Privacy Notice for Surveys

The EGI Surveys service (hereinafter referred to as: "the service" or "Surveys") allows individuals to take part in surveys managed and conducted by EGI Foundation. This privacy notice describes how we, the EGI Foundation (hereinafter referred to as "we" or "the Data Controller"), collect and process data by which you can be personally identified ("Personal Data") when you use the service.

EGI Foundation runs surveys on more than one platform. Each survey states which platform it uses. In addition to the information below, any survey form will include more specific information on what happens with the answers submitted through it, how and how long they will be stored, and who will gain access to them. Where a survey's own statement differs from this policy on a point specific to that survey, the survey's statement is the more specific one and applies.

Taking part in an EGI survey is voluntary. You may stop at any point before you submit, and you may decline to answer any question that is not marked as required.

The EGI Foundation
Science Park 140
1098 XG Amsterdam
The Netherlands

The EGI Foundation Data Protection Officer
Science Park 140
1098 XG Amsterdam
The Netherlands
E-mail: [email protected]

Jurisdiction: NL, The Netherlands.

EGI Foundation's lead supervisory authority is the Dutch Data Protection Authority. They can be contacted at autoriteitpersoonsgegevens.nl.

The service may process the following personal data.

Some invitation links carry information in the web address so that we do not have to ask you for it again, for example a project code or a reference identifying you as an invited participant. Where a link carries such information, it is stored with your response, and the survey says so.

EGI surveys do not request special categories of personal data (Article 9 GDPR). Where a specific survey needs to ask such a question, it will say so, explain why, and ask for your separate explicit consent before you answer.

Directly from you. Everything you enter into a survey, and any file you attach where a survey allows it.

Automatically, when you respond. The technical data described above, generated by the platform as your browser communicates with it.

From the invitation. Where we already hold your e-mail address, because you are an EGI Foundation contact, a project partner, a member of a community mailing list, or a registered participant in an EGI event, we may use it to invite you to a survey. Every invitation says how we obtained your address and how to stop receiving them. We do not buy personal data and we do not obtain it from data brokers or scraped sources.

We run both kinds, and each survey states which it is.

An anonymous survey collects no name, no e-mail address and no other direct identifier. The technical data listed above is still recorded, so a response is not anonymous in the strict sense of the GDPR: a combination of country, organisation type, role and free-text answers can in principle identify someone in a small population. We treat all survey responses as personal data and protect them accordingly, and we describe a survey as anonymous only in the sense that we do not ask who you are.

An identified survey asks for your name or e-mail address and states at that point why it needs them.

When we publish or report survey results, we publish aggregated figures and anonymised quotations. Where we want to attribute a quotation to you by name or by organisation, we ask you first.

What is placed on your device depends on the platform the survey uses.

We do not use advertising, profiling, cross-site tracking or third-party analytics on our surveys, and we do not add tracking scripts of our own to survey pages. On Formbricks we do not enable the platform's optional spam-protection feature, which would load Google reCAPTCHA.

Cookies can be viewed, blocked or deleted through your browser settings. Blocking the cookies above may prevent a survey from working.

The purpose of the collection, processing and use of the personal data mentioned above is:

We do not use survey responses to build a profile of you, to make automated decisions about you, or to target advertising. Your responses are not sold.

The legal basis for processing personal data is:

Where a survey asks a question falling within Article 9 GDPR, the basis for that question is your separate explicit consent under Art. 9 (2) (a) GDPR, asked for at the question itself. Where a survey asks you to opt in to a further use, such as being contacted for a follow-up interview, the basis for that use is your consent under Art. 6 (1) (a) GDPR, which you can withdraw at any time under Art. 7 (3) GDPR.

Personal data will not be used beyond the original purpose of their acquisition. Where a third party has to be involved in order to deliver the survey, that party acts as our processor on our documented instructions, under a contract meeting the requirements of Art. 28 GDPR, and only for the purposes set out in this policy. The data you provide will not be used for marketing and will not be sold.

For the purpose given in this privacy policy, personal data may be passed to the following third parties.

Any transfer of personal data to a third country outside the EU or the EEA must meet the conditions contained in Chapter V of the GDPR and comply with the provisions of this privacy policy and any related policies adopted by the EGI Federation. Where we identify such a transfer, we satisfy ourselves that those conditions are met before it continues, and we record it here.

Our surveys do not use third-party advertising, profiling, cross-site tracking or analytics services, and we do not disclose your responses to third parties for their own purposes.

