Privacy & Cookies Policy v2.1

Last Updated: 22 April 2026

Your Digital Twin is Safe!

CC BY 4.0

This privacy statement provides information about the processing and the protection of your personal data.

Processing operation: 3DxVERSE websites and e-services.

Joint Data Controllers: 3DxVERSE Consortium members,

iLabs Technologies B.V. (iLabs), Albardastraat 34, 7611BE, AADORP, The Netherlands
Ertico, Avenue Louise 523, 1050 Brussels, Belgium
sustainably.io, François de Veyestraat 8, 6221 AB Maastricht, Netherlands

(hereafter referred to as ‘3DxVERSE’):

Data Processors:

Adecs Airinfra, Castellum – Gebouw A, Loire 196, 2491 AM Den Haag, The Netherlands
Almelo Energie, Albaradastraat 34, 7611BX Aadorp, The Netherlands
iLabs Technologies B.V., Albardastraat 34, 7611BE, AADORP, The Netherlands
Ertico, Avenue Louise 523, 1050 Brussels, Belgium
FHC Corp N.V., Topaz 21, Noord, Aruba
ITS mobility e.V., Hermann-Blenk-Str. 22a, 38108 Braunschweig, Germany
sustainably.io, François de Veyestraat 8, 6221 AB Maastricht, Netherlands
UZE ADS Europe GmbH, Hanna-Kunath-Str. 31, 28199, Bremen, Germany
CONTINENTAL AUTOMOTIVE ROMANIA SRL, STRADA SIEMENS 1, Timisoara,300704, Romania
MUNICIPIUL TIMISOARA, BOULEVARD CONSTANTIN LOGA DIACONOVICI 1, TIMISOARA 300030, Romania,

With the following sub-processors:

ESRI, Weena 695 (B2 – 036), 3013AM Rotterdam, Netherlands
Cesium Inc., 400 Market Street, Suite 1100, Philadelphia, PA 19106, USA

Record reference: 3DxVERSE_Privacy_v2.1

1. Introduction

3DxVERSE is committed to protecting your personal data and to respect your privacy. 3DxVERSE collects and further processes personal data.

This privacy statement explains which data is collected, the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controllers with whom you may exercise your rights and the Data Protection Officer.

The information in relation to the processing operation “3DxVERSE websites and e-services” is undertaken by 3DxVERSE, a project which is co-funded by the European Union’s Digital Europe Programme (DIGITAL) under grant agreement No. 101168258. iLabs and Ertico act as Joint Data Controllers.

2. Why and how do we process your personal data?

Most of 3DxVERSE websites and e-services are accessible without giving any personal information. Personal data is required in the following cases which this record aims to cover.

A. Personal data published on the 3DxVERSE websites Personal data in relation to a specific activity or event, or to communicate on achievements or contributions to 3DxVERSE activities and publications.

B. To provide specific e-services on the 3DxVERSE websites

An e-service on the 3DxVERSE websites is a service or resource made available on the Internet to improve the communication among citizens, businesses, academia and local, national and EU public institutions.

Three types of e-services are, or will be, offered:

Information services that provide people, media, businesses, administrations and others with secure access to information.
Interactive communication services (communications to users, distribution of reports, information sharing within interest groups etc.) that allow better contact with people, businesses, civil society and public bodies, to facilitate policy design, development, consultations and feedback.
Interactive and immersive experiences in the 3DxVERSE Interoperable Digital Twin Testbed enabling people, media, businesses, administrations and others to participate in pilots, events and other activities in the virtual environment

C. To evaluate pilots and performance against defined programme metrics, e.g., inclusion or diversity. 3DxVERSE operates Open Research Data Pilots under the DIGITAL-2023-CLOUD-AI programme. As such, we are committed to promoting open science by making research data as accessible and reusable as possible, in accordance with the principle of “as open as possible, as closed as necessary.” This means that while we strive to share research findings and data openly, we also uphold strict privacy and data protection standards.

Your personal data will not be used for an automated decision-making including profiling.

3. On what legal ground(s) do we process your personal data

We process your personal data because you have given your consent to the processing of your personal data for one or more specific purposes, in accordance with Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR). Registration of data subjects to access the e-services is purely on a voluntary basis.

We do not process special categories of personal data, therefore Article 9 of Regulation (EU) 2016/679 (GDPR) does not apply.

4. Which personal data do we collect and further process?

The type of personal information we collect depends on how you are specifically interacting with us and which services you are using. Generally, we collect the following categories of personal information:

Personal data collected for subscription to a mailing list, or participation in a 3DxVERSE activity such as the Digital Commons, or in a Pilot Project

To enable you to participate in the 3DxVERSE activities, including the Digital Commons or Pilot Projects, and for 3DxVERSE to carry out its research activities and to publish metrics (for example related to accessibility and inclusion), we may collect the following data:

Contact Information: first name and/or last name, email address and/or phone number.
Your past, home, work or current location
Your age group

B. Users of 3DxVERSE e-services

To provide you with access to the e-services, 3DxVERSE collects the following personal data, either through a dedicated on-line registration form or email communication

Contact Information: first name and/or last name, alias, email address and/or phone number.
Demographic information: preferred language, default language, age group
- Your device: Internet Protocol (IP) address (anonymised where possible).
- Browser type and version
- Device type and model
- Operating system and version
- Referring website or source link used to access the service

C. Additional information

A username and password could also be set up at the first registration.

