Last updated: 14 May 2026
In short
Life Mapper is a public-interest project co-funded by the European Union (LIFE Programme, grant agreement 101213793). We process the minimum amount of personal data needed to run the website and the Knowledge Platform, we never sell it, and you can opt out of every non-essential activity from .
This notice is provided under articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").
Who is responsible
Data controller
Consiglio Nazionale delle Ricerche — Istituto di Scienze Marine (CNR-ISMAR)
Piazzale Aldo Moro 7, 00185 Roma, Italy
Project coordinator: TBC federica.foglini@bo.ismar.cnr.it
Project mailbox: lifemapper@ismar.cnr.it
Data Protection Officer (DPO)
CNR's institutional DPO is reachable at:
TBC responsabileprotezionedati@cnr.it
Data processor (technical operator)
Space42 Europe
Consortium partner responsible for designing, building, and operating the website and the Knowledge Platform on behalf of CNR-ISMAR (Grant Agreement Work Package 7).
Contact: lifemapper@ismar.cnr.it
What we process
We try to keep this list short. If a category is not mentioned here, we are not processing it.
1. Technical data (server logs)
When you visit the site, our hosting provider records standard HTTP request data: IP address, user agent, requested URL, response code, timestamp, referrer. This is needed to operate the service and to detect abuse.
Lawful basis: legitimate interest (GDPR Art. 6(1)(f)) in providing a reliable and secure service.
Retention: TBC up to 30 days, then deleted or anonymised.
2. Cookie preferences
Your own choice in the cookie banner is stored locally in your browser (under the key klaro) so the banner does not reappear at every page.
Lawful basis: legitimate interest in honouring your consent choice; the cookie itself is "strictly necessary" under ePrivacy Art. 5(3) and does not need separate consent.
Retention: 180 days, or until you clear it from your browser.
3. Analytics — only with your consent
We plan to use Plausible Analytics, a privacy-friendly, cookieless tool that produces aggregated visit counts without identifying individual users. The analytics toggle is already in the cookie banner so we have a record of your preference if and when the service is enabled.
Lawful basis: consent (GDPR Art. 6(1)(a)). You can withdraw it at any time from your cookie preferences.
Retention: aggregated metrics only; no personal identifiers are stored.
4. Embedded video (YouTube) — only with your consent
The tutorial videos on the Knowledge Platform are hosted on YouTube. The embedded player loads only after you opt in to "Embedded media" in the cookie banner. Before that, you see a small placeholder.
Lawful basis: consent (GDPR Art. 6(1)(a)).
Once accepted, YouTube becomes an independent controller of any data it collects. See Google's privacy policy for details.
5. Email correspondence
If you write to us at lifemapper@ismar.cnr.it or any of the contact addresses listed on the Contacts page, we receive your email address and whatever content you choose to include.
Lawful basis: consent and/or legitimate interest in responding to your enquiry (GDPR Art. 6(1)(a) and (f)).
Retention: as per CNR-ISMAR's institutional records-management policy.
6. Newsletter subscription Planned
We are preparing an opt-in newsletter for project updates (new resources, events, calls, scientific outputs). It is not yet active: today the "Subscribe" button only invites you to email us so we can notify you at launch. When the newsletter goes live we will collect your email address and the date of subscription, and nothing else.
Lawful basis: explicit consent (GDPR Art. 6(1)(a)), given by an unticked opt-in. No content is gated behind subscription — it is purely a way to stay informed.
Retention: until you unsubscribe (one-click link in every issue) or ask us to remove you, after which your address is deleted within 30 days.
Recipients: the email-delivery provider has not yet been selected. This section will be updated with the processor's name and safeguards before the newsletter is switched on.
The Knowledge Platform itself is read-only. There is no user registration, no login form, and no user-generated content — reading, searching and downloading never require an account. The only personal data we actively collect from visitors is what you choose to send us by email or, in future, the address you give us for the newsletter. Any change to this will be reflected here before the feature goes live.
Who we share data with
We share data only with third parties that are strictly necessary to deliver the service. Each of them is bound either by a data-processing agreement or by an adequacy decision under GDPR Chapter V.
- Hostinger International Ltd (EU, Lithuania) — hosting provider for the website and the Knowledge Platform. Processes server logs on our behalf. Acts as a data processor.
- Google LLC (YouTube) — only when you opt in to embedded media. Acts as an independent controller.
- Google LLC (Google Fonts) — the site loads the Open Sans typeface from
fonts.googleapis.com. When the font is fetched, your IP address is transmitted to Google's CDN. We are reviewing this dependency and may move to self-hosted fonts to remove this transfer.
Aside from these, your data is not shared with advertisers, marketers, brokers, or any other third parties.
International transfers
Our hosting infrastructure is located in the European Economic Area. When you opt in to YouTube embeds or when Google Fonts is loaded, some data may be transferred to the United States. These transfers are covered by the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023).
Your rights
Under articles 15–22 of the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase data ("right to be forgotten") when applicable;
- restrict processing in certain circumstances;
- data portability in a structured, machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, write to lifemapper@ismar.cnr.it or to the DPO above. We will reply within one month, as required by GDPR Art. 12.
Right to lodge a complaint
If you believe your data has been processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it), or with the supervisory authority of your EU member state of residence.
Security
We use TLS encryption for all traffic (HTTPS), keep our hosting stack up to date, and limit administrative access on a need-to-know basis. Despite our best efforts, no system can guarantee absolute security — if you become aware of a vulnerability, please contact us.
Changes to this policy
We may update this policy when our processing changes (new tools, new features, new partners). The "Last updated" date at the top of the page always reflects the most recent revision. Substantial changes will be announced on the News & Events page.
Legal references
- Regulation (EU) 2016/679 (GDPR) — articles 6, 12–22.
- Directive 2002/58/EC (ePrivacy) — article 5(3).
- Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
- Life Mapper D7.1 Communication Plan §6.1.2 (data protection & visibility).