1. Data Controller
For the purposes of applicable data protection legislation, including the General Data Protection Regulation (GDPR), the Data Controller is:

Council of Europe - https://www.coe.int

The Controller determines the purposes and means of the processing of personal data in connection with this platform.

2. Data Processor
The platform is developed and technically operated by:
youngminds - acting as a Data Processor on behalf of the Controller.

The Processor processes personal data strictly in accordance with the documented instructions of the Controller and under a contractual arrangement compliant with Article 28 GDPR.

3. Scope of the Platform
The system consists of:

a presentation website
a web-based application enabling users to access and complete governance-related surveys.

Access to the application is granted via email-based authentication. Authenticated users may access surveys previously completed or participated in and/or initiate new survey submissions.

4. Categories of Personal Data
The processing activities involve the following categories of personal data:

4.1 Identification Data
Email address (used for authentication and account management)

4.2 Optional Data
Email address provided for the purpose of receiving survey results (where different or explicitly submitted)

4.3 Technical and Usage Data
IP address
browser type and version
device information
usage patterns and interactions within the platform

Such data may be collected through the use of Google Analytics.

5. Nature of Survey Data
The survey consists of 28 questions concerning multi-level governance frameworks at country level. Responses are based on publicly available information. The survey does not require or solicit personal data. No special categories of personal data (as defined under Article 9 GDPR) are processed.

6. Purposes of Processing
Personal data is processed for the following purposes:

authentication and user account management
enabling access to historical survey data
administration and operation of the survey platform
communication of survey results (upon user request)
monitoring, analysis, and improvement of platform performance and user experience
ensuring system security and integrity

7. Legal Basis for Processing
Processing is carried out on the following legal grounds:

Article 6(1)(a) GDPR – Consent
(for sending survey results via email)

Article 6(1)(f) GDPR – Legitimate Interests
(for platform operation, security, and analytics)

The legitimate interests pursued include ensuring the proper functioning, security, and continuous improvement of the platform.

8. Data Storage and Transfers
Personal data is stored on secure servers located in Romania (European Union)
No transfers of personal data outside the European Economic Area (EEA) are intended
Where third-party services are used, appropriate safeguards are implemented in accordance with GDPR requirements.

9. Data Retention
Personal data shall be retained only for as long as necessary for the purposes set out above:

account-related data: retained for the duration of user access
analytics data: retained in accordance with configured retention periods of Google Analytics

Data may be retained longer where required by applicable legal obligations.

10. Recipients and Third Parties
Personal data may be processed by:

the Data Processor (technical service provider)
authorized personnel of the Controller
Google Analytics (for statistical and analytical purposes)
All third-party processing is subject to appropriate contractual and technical safeguards.

11. Data Security
Appropriate technical and organizational measures are implemented to ensure a level of security appropriate to the risk, including:

access control mechanisms
secure authentication procedures
data minimization principles
protection against unauthorized or unlawful processing, accidental loss, destruction, or damage

12. Data Subject Rights
Data subjects have the following rights under the GDPR:

right of access (Article 15)
right to rectification (Article 16)
right to erasure (“right to be forgotten”) (Article 17)
right to restriction of processing (Article 18)
right to data portability (Article 20)
right to object (Article 21)

Where processing is based on consent, data subjects have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

13. Cookies
The platform uses cookies and similar technologies for:

session management (authentication)
analytics and performance monitoring via Google Analytics

Users may manage cookie preferences through their browser settings.

14. Contact Details
For any inquiries regarding this Privacy Policy or the processing of personal data, please contact:

Council of Europe - https://www.coe.int
(Optionally: Data Protection Officer contact details can be included here.)

15. Amendments
This Privacy Policy may be updated from time to time to reflect changes in legal, technical, or operational requirements. The updated version will be made available on this page.