Privacy policy
In short
Browsing this website leaves no personal data with us. The site sets no cookies and stores nothing in your browser. We count visits with a cookieless analytics tool that does not identify you. If you email us, we have your email — and nothing else beyond what you chose to write.
Everything below explains that in the detail the GDPR requires.
Effective: 1 September 2026 Version: 1.0 — the first published version of this policy.
1. Who is responsible
The controller is the Luxembourg Institute of Science and Technology (LIST), acting as coordinator of the LATTICE Consortium under Horizon Europe Grant Agreement No 101308832.
5, avenue des Hauts-Fourneaux, L-4362 Esch-sur-Alzette, Luxembourg.
Data protection officer: dpo@lattice-project.eu
Partner organisations act as controllers for their own processing under the consortium agreement. This policy covers the website only, which is under LIST's controllership.
2. What we process, and when
2.1 When you simply read the site
Nothing is stored on your device and no account exists. See the cookie policy, which explains how to verify that yourself.
2.2 Analytics
We use Plausible Analytics to count visits. Each page view sends the page address, the site domain, and the referring page if there was one; as you read, one or more engagement events follow for that page, carrying the furthest scroll depth you reached and the time the page was visible and in the foreground. No cookie is set and no identifier is assigned to any of these requests.
As with any web request, these requests reach Plausible's servers carrying your IP address and user agent. Plausible does not store either. It combines them with a salt that is rotated and deleted every 24 hours to derive a counting hash, which is why the same visitor cannot be recognised across days. We see only aggregate numbers — page views, popular pages, referrer summaries. We cannot identify you from them, and we cannot single you out.
2.3 Hosting
The site is static files served by Hostinger. Like any web server, Hostinger's infrastructure records requests, which include IP addresses, as part of operating and protecting the service. Under Hostinger's data-processing terms that logging happens on our behalf, as our processor: we do not operate our own request logging, we do not access those logs in the ordinary course, and Hostinger keeps them only for the limited period its data-processing terms set for operational security.
2.4 When you email us
The site has no forms. Contact is by email, so we receive whatever your message contains — typically your email address, your name and organisation if you give them, and the text you write.
If you email contact@lattice-project.eu asking for project updates, we keep
your address on a list until you ask us to remove you. There is no tracking in
those emails: no open tracking, no click tracking, no profiling.
2.5 What we publish about the project team
The team page names the researchers carrying out the project — name, title, role, employer, and — where these exist — a professional email address and a link to a public ORCID record. This is personal data that we publish rather than collect: consortium members provide their rosters for exactly this purpose, and listing who does publicly funded work is part of the project's accountability. The legal basis is legitimate interest (Art. 6(1)(f)); photographs and personal profiles beyond these professional facts are only added with the person's consent.
A listed person can have their entry corrected or removed at any time by
writing to dpo@lattice-project.eu — directly or through their institution. No
justification is needed.
3. Legal basis (Article 6 GDPR)
| Processing | Legal basis |
|---|---|
| Aggregate analytics | Legitimate interest, Art. 6(1)(f) — understanding whether the project's public communication reaches anyone |
| Server logs kept by the host | Legitimate interest, Art. 6(1)(f) — operating and protecting the site |
| Publishing the project team on this site | Legitimate interest, Art. 6(1)(f) — transparency about who carries out publicly funded research (section 2.5) |
| Answering your email | Legitimate interest, Art. 6(1)(f) — replying to someone who contacted us |
| Project updates by email | Consent, Art. 6(1)(a) — given when you ask to be added, withdrawable at any time |
4. Who else sees the data
Two processors, both in the EU:
- Hostinger International Limited (Cyprus) — hosting. The site is served from Hostinger infrastructure inside the EU; at the time of writing the serving addresses are allocated in Germany.
- Plausible Insights OÜ (Estonia) — analytics, processed in the EU.
That is the complete list. We do not sell personal data, we do not share it for marketing or advertising, and we run no behavioural advertising of any kind.
5. Transfers outside the EU
There are none. Both processors are established in the EU and process the data in the EU.
Some illustrations on this site were generated with an AI image tool during production. No personal data was used to produce them, no visitor data is sent to any AI service, and no such service is involved in serving the site. The images are static files hosted with everything else.
6. How long we keep things
| Category | Retention |
|---|---|
| Aggregate analytics | Kept as aggregate statistics; they contain no personal data and identify nobody |
| Server logs | Kept by our host Hostinger, for the limited period its data-processing terms set for operational security; we do not access them in the ordinary course |
| Email correspondence | 12 months from the last message in the exchange, unless it concerns an ongoing matter |
| Project-update list | Until you ask to be removed |
| Team listings on this site | While the person works on the project, or until they ask for removal |
7. Your rights
Under the GDPR you may access your data (Art. 15), have it corrected (Art. 16) or erased (Art. 17), ask us to restrict processing (Art. 18), receive it in a portable form (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw consent at any time without affecting processing already carried out.
Write to dpo@lattice-project.eu. We reply within one month, as Article 12(3)
requires, and usually much sooner. Exercising a right costs nothing.
One honest limitation: we cannot answer an access request about your browsing. The analytics hold no identifier, so there is nothing we could look you up by — which is the point of collecting them that way.
If you are unhappy with how we handle it, you can complain to your national
supervisory authority. In Luxembourg that is the Commission nationale pour la
protection des données (CNPD), cnpd.public.lu.
8. Automated decision-making
There is none on this website. Nothing here profiles you or makes decisions about you.
The LATTICE platform being built by the project uses AI for threat detection, under the project's own compliance framework. It is not part of this website and does not process visitors to it.
9. Changes
If our processing changes, we update this page, raise the version number, and change the effective date. Anyone on the project-update list is told about material changes.
10. Contact
Privacy questions and requests: dpo@lattice-project.eu
General enquiries: contact@lattice-project.eu