After outlining a broad overview of the general purposes behind data processing, we would like to present the specific categories of personal data that are likely to be processed during the lifetime of the PACK project. Project partners will collect and process various types of personal data to ensure uninterrupted internal cooperation, the flawless execution of multiple activities and/or work-tasks, collaboration with external participants and compliance with their legal obligations. Regardless of the specific purpose behind a processing activity, it must be justified by at least one of the legal bases listed above and carried out in compliance with the principles of the GDPR. All partners commit to adhere to the obligations and requirements set forth in this privacy notice and avoid violating applicable legislations or the rights of the data subjects. 

Data protection during the execution of work tasks 

All employees involved in the PACK project under a valid employment contract or other legally binding agreement with any of the project partners, are required to follow the guidelines of this privacy notice, which are designed in accordance with EU and national laws to enhance data security. This applies to any associate, staff member or subordinate, even if the law governing the legally binding contact with a partner does not classify them as ‘employees’. As long as one is working on the project or accessing its products, documents or internal communication channels, adherence to this privacy notice is obligatory. 

Employees can keep only work-related documents visible on their desk and screen during working hours, and only when the data is necessary for their tasks. Also, any written documentation (e.g. printed sheets) and electronic devices containing personal data related to the project must be locked away at the end of the workday. All devices (e.g. phones, laptops, tablets) must be secured with strong PINs or passwords, and auto-lock features must be activated when the devices are left unattended. In the absence of the employee, appropriate procedures must be followed so that outsiders cannot access sensitive or restricted data. 

Internal meetings within each partner’s organization – especially when project-related personal data is discussed – must not be recorded without an explicit permission from a superior. If such recordings are made, they are subjected to the same principles and requirements outlined in this privacy notice. For example, data may be processed only if it is necessary to complete a specific work task during the meeting (e.g. deciding whether a potential external participant should be contacted). After concluding an online or hybrid meeting, all documents and table contents must be removed from the meeting rooms.

It is possible that not all employees of a partner are assigned work-tasks related to the PACK project under their employment contract. In such cases access by these employees to the data processing connected to the project must be explicitly prohibited and prevented through measures the partner deems necessary. Even if an employee is involved in the project, they may only access data to the extent and within the scope necessary for carrying out their previously assigned tasks.

The partners may maintain logs of data access by their employees whose activities can be monitored within legal boundaries (e.g. data stored on work-related devices can be checked by a supervisor appointed by the controller). Information from these logs may be retrieved by other partners in cases of unauthorised processing, data breaches or when a legitimate interest arises on the part of a consortium member concerning an employee (e.g. for the purpose of conducting a legal dispute). If a partner would like to follow this practice, they are required to provide proper information to their employees (e.g. which device can be monitored, how often or by whom). 

Primarily the personal data of employees involved in the PACK project will be processed by the respective partner employing them under a valid contract. However, if it is deemed necessary, the project coordinator or SFC – who is responsible for data management and protecting personal data – may access employees’ personal data besides the employer partners. The legal basis for this processing includes, on one hand, the fulfilment of contractual obligations (e.g. salary transfers), and on the other, compliance with financial transparency and budgeting requirements. Since the PACK project is funded by the European Union, it is objected to EU law requirements. This data may also be processed by the parties when there is a legal obligation to do so (e.g. reporting to an EU body on the project’s financial status or to submit data to various national authorities).

Data processing at partners related to the project will be reviewed by SFC with special attention paid to where the data is stored and the adequacy of its protection. 

Cooperation among project partners

Uninterrupted internal collaboration among the project partners is a key element in ensuring the success of the PACK project. Without seamless coordination and effective project (consortium) management, the project’s outcomes (e.g. products, publications, dissemination materials) will not achieve the broad accessibility and stakeholder engagement that the partners aim to reach. During this frequent communication, partners should expect that their personal data (e.g. email address, phone number, other contact details) may be shared among the consortium members. The legal basis for this data processing is either the fulfilment of obligations arising from a previously conducted contract (e.g. Consortium Agreement) or any other agreements between the partners, or the legitimate interests pursued by a partner. For example, in order to complete a work-task, a partner may be given access to the contact details of an employee of another partner organization if direct interaction is essential for executing that task. Primarily SFC – who is responsible for project coordination and operational management – and additionally any partner intending to communicate with another, reserves the right to collect and process the personal data of the members on the basis of their legitimate interest, limited strictly to what is necessary for effective internal communication. SFC will provide  project management templates (e.g. partner contact list) and offer assistance to the project partners as needed to support efficient collaboration. At the same time, SFC guarantees that personal data collected from the partners are handled securely. 

