ClimpactPlatform
Back to Climpact

Privacy Policy

Last updated: 2 August 2026

1. Introduction

This Privacy Policy describes how the CLIMPACT project (Charting the Landscape of Climate Litigation Impacts: An Interdisciplinary Framework and Open Access Database) collects, uses, stores and protects your personal data when you interact with this platform and its services.

CLIMPACT is a research project funded by the Italian Ministry of University and Research (MUR) through a Starting Grant under the Fondo Italiano per la Scienza (FIS 3), D.D. n. 1802 del 21 novembre 2024 — ERC Sector SH2. The project is based at the Dipartimento Jonico in Sistemi Giuridici ed Economici del Mediterraneo: società, ambiente, culture, Università degli Studi di Bari Aldo Moro.

This policy is drafted in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the Italian Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018 (Codice in materia di protezione dei dati personali).

2. Data Controller

The Data Controller is the Università degli Studi di Bari Aldo Moro, Piazza Umberto I, 1 — 70121 Bari, Italy.

The person responsible for data processing operations related to the CLIMPACT project is Dr. Giuseppe Naglieri, Principal Investigator, who can be contacted at giuseppe.naglieri@uniba.it or privacy@climpact.it.

The Data Protection Officer (DPO) of the University of Bari Aldo Moro can be contacted at rpd@uniba.it.

3. Categories of Personal Data and Purposes of Processing

The CLIMPACT platform collects and processes personal data through different channels and for different purposes, as described below.

3.1 Platform navigation, cookies and analytics

When you visit the public website, our hosting and infrastructure provider (Google Firebase / Google Cloud Platform) processes a limited amount of technical data — such as your IP address, browser type, device information and the time of access — in server logs, for the sole purpose of operating the platform securely and reliably.

In addition, and only if you give your consent, we operate our own website analytics. When analytics are enabled, we store one record for each page you view. That record contains: your IP address; the approximate location derived from it server-side (city, region, country, and the approximate latitude and longitude of that city) together with your network provider and, where the network belongs to an organisation such as a university, a public institution or a company, the name and kind of that organisation; the page you visited and the time you spent on it; the address of the site that referred you; and the identification string your browser sends with every request (the "user agent"), from which we derive whether you are on a desktop, tablet or mobile device. An opaque, per-session identifier groups the pages of a single visit together; it is held in your browser's session storage and is discarded when you close the tab.

With the same consent we also store a random identifier in your browser's local storage, so that we can tell whether a browser has visited before. It contains nothing about you, is renewed every 12 months and is deleted as soon as you withdraw your consent. We also record a few actions on our pages: how far down a page you scroll, the files you download, the links to other websites you open, the words you type in the site search before opening a result, and the completion of a form (such as a newsletter subscription, an event registration or a press accreditation request), without the content of the form. These records carry no IP address.

We keep the IP address and the browser identification string, rather than only the location derived from them, for two reasons: to distinguish genuine readers from automated crawlers, and to recognise repeat requests from the same visitor so that our audience figures are not inflated. The approximate coordinates are those of the resolved city, not of your device, and are used to place a marker on an internal map of where our readers are. We do not combine any of this with data from other sources, we do not use it to build a profile of you, and we do not attempt to identify you from it, with the single exception described in section 3.2 for newsletter subscribers who open a link in one of our campaigns. These records are visible only to the Principal Investigator and to the staff who administer the website. They are stored on our own infrastructure and automatically deleted after 90 days.

Non-essential (analytics) processing is activated only after you give your prior consent through the cookie banner shown on your first visit, which you can change at any time. The legal basis for strictly necessary cookies and technical logs is the legitimate interest of the Data Controller in operating the platform securely (Art. 6(1)(f) GDPR); the legal basis for analytics is your consent (Art. 6(1)(a) GDPR). Full details are set out in our Cookie Policy.

