1. Data Controller
The data controller responsible for your personal data is:
Fondazione bioERGOtech ETS
Via Ciro Giovinazzi 70, 74123 Taranto, Italy
C.F. 90287640735
info@bioergotech.org
2. What Data We Collect
We collect the following categories of personal data depending on how you interact with our website:
Membership Applications
- Full name and job title
- Email address
- Organisation name, type, website
- Country and city
- Scientific areas of interest
- Statement of what you bring to and seek from the ecosystem
Member Portal Accounts
- Email address and encrypted password
- Full name and organisation details
- Partnership level and access permissions
- Login timestamps and session data
Schools Joining an Educational Programme
- Name of the institute, its ministerial code, town and province
- Institute email address and website, and the head teacher's name
- Referring teacher: name, surname, email, telephone and subject taught
- Number of students the institute expects to involve, by year of study, and the classes concerned
- Expected attendance at the closing event, and any notes the institute adds
- The commitments and declarations ticked when joining, recorded with their wording and timestamp
Students Enrolled in an Educational Programme
- Name, surname and contact email
- Class and year of study
- The institute the student belongs to, and the team they join
- Reflections submitted at the end of each lesson, and the project the team submits
- The declaration of being at least 14 and the acceptance of the privacy notice and of the participation rules, recorded with their wording and timestamp
Applications to Our Calls
- Contact person: name, surname, role, email and telephone
- The project or organisation described in the application, and any links to material the applicant chooses to share
- For the university call: university, degree course, level of study and areas of interest
- For the startup call: legal form, VAT number, incorporation date, country and city, and the funding and traction figures the applicant reports
- The declarations and consents given, recorded with their wording and timestamp
Participants in the University Programme
- The account created when the application is submitted, which gives access to the course and to the programme area
- Reflections submitted at the end of each lesson, and therefore how far through the course the participant has got
- The team they join, the role they hold in it, and the join requests they send or receive
- The project the team submits, and the links to material they choose to share
- Registrations for the expert talks, linked to their account
- If they choose to appear on the board of participants looking for a team: name, surname, university, degree course, discipline and the note they write. The board is visible only to confirmed participants of the programme, it is not public and it is not indexed. This consent is optional and can be withdrawn at any time, and the email address never appears there
- The scores and notes the evaluation committee records on the submitted project
Mentor Applications
- Name, surname, email and optional telephone number, which stays internal and is never published
- Role, university, institution or company, disciplines, profile, expertise and declared availability
- Any links to a personal website or a professional profile
- The outcome of the application and the teams the mentor is paired with, if any
- Consent to publish the profile on the public mentors page, which is optional and separate: one can be a mentor without appearing on the page, and the consent can be withdrawn at any time
- If the mentor provides one, a professional contact (email or contact page) for students. It is shown only to signed-in participants of the programme, from secondary schools and universities, and only after the mentor has accepted the mentor guidelines, together with the date and text of that acceptance. It never appears on the public page
Website Usage
- IP address and browser type (anonymised where possible)
- Pages visited and time spent
- Referring website or search query
- Cookie preferences
3. How We Use Your Data
| Purpose | Legal Basis |
|---|
| Processing membership applications | Legitimate interest / Pre-contractual steps |
| Providing Member Portal access | Performance of a contract |
| Sending application status updates | Legitimate interest |
| Assessing and confirming a school's participation | Legitimate interest / Pre-contractual steps |
| Enrolling students and giving them access to the course | Consent, and performance of the programme the school has joined |
| Recording course work, teams and project submissions, and assessing them | Legitimate interest in running and judging the programme |
| Registering finalists for the closing event | Legitimate interest |
| Processing applications to our calls | Consent / Pre-contractual steps |
| Creating the account that gives access to the course and the programme area | Performance of the programme the applicant asked to join |
| Showing who is looking for a team on the board, to other participants only | Consent, optional and withdrawable |
| Running teams, join requests and mentor pairing | Legitimate interest in running the programme |
| Collecting and assessing mentor applications | Consent / Pre-contractual steps |
| Publishing a mentor profile on the public page | Consent, optional and withdrawable |
| Sending platform notifications | Consent / Legitimate interest |
| Improving website performance | Consent (analytics cookies) |
| Complying with legal obligations | Legal obligation |
Where processing is based on consent, you may withdraw it at any time, and withdrawal does not affect the lawfulness of processing carried out before it.
