Privacy Policy | RESTOR Project

This privacy policy explains how the RESTOR project consortium ("we", "us", "our"), represented by AIT Austrian Institute of Technology GmbH as the website operator, processes personal data collected through the website restor-project.eu, in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR).

1. Data controller

AIT Austrian Institute of Technology GmbH
Giefinggasse 4, 1210 Vienna, Austria
Email: info@restor-project.eu

The data controller is responsible for the processing of personal data as described in this privacy policy in accordance with Article 4(7) GDPR.

2. Personal data we collect

Automatically collected data: When you visit our website, the web server automatically records technical information including your IP address (anonymised where possible), browser type and version, operating system, referring URL, pages visited, date and time of access, and data volume transferred. This data is processed for the purpose of ensuring the secure operation of the website.

Voluntarily provided data: If you contact us via email or a contact form, we collect the personal data you provide, such as your name, email address, organisation, and the content of your message.

Cookies: This website uses only technically necessary cookies required for the proper functioning of the website. No tracking, analytics, or advertising cookies are used. In accordance with Article 5(3) of Directive 2002/58/EC (ePrivacy Directive) as amended by Directive 2009/136/EC, strictly necessary cookies do not require user consent.

3. Purpose and legal basis for processing

We process personal data for the following purposes:

Website operation and security — Legal basis: legitimate interest (Article 6(1)(f) GDPR) in maintaining a secure and functional website.
Responding to enquiries — Legal basis: consent (Article 6(1)(a) GDPR) given by you when submitting your contact details, or performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR).
Compliance with legal obligations — Legal basis: Article 6(1)(c) GDPR, where processing is necessary to comply with EU or member state law.

4. Data retention

Server log data is retained for a maximum of 30 days and then automatically deleted. Personal data submitted through contact forms is retained only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. When the data is no longer needed, it is securely deleted in accordance with Article 17 GDPR.

5. Data sharing and transfers

We do not sell, trade, or otherwise transfer your personal data to third parties. Data may be shared within the RESTOR consortium partners solely for the purposes described in this policy. All consortium partners are bound by the GDPR and the project's Data Management Plan.

Where data is transferred to consortium partners outside the European Economic Area (EEA), appropriate safeguards are in place in accordance with Chapter V of the GDPR, including Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914.

6. Third-party service providers

Contact form processing: When you submit a message through our contact form, your data (name, email address, and message content) is transmitted to Web3Forms (web3forms.com), a third-party form processing service, for the sole purpose of delivering your message to us. Web3Forms processes this data as a data processor on our behalf. No data is stored by Web3Forms beyond the time necessary to deliver the message. For more information, see the Web3Forms Privacy Policy.

7. Your rights under GDPR

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Article 15) — obtain confirmation of whether your data is being processed and access to it.
Right to rectification (Article 16) — request correction of inaccurate personal data.
Right to erasure (Article 17) — request deletion of your personal data ("right to be forgotten").
Right to restriction of processing (Article 18) — request limitation of processing under certain conditions.
Right to data portability (Article 20) — receive your data in a structured, machine-readable format.
Right to object (Article 21) — object to processing based on legitimate interests or direct marketing.
Right to withdraw consent (Article 7(3)) — withdraw consent at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint (Article 77) — file a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights, please contact us at info@restor-project.eu. We will respond within one month in accordance with Article 12(3) GDPR.

8. Data security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. These include encryption of data in transit (TLS/HTTPS), access controls, and regular security reviews. However, no method of electronic transmission or storage is 100% secure.

9. Links to third-party websites

Our website may contain links to external websites operated by third parties. We have no control over the content or privacy practices of these websites. We encourage you to review the privacy policies of any third-party website you visit. We accept no responsibility or liability for their content or practices.

10. Changes to this policy

We may update this privacy policy from time to time to reflect changes in legal requirements or our data processing practices. The latest version will always be available on this page. We encourage you to review this policy periodically.

Last updated: March 2026.

11. Contact

If you have questions about this privacy policy or wish to exercise your data protection rights, please contact:

AIT Austrian Institute of Technology GmbH
Giefinggasse 4, 1210 Vienna, Austria
Email: info@restor-project.eu