3.2 Newsletter

If you subscribe to the CLIMPACT newsletter, we collect your name, email address and — where provided — your institutional affiliation. This data is used exclusively to send you periodic communications about the project's research activities, events, publications and updates. You may unsubscribe at any time using the link included in every newsletter or by writing to privacy@climpact.it. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR).

The links in our newsletter campaigns pass through our own address (climpact.it/go) before reaching the page. When you open one, we record which link you opened, when, and the type of device, together with your subscription, so that we know which topics interest our readers. Each campaign also contains a one-pixel image loaded from our own address (climpact.it/px): when your email program downloads it, we record that the email was probably opened, when, and how many times. This is only an indication, since some email programs download images without the email being read and others block them. If, on arrival, you have accepted analytics on our website, the pages you read during that visit are also linked to that click. Every campaign carries a link to stop both measurements for your address without unsubscribing. Open and click records are deleted after 90 days. The legal basis is our legitimate interest in understanding how our newsletter is read (Art. 6(1)(f) GDPR); you can object at any time by writing to privacy@climpact.it or by unsubscribing.

3.3 Application Hub and event registration

The platform hosts a centralised submission portal (the Application Hub) through which candidates may apply to the project's open calls — including calls for papers, calls for applications to research positions, calls for interest in governance and advisory bodies, and calls for contributions — and public forms through which you may register for the project's events.

Depending on the specific call or event, the data collected may include your name, email address, institutional affiliation, country, career stage, research interests, a brief professional biography, a statement of interest, a curriculum vitae, cover letters, writing samples, and other supporting documents you submit. This data is processed for the purposes of evaluating your submission or managing your participation, communicating with you about the outcome and, where applicable, managing your involvement in the project. It is accessed only by the Principal Investigator and by members of the research team or administrative staff directly involved. Where you have given your consent through the dedicated option in the form, your contact details may also be used to send you the newsletter.

Journalists, photographers and crews who ask for press accreditation to one of our events give us their name, email address and, where provided, telephone number and country; the name and kind of their outlet and their role; and what they need at the event, such as an interview, photography or video recording. We use this data to decide on the request, to write to them about the outcome and, if they are accredited, to register them as press participants in the event, with an e-Badge that gives access to the press kit and to interview requests addressed to the event desk. The data is accessed only by the Principal Investigator and the staff who organise the event. The legal basis is the consent given in the accreditation form (Art. 6(1)(a) GDPR), which can be withdrawn at any time by writing to privacy@climpact.it.

We also use this data, and the record of your registration to the Application Hub, to monitor how our calls perform: how many people opened a call, how many began an application, how many submitted one, and how many registered an account without ever applying. These figures are produced for internal use by the Principal Investigator and the staff who administer the calls. They are normally consulted in aggregate, but the underlying lists remain identifiable, so that we can remind an applicant that their application is still unsent before a deadline passes, and so that we can contact people who registered an interest but did not go on to apply, about that call or a future one. You may object to this use at any time by writing to privacy@climpact.it, and you may unsubscribe from any such message.

The legal basis is the legitimate interest of the Data Controller in evaluating applications and managing the project's activities (Art. 6(1)(f) GDPR) and, where applicable, the performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR); where data is used for newsletter communications, the legal basis is your consent (Art. 6(1)(a) GDPR). The legal basis for the monitoring described above is the legitimate interest of the Data Controller in assessing and improving the reach of its calls (Art. 6(1)(f) GDPR), in respect of which you have a right to object under Art. 21 GDPR.

3.4 Scientific Advisory Board and Climpact Rapporteurs Panel

The project is supported by two expert bodies whose members are enrolled by invitation: the Scientific Advisory Board (SAB) and the Climpact Rapporteurs Panel (CRP). If you are invited to join one of these bodies and accept, we create a personal account for you and process your name, email address, institutional affiliation, role and the professional and biographical information relevant to your appointment, together with the contributions you make in that capacity (such as scientific opinions, reviews, recommendations or rapporteur reports). This data is processed in order to constitute and operate these advisory and governance bodies and to document their work. Access to the SAB and CRP areas is restricted to invited members and to the Principal Investigator and authorised members of the research team.

