Privacy Notice

EurOMo Full Database Access Requests

This Privacy Notice explains how personal data is processed when you submit a request for access to the Euromedia Ownership Monitor (EurOMo) ‘Full Database’.

1) Who is responsible (Controller)

The controller for processing your access request is:

Paris-Lodron Universität Salzburg (PLUS) (University of Salzburg)

Kapitelgasse 4–6, 5020 Salzburg, Austria.

EurOMo is a project operated by a consortium of higher education institutions and research institutes and coordinated by PLUS. (Within PLUS, the controller is represented by the Rectorate.)

2) Data protection contact (Data Protection Officer)

E-mail: [email protected]

Phone: +43 662 8044 2007

University of Salzburg

(Use this contact for GDPR rights requests as well.)

3) What we collect

We process the information you submit in the form, such as:

• identification and contact details (e.g., name, institutional email),
• affiliation/role,
• your stated reason for legitimate interest,
• supporting documents you upload (e.g., proof of affiliation),
• operational/security data related to your access (e.g., authentication and query-volume logs).

4) Why we process it

We process your data to:

• assess and decide on your request for Full Database access,
• set up and administer approved access,
• protect the platform and prevent misuse (security, fraud prevention, auditing, and incident handling).

5) Legal basis (GDPR)

Depending on how your access is provided and administered, we rely on one or more of the following legal bases:

• Art. 6(1)(b) GDPR (steps at your request / performance of a contract) — to process your request and provide/manage access where approved; and/or
• Art. 6(1)(f) GDPR (legitimate interests) — to operate and secure the service, prevent misuse, and keep necessary logs.

Where we rely on legitimate interests, our interests are the secure and accountable operation of the service and the prevention/investigation of abuse.

6) Who we share it with (recipients)

Your data may be accessed by:

• authorised PLUS staff responsible for assessing requests and administering access;
• where necessary, relevant EurOMo consortium partners involved in access assessment and administration (on a need-to-know basis);
• IT/hosting or support providers acting under instructions of PLUS (where used).

In addition, because EurOMo is EU co-funded, information may be shared where required for grant management and compliance with the European Commission and authorised bodies (e.g., in the context of checks, reviews, audits or investigations).

7) International transfers

If any service provider processes personal data outside the EEA, PLUS will use appropriate safeguards required under GDPR (e.g., adequacy decisions or Standard Contractual Clauses).

8) How long we keep it (retention)

We keep personal data only as long as necessary for the purposes above and according to applicable obligations.

• Routine correspondence with external requesters may be retained for up to 6 months to handle follow-up queries and then deleted, where no longer needed.
• Access request records and supporting documents may need to be retained longer where necessary for compliance and auditability connected to the EU grant framework — potentially up to 5 years after final payment.

Security logs (e.g., authentication events and query-volume/rate-limit logs) are retained for 6 months and then deleted or anonymised, unless a longer retention is necessary to investigate misuse/security incidents or to comply with legal/compliance obligations for grant management (e.g., ongoing checks, audits or investigations).

9) Your rights

Under the GDPR, you may have the right to request access, rectification, erasure, restriction, objection, and (where applicable) data portability. To exercise your rights, contact: [email protected]

You also have the right to lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)

Barichgasse 40–42, 1030 Wien, Austria

Phone: +43 1 52 152-0 | Email: [email protected]

10) Providing data

Providing the requested information is necessary to assess your application. If you do not provide required fields or adequate supporting information, we may be unable to process or approve your request.

11) Automated decision-making

We do not make solely automated decisions about access requests; requests are processed and reviewed by humans.

12) What we ask you not to upload

Please avoid uploading special-category or highly sensitive personal data unless it is strictly necessary to support your request.