — legitimate interest in reporting on a publicly funded project | Duration of the Website plus at least 5 years after final payment under the GA |
3. Cookies and Similar Technologies
The Website uses the following categories of cookies:
| Category | Description | Consent required? |
| Strictly necessary | cookieyes-consent (CookieYes — stores user’s cookie preferences, expiry ~1 year, SameSite=Strict) WordPress session cookies (set only for logged-in administrators, not for public visitors) WordPress session cookies (set only for logged-in administrators, not for public visitors) | No (Article 5(3) ePrivacy Directive exception for strictly necessary |
Users can manage or withdraw consent at any time via “Cookie Preferences” in the footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
4. Who We Share Data With
Zelus IKE, as data controller for Website processing, shares personal data only where necessary for the operation of the Website, project communications, event management, compliance with the Grant Agreement, or the handling of requests from data subjects.
| Recipient | Data shared and purpose |
|---|---|
| Papaki (Enartia S.A.) Athens, Greece | Papaki/Enartia S.A. is engaged by Zelus IKE as a processor for hosting and infrastructure services, under the applicable Data Processing Agreement. It provides hosting and related technical infrastructure services for the AENAON Website through the hosting arrangements managed by ZELUS IKE. Papaki / Enartia S.A. may process website-hosting data, server logs, IP addresses, browser/user-agent data, timestamps, requested resources, error/security logs, WordPress database records and newsletter delivery metadata in accordance with the applicable hosting, service and data protection terms. |
| The Newsletter Plugin WordPress plugin (local) | The newsletter is operated through a WordPress plugin installed on the Website. Subscriber data is stored in the WordPress database on the Papaki server in Athens, Greece. No third-party newsletter platform processes subscriber data. |
| CookieYes Limited United Kingdom | Provides cookie consent management. Processes cookie preferences, consent status, consent ID, timestamp and technical identifiers. Acts as processor under its applicable Data Processing Agreement. Transfers to the United Kingdom are covered by the EU adequacy decision under Article 45 GDPR. |
| Microsoft Ireland Operations Ltd, Ireland | May process registration, attendance and participation data where Microsoft Teams, Microsoft Teams Events or related Microsoft services are used for AENAON online events or webinars. Acts under the applicable Microsoft data protection terms. Event-specific information will be provided where relevant. |
| AENAON consortium partners | Personal data may be shared with consortium partners only where necessary for their role in project implementation, for example to respond to a request, manage participation in a project activity, organise an event, carry out dissemination obligations, carry out reporting obligations and maintain records. Access is limited to what is necessary and subject to the confidentiality and data protection obligations applicable within the consortium. |
| ECCC, European Commission, OLAF, EPPO, European Court of Auditors | Personal data may be shared where required for reporting, monitoring, checks, reviews, audits or investigations under the Grant Agreement and applicable EU rules. Legal basis: Article 6(1)(c) GDPR. |
| Greek Data Protection Authority | For the AENAON Website processing controlled by Zelus IKE, the Greek Data Protection Authority (Hellenic DPA) is the relevant lead supervisory authority, without prejudice to the data subject’s right to complain to another competent supervisory authority under Article 77 GDPR. |
| Courts, legal advisers and public authorities | Personal data may be disclosed where required by law or where necessary to establish, exercise or defend legal claims. |
We do not sell, rent or commercially exploit personal data.
We do not share personal data with third parties for their own marketing purposes.
If analytics cookies or a third-party analytics tool are introduced in the future, this Policy and the cookie banner will be updated before activation.
5. International Transfers
Personal data processed through the Website is primarily stored and processed within the European Economic Area (EEA). Specifically:
- Website hosting, newsletter database and email delivery are operated on infrastructure located in Athens, Greece (EEA), provided by Papaki/Enartia S.A. as sub-processor engaged by Zelus IKE.
- Cookie consent management is provided by CookieYes Limited, based in the United Kingdom. Transfers to the UK are covered by the EU–UK adequacy decision adopted by the European Commission under Article 45 GDPR, for as long as that decision remains in force.
Should any processor be added in the future whose processing involves transfers outside the EEA without an adequacy decision, those transfers will be governed by appropriate safeguards under Article 46 GDPR (Standard Contractual Clauses), accompanied by a Transfer Impact Assessment where required, or by a derogation under Article 49 GDPR where strictly applicable. This Policy will be updated accordingly.
6. Your Rights Under GDPR
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)) and lodging a complaint with a supervisory authority (Art. 77).
The right to erasure does not apply where processing is necessary to comply with audit obligations under the Grant Agreement or for the establishment, exercise or defence of legal claims.
To exercise any right, contact dpo@aenaon-project.eu. Response within one month, extendable by two months for complex requests under Article 12(3) GDPR.
Complaints: Greek Data Protection Authority, Leof. Kifisias 1-3, Athina 115 23, contact@apd-gba.be, +30 21 0647 5600 – https://www.dpa.gr. You may also complain to the supervisory authority of your country of residence or place of work.
7. How We Protect Your Data
We apply appropriate technical and organisational measures under Article 32 GDPR, including:
- TLS/HTTPS encryption for all web traffic;
- Access controls on a need-to-know basis for the WordPress administration interface;
- DKIM email authentication for outgoing newsletter messages;
- Regular security reviews of the Website and underlying hosting environment;
- Documented procedures for detecting, reporting and managing personal data breaches.
The AENAON Consortium Agreement (Section 10) imposes a five-year confidentiality obligation on partners after final payment under the Grant Agreement.
Personal data breaches likely to result in a risk to data subjects’ rights and freedoms are notified to the Greek Data Protection Authority within 72 hours under Article 33 GDPR, and to affected individuals where the breach is likely to result in a high risk (Article 34 GDPR).
8. Links to Other Websites
The Website contains links to external sites (ECCC, EU Funding & Tenders Portal, consortium partners’ websites, social media pages). This Policy does not apply to those sites. The EU Funding & Tenders Portal operates under its own Portal Privacy Statement: https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/support/legalnotice . ECCC processing is governed by Regulation (EU) 2018/1725.
9. Changes to This Policy
We may update this Policy. The current version date is shown at the top. Material changes will be notified to active newsletter subscribers and shown prominently on the Website. Previous versions are available on request.
10. Contact
| Coordinator | info@aenaon-project.eu |
| Data Protection Officer contact | Dpo@aenaon-project.eu |
| Open Call enquiries | Open-call@aenaon-project.eu |
| Supervisory Authority | Complaint details are provided in Section 6 above. You may also lodge a complaint online at: https://www.dataprotectionauthority.be/citizen/actions/lodge-a-complaint |
11. Legal References
- Regulation (EU) 2016/679 (GDPR);
- Greek law 4624/2019;
- Regulation (EU) 2018/1725 (applicable to ECCC and EU institutions)
- Grant Agreement No. 101249723, Article 15;
- AENAON Consortium Agreement, Section 11;
- EU–UK adequacy decision under Article 45 GDPR.