A survey may contain links to external websites, for example to a document you are being asked about. Those websites are operated by others and are outside our control. This privacy policy does not apply to them, and their own privacy notices apply once you follow a link.

A survey platform may display its provider's own imprint and privacy policy at the foot of the page. Those documents describe how the provider handles data as a company and do not replace this policy, which is the one that governs your response.

You can exercise the following rights at any time by contacting our data protection officer using the contact details provided in the Data Protection Officer section:

To act on a request about a specific response, tell us which survey it was and roughly when you responded, and give us any identifier the survey collected. Where a survey collected no identifier from you, we may be unable to find your response, and we will explain what we can and cannot do.

If you have a question or a concern about how your personal data is handled, or if you wish to exercise any of the rights listed above, please contact our Data Protection Officer at [email protected], using the postal address in the Data Protection Officer section above. You do not have to use any particular form of words, and there is no charge for making a request.

We will acknowledge your request and respond to it without undue delay, and in any event within one month of receiving it. Where a request is complex, or where we have received a number of requests from you, we may extend that period by up to two further months, and we will tell you within the first month if this is the case and explain why. If we are unable to act on your request, we will tell you why and inform you of your right to complain to a supervisory authority and to seek a judicial remedy.

If you no longer wish to be invited to EGI surveys, tell us at [email protected] or use the unsubscribe link in the invitation. This does not affect responses you have already given.

If you are not satisfied with our response, you can complain at any time to the supervisory data protection authority (DPA) responsible for you. The responsible DPA depends on your country and state of residence, of your workplace or of the presumed violation. A list of the supervisory authorities with addresses can be found at edpb.europa.eu.

You can contact EGI Foundation's lead supervising authority using the contact details provided in the Jurisdiction and supervisory authority section. Complaining to a supervisory authority does not affect any other remedy available to you.

EGI surveys are addressed to researchers, professionals and members of the research and computing community, and are not directed at children. We do not knowingly collect personal data from anyone under 16. Should a survey be aimed at a younger audience, for example in an outreach or training context, it will say so and we will obtain the consent required by Article 8 GDPR before any personal data is collected.

If you believe a child has provided us with personal data through one of our surveys, please contact the Data Protection Officer and we will delete it.

Data retention and deletion periods can vary for different surveys and are usually indicated on the survey form. By default:

Where a survey needs a longer period, its own statement gives the period and the reason.

Deletion on the platform is followed by deletion from the provider's backups: on Formbricks, within 90 days.

Our processors act only on EGI Foundation's documented instructions. If an agreement with a processor ends, the personal data is returned to EGI Foundation or deleted, at EGI Foundation's instruction.

We take appropriate technical and organisational measures to ensure data security and the protection against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access.

Access to survey responses is limited to the survey managers who need it for the survey concerned, through named accounts with multi-factor authentication.

A comprehensive overview of the technical and organisational measures taken by EGI Foundation can be found at EGI Document 3737: EGI Foundation Technical and Organisational Measures (TOM). The measures applied by our platform providers are published by them: Formbricks at formbricks.com/security, which is audited to SOC 2 Type II.

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. We have procedures in place to detect, report and investigate such breaches.

Our processors are required under their Data Processing Agreements to assist EGI Foundation in meeting its obligations under Articles 33 and 34 GDPR. Anyone can report a suspected breach or a security weakness affecting an EGI survey to the EGI Computer Security Incident Response Team (EGI CSIRT) at [email protected], or to the Data Protection Officer at [email protected]. Reports made in good faith are welcome, and we will not pursue anyone who reports a weakness responsibly.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, EGI Foundation notifies the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we inform you without undue delay. All breaches are recorded in an internal register in accordance with Article 33 (5) GDPR, whether or not they are notifiable.

We may update this privacy policy from time to time, for example if we change survey platform or if a platform configuration changes. Any change is published at this address and the version and date are revised. The policy that applies to your response is the one in force when you submitted it.

Version 12, 1 September 2026: EUSurvey removed, as it will no longer be accessible. Formbricks added as an alternative survey tool alongside LimeSurvey. Sections added covering how data is collected, anonymous and identified surveys, cookies, third-party websites, personal data breaches and children. Retention detail expanded. Code of Conduct reference corrected to REFEDS.

Version 11 and earlier: available on request from [email protected].

EGI Foundation is conforming to REFEDS Code of Conduct and your personal data will be processed in accordance with the REFEDS Code of Conduct for Service Providers and the EGI-doc-2732-v3: Policy on the Processing of Personal Data.

Based on the AARC Policy Development Kit (licenced under CC BY-NC-SA 4.0).