The legal basis is the performance of a task carried out in the public interest and the legitimate interest of the Data Controller in operating the project's governance (Art. 6(1)(e) and (f) GDPR) and, in respect of the working relationship arising from your appointment, the performance of that engagement (Art. 6(1)(b) GDPR). The platform's remaining portals — the Digital Research Platform and the internal management areas — are reserved for the project's own team members and operate under the University of Bari Aldo Moro's institutional framework for the processing of staff and collaborator data.

3.5 Contact and contribution forms

The platform may include forms through which you can contact the project team, suggest climate-litigation cases, or share reflections and materials relevant to the project's research. The data collected includes your name, email address, institutional affiliation (where provided) and the content of your message. It is processed in order to receive and respond to your communication and, where relevant, to incorporate your contribution into the project's research in accordance with applicable ethical and scientific standards. The legal basis is the legitimate interest of the Data Controller in receiving and responding to communications related to the project (Art. 6(1)(f) GDPR).

3.6 Surveys and research activities

In the course of its research, CLIMPACT may conduct surveys, interviews or other data-collection activities involving human participants. Where such activities take place through this platform or linked platforms, specific and detailed information on the data collected, the purposes of processing and the applicable safeguards will be provided to participants at the time of collection, together with a dedicated consent form. The legal basis is your consent (Art. 6(1)(a) GDPR), in conjunction — where applicable — with Art. 89 GDPR and the relevant provisions of Italian law governing the processing of personal data for scientific-research purposes.

3.7 Platform accounts and the activity log

If you have an account on the CLIMPACT platform (the research team, the boards and panels, and other invited collaborators), we keep a security and accountability log of significant actions: when you sign in, and changes to research records, published content, event data and user permissions, as well as data exports. Each entry records who acted, what was done, on which record and when. We do not record the pages you browse inside the platform and we do not use the log to measure anyone's work or productivity. The log is visible only to the Principal Investigator, is used to protect the integrity of the research data and to investigate errors or misuse, and is deleted after 12 months. The legal basis is the legitimate interest of the Data Controller in the security of the platform and the integrity of the research (Art. 6(1)(f) GDPR).

3.8 Requests for the TRACE technical report

On the page of the TRACE dataset you can ask us to send the TRACE technical report to an email address. We use that address only to send you one message with a link to the report: it is not added to the newsletter or to any other list, and we do not write to you again because of it. To prevent abuse of the form we record, for each request, the address, the time, the outcome and a one-way fingerprint of your IP address (a salted hash: never the IP address itself), and we count requests per fingerprint and per address. For research reasons, we keep these records until the end of the CLIMPACT project. The message is delivered by our transactional email provider. The legal basis is your consent, given by ticking the box on the form (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to privacy@climpact.it; the records kept to prevent abuse rest on the legitimate interest of the Data Controller in the security of the service (Art. 6(1)(f) GDPR).

4. Data Retention

Records connected to the project are kept for its whole duration and for ten years after its end, so that the project's work can be documented and accounted for towards the Ministry of University and Research and the University of Bari:

  • newsletter data is retained until you withdraw your consent or request its deletion; when you unsubscribe we keep only your email address, marked as unsubscribed, so that we never write to you again;
  • data submitted through the Application Hub and event forms, including press accreditation requests, registrations and certificates of attendance, is retained for the duration of the project and for ten years after its end, unless a longer period is required by law or by the University's record-keeping obligations;
  • travel and reimbursement data is retained for ten years, in accordance with accounting law;
  • data of members of the Scientific Advisory Board and the Climpact Rapporteurs Panel is retained for the duration of their appointment and, thereafter, for the duration of the project and for ten years after its end;
  • data collected through contact and contribution forms is retained for the duration of the project and for ten years after its end;
  • website analytics data, including the records of actions on our pages, the returning-browser records and the newsletter open and click records, is retained for 90 days and then automatically and irreversibly deleted; the random identifier stored in your browser is renewed every 12 months and deleted when you withdraw consent;
  • the activity log of platform accounts is retained for 12 months;
  • requests for the TRACE technical report (the email address, the time, the outcome and a fingerprint of the IP address) are kept for research until the end of the CLIMPACT project;
  • research data is retained in accordance with the information provided at the time of collection and with the project's Data Management Plan, which follows the FAIR principles (Findable, Accessible, Interoperable, Reusable); where possible it is anonymised or pseudonymised.

