PRIVACY POLICY

Last updated: 25 March 2025

1. Introduction

This Privacy Policy explains how the VComp Lab (“Voluntary Compliance Lab”) at Bar-Ilan University collects, uses, and protects personal data obtained through this website. The VComp project is funded by the European Research Council (ERC) under the European Union's Horizon Europe research and innovation programme (Advanced Grant No. 101054656).

We are committed to safeguarding your privacy and handling your data in a transparent manner, in compliance with the EU General Data Protection Regulation (GDPR) and applicable Israeli privacy legislation.

2. Data Controller

The data controller responsible for your personal data is:

3. What Data We Collect

We may collect and process the following categories of personal data:

3.1 Information you provide

• Contact form submissions: your name, email address, institutional affiliation, and the content of your message.
• Newsletter subscriptions: your email address and, where provided, your name and institutional affiliation.

3.2 Information collected automatically

• Website usage data: pages visited, referring URLs, browser type, device type, and approximate geographic region.
• Technical data: IP address (anonymised where possible), access timestamps, and server log data.

4. How We Use Your Data

We use the personal data we collect for the following purposes:

• To respond to your enquiries submitted via the contact form.
• To send newsletters and updates about VComp research activities to subscribers.
• To improve the website's content, functionality, and user experience.
• To comply with ERC reporting requirements and Horizon Europe programme obligations.
• To ensure the security and proper operation of the website.

5. Legal Basis for Processing (GDPR)

We process your personal data on the following legal grounds under Articles 6 and 9 of the GDPR:

• Consent (Art. 6(1)(a)): when you voluntarily submit information through the contact form or subscribe to our newsletter. You may withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)): for website analytics and security monitoring, where such processing does not override your fundamental rights and freedoms.
• Legal obligation (Art. 6(1)(c)): where processing is necessary to comply with ERC grant conditions and applicable regulatory requirements.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form submissions: retained for up to 3 years following the last interaction, or for the duration of the ERC grant period, whichever is longer.
• Newsletter subscriptions: retained until you unsubscribe or request deletion.
• Website analytics data: retained for a maximum of 26 months, after which it is automatically deleted or anonymised.

7. Your Rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access: obtain confirmation as to whether personal data concerning you is being processed and request a copy of that data.
• Right to rectification: request correction of inaccurate personal data.
• Right to erasure: request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to restriction: request the restriction of processing in certain circumstances.
• Right to data portability: receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please contact us at vcomplab@gmail.com. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

8. Cookies

This website uses a minimal set of cookies strictly necessary for its operation and functionality. We do not use tracking cookies, advertising cookies, or third-party profiling cookies without your explicit consent.

Should we introduce any non-essential cookies in the future, we will seek your consent before placing them and provide full details of their purpose and duration.

9. Third-Party Services

This website relies on the following third-party services, each of which may process limited personal data in accordance with their own privacy policies:

• Supabase: database hosting for contact form submissions and newsletter subscriptions. Data may be stored in the EU or US.
• Cloudflare: content delivery, DDoS protection, and website hosting. Cloudflare may process IP addresses and request metadata for security purposes.
• Google Fonts:web fonts loaded from Google servers. Google may collect usage data as described in Google's Privacy Policy.

We take reasonable steps to ensure that any third-party processors comply with applicable data protection requirements.

10. EU-Funded Research and Data Management

As a Horizon Europe-funded project, VComp adheres to the data management requirements set out by the European Commission. Research data generated by the project is managed in accordance with our Data Management Plan (DMP) and the FAIR data principles (Findable, Accessible, Interoperable, Reusable).

Personal data collected through this website is separate from research data and is governed by this Privacy Policy. For questions about the handling of research data specifically, please contact the Principal Investigator through the contact details above.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable legislation. Any material changes will be communicated by posting the revised policy on this page with an updated “Last updated” date. We encourage you to review this page periodically.

12. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data-processing practices, please contact us at: