Privacy policy

This Privacy Policy explains how personal data may be collected, used and protected through the website seras-railskills-alliance.eu.

The website is operated as part of the SERAS project communication and dissemination activities. Personal data collected and processed through this website is handled in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and other applicable data protection rules.

This Privacy Policy provides information in accordance with Articles 13 and 14 of the GDPR, where personal data is collected directly from the data subject or obtained from other sources.

This policy was last updated: August 2026.

The Controller

The controller of the processing operation is:

UNIVERSITA DEGLI STUDI DI GENOVA - (UNIGE)
Via Balbi, 5
16126 Genova GE
Italy

UNIGE, as coordinator of the SERAS project, oversees the SERAS website as part of the project’s communication and dissemination activities.

Editorial and technical roles

wmp consult supports the editorial coordination and day-to-day management of the content published on seras-railskills-alliance.eu.

wmp consult
Schaarsteinwegsbrücke 2
20459 Hamburg
Germany

WAAT Poland Sp. z o.o. - (WAAT) manages the domain name, hosting and technical infrastructure as part of the project’s hosting and maintenance contract.

WAAT Poland Sp. z o.o. - (WAAT)
Telewizyjna 48
01-492 Warszawa
Poland

WAAT is not responsible for the editorial content published on the website.

Data protection contact

Data subjects may contact the controller with any questions or requests concerning the processing of their personal data.

Data protection contact:
contact@seras-alliance.eu

For technical enquiries relating to this website, please contact:
contact@waat.eu

Categories of personal data processed

Depending on how you use the website, the following categories of personal data may be processed:

identification and contact data, such as name, organisation, job title, email address and telephone number;
information submitted through website forms, surveys, newsletter subscription forms, event registration forms or contact forms;
communication data, such as messages, requests, feedback or correspondence sent through the website;
technical data, such as IP address, browser type, device information, operating system, date and time of access, pages visited and similar server log information;
consent preferences, including cookie consent choices where a cookie consent tool is used;
event participation data, where registration or attendance information is collected for SERAS-related activities.

The website does not intentionally collect special categories of personal data unless this is explicitly requested for a specific and lawful purpose.

Purposes of processing personal data

Personal data may be processed for the following purposes:

to operate, maintain and secure the SERAS website
to respond to questions, comments or requests submitted through the website
to manage newsletter subscriptions and send SERAS project updates, where applicable
to provide information about SERAS activities, outputs, events and related dissemination activities
to manage event registrations, participation and follow-up communications, where applicable
to collect feedback through forms, surveys or consultation activities, where applicable
to analyse and improve the website, where analytics tools are used in accordance with applicable rules
to comply with legal, contractual, reporting, audit or project-related obligations

Legal basis for processing

The legal basis for processing personal data may include one or more of the following:

consent, where you have agreed to receive newsletters, event communications, use of non-essential cookies, or other specific communications
performance of a task carried out in the public interest or in connection with the SERAS project’s communication and dissemination activities
legitimate interests, where processing is necessary for the operation, security, maintenance, improvement and administration of the website, provided that such interests are not overridden by your rights and freedoms
compliance with legal obligations, including record-keeping, audit, reporting or regulatory requirements
performance of a contract or steps prior to entering into a contract, where relevant for specific project-related interactions

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Who may access your data?

Access to personal data is limited to organisations and individuals who need access for the purposes described in this Privacy Policy.

This may include:

UNIGE, as coordinator of the SERAS project;
wmp consult, for editorial coordination and content management purposes;
WAAT, for hosting, maintenance, technical administration and website support purposes;
SERAS project partners, where access is necessary for project implementation, communication, dissemination, reporting or event management;
service providers acting on behalf of the controller, such as hosting providers, mailing tools, analytics providers, event management tools or IT support providers;
competent authorities, auditors or funders, where disclosure is required by law, contract, project rules or audit obligations.

Personal data is only shared where necessary and on a need-to-know basis.

International transfers

Personal data is primarily processed within the European Union or the European Economic Area.

Where personal data is transferred outside the EU or EEA, appropriate safeguards will be applied in accordance with the GDPR, such as an adequacy decision, standard contractual clauses, or another lawful transfer mechanism.

How long do we keep your data?

Personal data is retained only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law, contract, audit rules, reporting obligations or project documentation requirements.

As a general principle:

contact requests are kept for the time needed to respond and manage any follow-up;
newsletter subscription data is kept until you unsubscribe or withdraw your consent;
event registration data is kept for the time needed to organise the event, manage follow-up and comply with project reporting or audit requirements;
technical logs are kept for a limited period necessary for website security, troubleshooting and maintenance;
records required for contractual, financial, audit or project reporting purposes may be kept for longer where required by applicable rules.

Data will be deleted, anonymised or archived when it is no longer needed.

Sources of personal data

Personal data may be collected directly from you when you:

fill in a contact form
subscribe to a newsletter
register for an event
complete a survey or consultation form
send a message or request
interact with the website

Personal data may also be obtained from other legitimate sources, such as:

SERAS project partners
participant lists from SERAS or related project events
professional contact details made publicly available
prior correspondence or project-related communications
public sources relevant to SERAS communication and dissemination activities

Cookies and similar technologies

The website may use cookies and similar technologies to make the website work, remember preferences, manage consent choices, improve performance, or understand how the website is used.

Strictly necessary cookies may be used without consent where they are required for the operation of the website. Non-essential cookies, such as analytics or third-party cookies, are used only where permitted by applicable law and, where required, after consent has been given.

Further information is available in the website’s Cookie Policy.

Your rights

Under the GDPR, you may have the following rights in relation to your personal data:

Right of access

You have the right to request confirmation as to whether your personal data is being processed and, where applicable, to receive access to that data and information about how it is processed.

Right to rectification

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to erasure

You have the right to request the deletion of your personal data where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent and there is no other legal basis for processing, where you object to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed.

Right to restriction of processing

You have the right to request restriction of processing in certain circumstances, for example where you contest the accuracy of the data or object to the processing.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

Right to object

You have the right to object to processing based on legitimate interests or public interest grounds, where applicable. You also have the right to object to processing for direct marketing purposes.

Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time.

Right not to be subject to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects concerning you or similarly significantly affects you. The SERAS website does not intend to carry out such automated decision-making.

How to exercise your rights

Any requests relating to your personal data should be sent to:

contact@seras-alliance.eu

You may be asked to provide information necessary to verify your identity and process your request.

The controller will respond to your request within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months. In that case, you will be informed of the extension and the reasons for it.

Security of personal data

Appropriate technical and organisational measures are used to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Where third-party service providers process personal data on behalf of the controller, they are expected to apply appropriate security and confidentiality measures.

What happens if you do not provide your personal data?

You are not required to provide personal data simply to browse the public pages of the website.

However, if you choose not to provide personal data requested through specific forms or services, it may not be possible to:

respond to your question, request or message
send you SERAS project updates or newsletters
register you for an event
manage your participation in a SERAS activity
provide access to certain optional features or communications

Complaints and right to recourse

If you believe that your personal data has not been processed in accordance with the GDPR, you may contact the controller using the contact details above.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

You may also contact the data protection authority in your country of residence, place of work or place of the alleged infringement.

Updates to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in the website, project activities, processing operations or applicable legal requirements. The latest version will be made available on this page.