Data collected before 27 September 2026 is kept within the period stated in this policy at the time it was collected.

At the end of the applicable retention period your data is securely deleted or irreversibly anonymised.

5. Data Recipients

Your personal data may be accessed by:

  • the Principal Investigator and the members of the CLIMPACT research team, in the exercise of their functions;
  • administrative and technical staff of the University of Bari Aldo Moro, where necessary for the management of the project;
  • our hosting and infrastructure provider, Google (Firebase / Google Cloud Platform, provided in the European Union by Google Ireland Limited), which stores and processes data on behalf of the Data Controller as a data processor under an agreement compliant with Art. 28 GDPR;
  • our transactional email provider, which delivers newsletters and service messages on our behalf as a data processor;
  • an IP-geolocation service provider, which receives a visitor's IP address solely in order to return an approximate location, and only where website analytics have been enabled with consent.

Your data is not sold, nor shared with or transferred to third parties for commercial or promotional purposes. Disclosure to other recipients may occur only where required by law or by order of a competent authority.

6. International Data Transfers

The platform's databases, files and back-end functions are hosted on Google Cloud Platform / Firebase in data centres located within the European Union. Some of our processors — in particular our transactional email provider and the IP-geolocation service used for consent-based analytics — may process limited data (such as an email address or an IP address) in the United States or other countries outside the European Economic Area. Where this occurs, the transfer is carried out on the basis of an adequacy decision of the European Commission (including, where the provider is certified, the EU–US Data Privacy Framework) or, failing that, of Standard Contractual Clauses adopted pursuant to Art. 46(2)(c) GDPR, together with appropriate additional safeguards. Beyond these processor arrangements, the CLIMPACT project does not transfer personal data outside the European Economic Area; should such a transfer become necessary in the context of specific research activities, it will comply with Chapter V of the GDPR and specific information will be provided to the data subjects concerned.

7. Data Security

Your personal data is protected through appropriate technical and organisational measures designed to prevent unauthorised access, disclosure, alteration, loss or destruction. These measures are implemented both at the level of the University of Bari Aldo Moro, in accordance with its institutional data-protection policies, and at the level of our hosting and infrastructure provider (Google Firebase / Google Cloud Platform), which maintains industry-standard security certifications and protocols.

8. Your Rights

Under the GDPR you have the right to:

  • access your personal data and obtain a copy of it (Art. 15);
  • request the rectification of inaccurate or incomplete data (Art. 16);
  • request the erasure of your data, where the conditions of Art. 17 are met;
  • request the restriction of processing in the circumstances of Art. 18;
  • receive your data in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller (Art. 20);
  • object to processing based on a legitimate interest, on grounds relating to your particular situation (Art. 21);
  • withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out beforehand (Art. 7(3)).

To exercise any of these rights, contact the Principal Investigator at privacy@climpact.it or the Data Protection Officer of the University of Bari Aldo Moro at rpd@uniba.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) if you believe that the processing of your personal data infringes the GDPR or applicable national law.

9. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in our data-processing practices, in the services offered through this platform or in the applicable legal framework. Any update is published on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

10. Contact

For any question or concern regarding this Privacy Policy or the processing of your personal data in connection with the CLIMPACT project, please contact the Principal Investigator, Dr. Giuseppe Naglieri, at privacy@climpact.it, or the Data Protection Officer of the University of Bari Aldo Moro at rpd@uniba.it.