User Access Policy – EOSC Node Data Terra

#

This User Access Policy (“UAP”) explains who may use the resources and services of the Data Terra Node, and how you obtain access to them.

Federated authentication

#

• Users may access the service through supported federated identity providers, such as:
  • eduGAIN / institutional identity providers;
  • ORCID;
  • EOSC-compatible AAI services
• Some services are open and they can be used anonymously or immediately after signing in. Other services need an access request. The exact attributes received depend on the identity provider and on the requirements of the service being accessed through the Node services catalogue.
• When authentication is performed through an institutional identity provider, the service may receive the user’s name and email address and, where required, institutional affiliation or other authorised attributes.
• If a required attribute is not provided by the user’s Home Organisation, the service may ask the user to provide it directly.
• When ORCID is used as an authentication or identification provider, only the attributes required by the relevant service are retrieved from ORCID.
• The access may be restricted, suspended or withdrawn if the authorisation requirements are not longer met, for administrative, operational, or security reasons, without prior notice and without compensation, or if not compliant with the Acceptable Use Policy or the applicable policies and notices from Data Terra.

Privacy Notice – EOSC Node Data Terra

#

The EOSC Node Data Terra respects the applicable legal framework for the protection of personal data, in particular the Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable French data protection legislation.
This Privacy Policy explains how personal data are processed when users access the services of the EOSC Node Data Terra, including its federated authentication and authorisation services.

1. Service information**

#

The precise allocation of responsibilities under the GDPR may depend on the service accessed. Where another organisation acts as the data controller for a specific service, users will be informed through the privacy notice applicable to that service.

2. Personal data processed

#

Depending on the authentication method and the service accessed, the EOSC Node Data Terra may process the following categories of personal data:

• first name and surname;
• email address;
• institutional affiliation / organisation;
• country;
• professional or organisational information required for authorisation;
• persistent or pseudonymous identifiers associated with the user’s federated account;
• information concerning the authentication method used;
• account and authorisation information;
• technical information and security logs associated with access to the service.

The EOSC Node Data Terra only processes attributes that are necessary for the relevant service and its stated purposes.

3. Purposes of processing

#

Personal data may be processed for the following purposes:

• authenticating users;
• creating and managing user accounts;
• identifying users within the EOSC Node;
• determining access rights and permissions;
• providing access to authorised services and resources;
• enabling federated access across EOSC services;
• ensuring the security and integrity of the services;
• detecting and investigating security incidents or misuse;
• diagnosing and resolving technical problems;
• maintaining and improving the reliability and security of the infrastructure;
• fulfilling applicable legal or regulatory obligations.

Personal data will not be processed for purposes incompatible with those described above.

4. Legal basis

#

Depending on the processing activity and the applicable organisational framework, personal data may be processed on one or more of the following legal bases under Article 6 of the GDPR:

• performance of a contract or provision of a requested service;
• compliance with a legal obligation;
• legitimate interests, in particular the security, maintenance and proper operation of the infrastructure and services, where these interests are not overridden by the rights and freedoms of the data subject;
• consent, where consent is required and is the applicable legal basis.

The applicable legal basis may vary depending on the service and the category of processing concerned.

5. Disclosure of personal data

#

Personal data may be disclosed to or made available to:

• the Data Terra services and applications that the user has requested to access;
• authorised service providers acting on behalf of Data Terra, where applicable;
• federated identity providers and authentication infrastructures involved in the authentication process;
• other EOSC services or infrastructures, where this is necessary to provide the requested service and is covered by the applicable access and data protection arrangements;
• competent public authorities where disclosure is required by law.

User attributes are transmitted to a service only when necessary for authentication, identification or authorisation.
Data Terra does not sell personal data or use them for commercial advertising purposes.

6. International transfers

#

The EOSC Node Data Terra operates within a European and international research infrastructure environment. Where personal data are transferred outside the European Economic Area (EEA), such transfers will be carried out in accordance with Chapter V of the GDPR and appropriate safeguards will be implemented where required, such as an adequacy decision or appropriate contractual safeguards.
Information concerning a specific international transfer and the safeguards applied may be obtained by contacting the Data Terra privacy contact.

7. Data retention

#

Personal data are retained only for as long as necessary for the purposes for which they were collected, taking into account applicable legal, security and operational requirements.
The deletion of an account does not necessarily result in the immediate deletion of all technical or security logs where their retention remains necessary for security, legal or audit purposes.

8. Security

#

Data Terra implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
The EOSC Node Data Terra applies privacy and security principles by design and by default.

9. Your rights

#

You may access or rectify your personal data, or request deactivation of your account, by contacting the Helpdesk. If you have any questions regarding your personal data or your data protection rights, please contact the Helpdesk.
Please note that some personal data, such as attributes provided by your Home Organisation (e.g. your university or research institute), may be managed by that organisation. To access or rectify such data, please contact your Home Organisation’s IT helpdesk.
Where applicable, you may object to the processing of your personal data by contacting the Helpdesk.

10. Cookies and similar technologies

#

The EOSC Node Data Terra may use cookies or similar technologies that are strictly necessary for authentication, session management, security and operation of the service.
Where cookies or similar technologies are used for additional purposes requiring consent under applicable law, the relevant consent mechanism and information will be provided separately.

11. Changes to this Privacy Policy

#

This Privacy Policy may be updated to reflect changes in the services, technical infrastructure, applicable legislation or EOSC Federation requirements.
The latest version will be made available on the EOSC Node Data Terra website or on the relevant service interface.

12. Applicable data protection framework

#

The EOSC Node Data Terra is committed to applying the principles of the GDPR. The EOSC Node also takes into account the applicable EOSC Federation requirements and good practices concerning data protection, security and privacy.