Last updated 8 October 2026.
This policy explains how personal data is handled when you visit digicap.eu, the public website of the DIGICAP project. It is written to comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and the Spanish Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights (LOPDGDD).
In short: this site runs no analytics, no advertising and no third-party tracking. The only cookie it sets is a strictly necessary session cookie used to protect its forms. We only hold personal data that you deliberately send us through the Stakeholder Panel registration form, the contact form or the mailing-list sign-up.
Who is responsible for your data
The data controller for this website is Matical Innovation SL (“MATICAL”), acting on behalf of the DIGICAP consortium as part of its stakeholder-engagement remit. The consortium is coordinated by TEAM-NB aisbl (Belgium); MATICAL is the partner operating the public website.
- Controller: Matical Innovation SL, on behalf of the DIGICAP consortium.
- Registered address: Avenida de Manoteras 24, 2nd floor, 28050 Madrid, Spain.
- Tax identifier (CIF/VAT): B45861895.
- Contact for data protection matters: info@digicap.eu, or through our contact form.
What data we collect and why
We keep data collection to the minimum needed to run the site and listen to our stakeholders. There are exactly four sources of personal data.
1. Stakeholder Panel registration form
When you register your interest in the DIGICAP Stakeholder Panel we process the name, email address, organisation, role or position, country, stakeholder group and motivation you provide.
- Purpose: managing participation in the DIGICAP Stakeholder Panel — assessing expressions of interest, contacting you about panel activities, and reporting anonymous, aggregated participation figures to the project.
- Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the consent box on the form.
- Retention: for the duration of the DIGICAP project, after which the records are deleted.
2. Contact form
When you write to us through the contact form we process the name, email address, organisation (optional), subject and message you provide.
- Purpose: reading and answering your enquiry.
- Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the consent box on the form.
- Retention: up to 24 months after our last exchange, then deleted unless a longer period is required to honour a legal obligation.
3. Mailing list (“Stay updated”)
When you join our mailing list through the “Stay updated” button we process the email address you provide, the date you subscribed and confirmed, and the page you subscribed from. We first send one email with a confirmation link: you join the list only when you click it.
- Purpose: sending you DIGICAP news, newsletters and announcements. Your address is not used for anything else and is never shared outside the DIGICAP project team.
- Legal basis: your consent (Art. 6(1)(a) GDPR), given by submitting your address and confirming it through the link we email you.
- Unsubscribing: at any time, by replying to any of our emails or writing to contact@digicap.eu. We then delete your address from the list.
- Retention: until you unsubscribe, and at the latest until the end of the DIGICAP project. An address that is never confirmed is deleted after 7 days.
4. Hosting server logs
Our hosting provider records standard technical information (IP address, timestamp, requested URL, user agent, response code) on every request.
- Purpose: keeping the service running, diagnosing faults and detecting abuse. These logs are never used for analytics or marketing.
- Legal basis: our legitimate interest in the security and integrity of the website (Art. 6(1)(f) GDPR).
- Retention: up to 12 months, then overwritten.
When a form is submitted, a notification containing the submitted data is emailed to the DIGICAP project team so that a person can act on it. Form submissions are also stored on the website's own server, in a directory that is not reachable from the public internet.
Cookies
A “cookie” is a small text file that a website stores in your browser. EU rules (the ePrivacy Directive together with the GDPR, and Art. 22.2 LSSI in Spain) require consent before setting any cookie that is not strictly necessary to deliver the service you asked for.
This site sets one cookie, and it is strictly necessary.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
digicap_sid |
Strictly necessary (first-party PHP session cookie) | Keeps the security token that protects our forms against cross-site request forgery (CSRF), so that a submission can be recognised as coming from the page you actually filled in. | Session — it expires when you close your browser. |
Because this cookie is strictly necessary for the security of a service you have explicitly requested, it is exempt from the consent requirement. That is why you do not see a cookie consent banner on this site.
What this site does not do:
- No third-party analytics. We do not run Google Analytics, Matomo, Plausible or any comparable service. Our audience statistics are described in the next section and never leave our server.
- No advertising and no profiling. We sell nothing, run no ads and build no visitor profiles.
- No third-party embeds. Fonts, images and the EU emblem are served from our own domain; there are no YouTube, X or LinkedIn widgets.
- No cross-site tracking cookies of any kind.
You can clear, block or audit cookies from any site through your browser settings. Blocking the digicap_sid cookie will not stop you from reading the site, but the forms will refuse submissions because their security check can no longer be completed.
If we ever add a feature that needs a non-essential cookie, we will update this page and deploy a proper consent mechanism before that cookie is set.
Audience statistics
DIGICAP is a publicly funded project, and we have to be able to report how far its results travel. To do that we keep a simple count of how the site is used. It runs entirely on our own server and involves no third party, no cookie and no advertising technology.
For each page view we record the date and time, the page address, the country the request came from, whether the visitor used a phone, tablet or computer, and — if you arrived by following a link — the website you came from. We also measure how long the page was open and how far down it was scrolled, and, for the explainer video on the homepage, whether it was played and how much of it was watched.
We take deliberate steps so that this cannot become a record of you:
- Your IP address is never stored. It is used to look up a country, in a database held on our own server, and is then discarded. No request is ever made to an external geolocation service.
- Visits are counted without an identifier. To avoid counting the same person twice in one day we compute a one-way hash of the IP address and browser, combined with a secret value that is replaced every night and never kept. The result cannot be turned back into an IP address, and yesterday's hash cannot be matched to today's. Nobody — including us — can follow a visitor from one day to the next.
- No cookie and no browser storage are used for statistics.
- Only the name of a referring website is kept, never the full address it was linked from.
These statistics are aggregate and first-party: they tell us that a page was read a certain number of times from a certain country, and nothing about who read it. Under the GDPR we rely on our legitimate interest (Article 6(1)(f)) in understanding whether a publicly funded project is reaching its audience, and we consider the measurement exempt from the consent requirement because it is strictly limited to producing our own anonymous audience figures, sets no cookie, and is never used to track anyone across sites. If that assessment ever changes, we will ask for consent before continuing.
Individual records are kept for no longer than four years and are then deleted automatically; only aggregate figures are used in project reporting. The two pages of legal information on this site are not measured at all.
Who processes your data on our behalf
We rely on a single sub-processor:
- Hostinger — hosting of the website, its email notifications and its stored form submissions, on servers located inside the European Union.
We do not transfer personal data outside the European Union or the European Economic Area. We do not sell personal data, and we never share it for marketing purposes.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data rectified;
- have your data erased where the law allows;
- restrict or object to certain processing activities;
- receive your data in a portable format;
- withdraw any consent you have given, at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, write to info@digicap.eu or use our contact form. If you believe your rights have been breached, you may also lodge a complaint with the Spanish Data Protection Agency — Agencia Española de Protección de Datos (AEPD) — or with the supervisory authority of your country of residence.
Changes to this policy
We may update this policy to reflect changes in the website, in the tools we use or in the law. The “last updated” date at the top of this page always shows when the current version came into force.