The e-service may collect the following additional data about each user:

Date and time of
- Most recent successful and unsuccessful authentication.
- Last change of password.
- Last password reset.
Number of good logins and failed attempts.
Account status (whether active, inactive etc.)
Recent passwords – to make sure you follow the prevailing security policy regarding password re-use.
Security data/log files.
Other than Strictly Necessary Cookies (i.e., those cookies essential for you to browse the website and use its features), where a cookie statement will be provided. All other cookies will be opt-in.

5. How long do we keep your personal data?

A. Personal data collected for subscription to a mailing list, or participation in a 3DxVERSE activity such as the Digital Commons, or in a Pilot Project

Your personal data is kept for a maximum of 4 years, starting from the date you submit your consent, via email or specific authorisation form, to process your personal data. For retention after that period, a renewed declaration of consent from you (the Data Subject) is required.

B. Users of 3DxVERSE e-services

Your personal data is kept for as long as is necessary to meet the purposes for which they were collected, and this will be declared on the e-service registration form. We will delete your personal information if it is no longer needed, and in any case at the latest after two years of continuous inactivity or upon email request to the Data Protection Officer.

Additional data collected that are related to your interaction with a 3DxVERSE e-service include:

Security data/Log files, Internet Protocol (IP) address, date and time of authentication, change/reset of password or account status: Stored for a maximum of 1 year. In the context of investigations related to security incidents, Registered users have password-protected direct online access to their profile and can update their information, cancel their registration or request to unsubscribe from specific e-services or mailing lists.

Time limits of the retention of data related to specific e-services will be specified in the terms and conditions.

Anonymised data will be made available for scientific research purposes under Open Research Data under the DIGITAL-2023-CLOUD-AI.

6. How do we protect and safeguard your personal data?

All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored either on the servers of 3DxVERSE or of its sub-contractors. All processing operations are carried out in accordance with the requirements of Regulation (EU) 2016/679 (GDPR) and our Information Security Policy, which is aligned with ISO/IEC 27001.

3DxVERSE sub-contractors are bound by a specific contractual clause for any processing operations of your data on behalf of 3DxVERSE and by the confidentiality obligations deriving from the transposition of the General Data Protection Regulation in the EU Member States (‘GDPR’ Regulation (EU) 2016/679).

To protect your personal data, 3DxVERSE has put in place several technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

7. Who has access to your personal data and to whom is it disclosed?

A. Personal data collected for subscription to a mailing list, or participation in a 3DxVERSE activity such as the Digital Commons, or in a Pilot Project

Your personal data can only be accessed by authorised persons from 3DxVERSE or their contractors.

B. 3DxVERSE e-services

Your personal data can only be accessed by authorised persons from 3DxVERSE or their contractors.

The e-service system administrators have access to all data categories. This includes 3DxVERSE staff responsible for carrying out this processing operation and authorised staff according to the “need to know” principle. Such staff abide by statutory, and when required, additional confidentiality agreements.
In case of a security incident, security data/log files, IP address may be shared with 3DxVERSE or its contractors who are responsible for the security of information systems.
The following data categories will be accessible to system administrators:
- Contact Information: first name and/or last name, alias, email address and/or ‘phone number.
- Demographic information: preferred language, default language, age group
- Your device: Internet Protocol (IP) address.
- No personal data categories will be made available to other external or internal users.

Personal data may be communicated to external contractors assisting 3DxVERSE in fulfilling the objective for which the data is managed. 3DxVERSE’s contractors are bound by a specific contractual clause for any processing operations of personal data on behalf of the Commission, and by the confidentiality obligations deriving from the transposition of the General Data Protection Regulation in the EU Member States (‘GDPR’).

The information we collect will not be given to any third party, except to the extent and for the purpose we may be required to do so by law.

8. What are your rights and how can you exercise them?

You have specific rights as a ‘data subject’ under Chapter III (Articles 15–22) of Regulation (EU) 2016/679 (GDPR), including the right to access, rectify or erase your personal data and the right to restrict the processing of your personal data. Where applicable, you also have the right to object to the processing or the right to data portability.

You have consented to provide your personal data to 3DxVERSE for the present processing operation. You can withdraw your consent at any time by notifying either of the Data Controllers. The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent.

You can exercise your rights by contacting the Data Processors/Data Controller, or in case of conflict the Data Protection Officer.

9. Contact information

The Data Processor and Data Controller

If you would like to exercise your rights under Regulation (EU) 2016/679 (GDPR), or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Protection Officer (DPO).

You may contact the Data Protection Officer at: data-protection-officer@3dxverse.eu

about issues related to the processing of your personal data under Regulation (EU) 2016/679 (GDPR).