4. Data Retention
We retain your personal data only for as long as necessary for the purposes described in this policy:
- Membership applications: Retained for 2 years from the date of submission, or until you request deletion.
- Member Portal accounts: Retained for the duration of your membership plus 1 year after account closure.
- Website analytics: Aggregated data retained for up to 26 months.
- Email communications: Retained for up to 3 years for record-keeping purposes.
- Records of schools joining a programme: A fixed period is being defined. Until it is set, the data is kept only for as long as the purposes described above require, and is deleted on request.
- Student enrolment records: A fixed period is being defined. Until it is set, the data is kept only for as long as the purposes described above require, and is deleted on request.
- Course work, teams and project submissions: A fixed period is being defined. Until it is set, the data is kept only for as long as the purposes described above require, and is deleted on request.
- Applications to our calls: A fixed period is being defined. Until it is set, the data is kept only for as long as the purposes described above require, and is deleted on request.
5. Data Sharing
We do not sell your personal data. We share data only with trusted service providers who process it on our behalf:
- Supabase (Supabase Pte. Ltd.). Database and authentication hosting
- Vercel Inc. Website hosting and deployment
- Resend. Delivery of the transactional emails described in this policy
- Google Ireland Ltd and Google LLC. Google Analytics and Google Ads, only with your cookie consent (see the Cookie Policy); maps and productivity tools (Google for Nonprofits)
All third-party processors are bound by Data Processing Agreements and are required to process data only as instructed by us. The members of the assessment panel for our calls and programmes see the submitted projects in order to score them, and are bound to confidentiality. Students' names are not disclosed to them.
6. International Transfers
Some of our service providers are based outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place: the EU-US Data Privacy Framework for certified providers, or the Standard Contractual Clauses approved by the European Commission included in our providers' data processing agreements.
7. Your Rights
Under GDPR and Italian data protection law, you have the following rights:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete data.
Right to Erasure
Request deletion of your personal data ('right to be forgotten').
Right to Restriction
Request that we limit how we use your data.
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests.
Right to Withdraw Consent
Withdraw consent at any time where processing is consent-based.
Right to Complain
Lodge a complaint with the Italian Data Protection Authority (Garante).
To exercise any of these rights, contact us at info@bioergotech.org. We will respond within 30 days.
8. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS), password hashing, and role-based access controls within the Member Portal and the programme consoles.
9. Minors
Our website and services are not directed at children under the age of 14, and we do not knowingly collect their personal data. If you believe a child under 14 has provided us with personal data, please contact us and we will delete it promptly.
Some of our educational programmes are addressed to secondary school students, who may be minors aged 14 or over. Students aged 14 or over enrol and consent themselves, as Italian law allows for online services (Art. 2-quinquies of the Italian Data Protection Code); their school appoints a referring teacher who confirms the enrolment, and does not collect consents on our behalf. In those cases we process only what the programme needs: the school code, name, surname, class, year of study and contact email. We do not collect dates of birth, tax codes, identity documents or parents' contact details. Before a student appears in photographs or recordings of our events, a separate choice is always requested on a form kept by the school and signed by a parent for students under 18. Full details are in the programme's own privacy notices for students and for schools. Parents and guardians may exercise the rights described above on behalf of their child by writing to the address at the end of this policy.
Taking part in the programme also means following an online course, which requires an account. Alongside the data listed above we therefore keep the work the student submits during the course: the reflection that closes each lesson, the team they belong to and the project the team submits. The teachers of the school who follow the programme see how far their own students have got and read the reflections and questions they submit in the lessons, so that the school can follow them. The assessment panel sees the projects without the names of the students who wrote them.
10. Updates to This Policy
We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. We will notify registered members of any significant changes by email.
11. Supervisory Authority
You have the right to lodge a complaint with the Italian Data Protection Authority:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma, Italy
www.garanteprivacy.it