Cooperation between the partners extends far beyond ad-hoc or occasional communication. Semi-annual on-site meetings, as well as hybrid or fully virtual (video)conferences will be organized at various levels throughout the entire course of the project. Partners may be invited to on-site technical testings or field trips to test the project products. Therefore, the scope of the data processed in connection with these occasions, as well as its legal basis, will depend on the nature and purpose of the specific event. The legal basis for each type of data processing will be evaluated separately. This means that a signed agreement between the partners (e.g. Consortium Agreement) does not automatically authorize all forms of data processing by other project partners. For example, personal attendance at a physically conducted meeting or field trip may be required by a contractual obligation, which would justify sending an invitation to a partner’s email address, including their name, organizational role, and other contact details. However, this does not imply consent for recordings or photographs to be taken of those individuals at the venue. The scope of data processing must be interpreted strictly even within internal relations, and partners must be provided with appropriate information accordingly. Also, where necessary, informed consent must be obtained from them before data collecting may begin. 

The PACK project entails an ongoing internal quality assurance, during which personal information related to internal documents and external publications may be shared among partners or directly forwarded to those working on related tasks. Since sharing data at this level is essential for the successful implementation of the project (e.g. internal peer reviews, approval from the Management Team or other partners), it will be carried out based on the partners’ legitimate interest.

One of the goals of the PACK project is to introduce its products to the market. To achieve this, partners will monitor the status of intellectual property rights (IPR) and any relevant trademarks. Personal data might be processed during such activities as a part of IPR research or (later on) the implementation of IPR protection measures. Such data processing will be carried out on the basis of legitimate interest of the partners and in accordance with the applicable data protection requirements detailed in this privacy notice.

Certain project partners and/or their selected employees might be invited to promote the PACK products in interviews or podcasts on television or radio. Participation in such activities will be voluntary. If a partner agrees to participate, their personal data will be processed based on their informed consent.

Stakeholders’ engagement

With the intention of increasing the visibility and outreach of the PACK project, a separate work-task will be dedicated to identify and engage stakeholders: both individually and as groups or entire organisations. PACK’s communication targets a wide and varied range of stakeholder groups, including logistics companies, customs and border authorities, truck and trailer manufacturers, suppliers, truck drivers, policy makers and environmental agencies as well as the members of the general public. Active and regular engagement of these stakeholders is essential to refine the specific desires and needs PACK intends to address by the end of the project. Also, by recruiting volunteers and other participants for our events, gathering feedback from them and considering the diverse perspectives coming from a broad range of sources, we hope that the project’s results will more accurately represent the real-world needs of the industry.

Mapping and engaging the stakeholders will also allow the partners to make significant progress in communicating and disseminating our results with the public. Our outreach to stakeholders will not be limited to the online space (e.g. teleconferences) but their participation in community events, such as workshops, demonstrations or product testings, will also be encouraged. These collaborative events will be organized to connect the partners with diverse end-users and stakeholders, while also showcasing the project’s progress and achievements to them. 

To establish contact with potential future stakeholders (e.g. truck drivers, customs officers, transport companies), who may be invited to participate in the project, the partners need to access a small set of their personal data (e.g. name, phone number, email address), limited strictly to what is necessary for making contact. This data will be processed based on the partners’ legitimate interest and will be deleted if the cooperation between the partner and the stakeholder has failed and the personal data is no longer necessary for future collaboration, or if a new legal basis applies (e.g. a contract is concluded between the parties). Data subjects may also exercise their right to erasure by contacting our DPO. After contacting a potential stakeholder, a partner may offer to enter into a contract. From this point forward, the legal basis and scope of data processing will be adjusted accordingly, and different types of data may be collected if necessary for performing the contract. The content of the contract concluded between the data subject and a consortium member may extend beyond participation in the project and could also include a non-disclosure agreement (NDA).

Stakeholder engagement is led by SFC – who is mainly responsible for data management in this regard – however, all partners contribute with stakeholder identification and involvement. Hence, all partners (as joint data controllers) are involved in sharing basic contact details of identified stakeholders for outreach purposes. 

As it was pointed out, various types of events (e.g. conferences, workshops, tests, demonstrations) will be organised throughout the lifetime of the PACK project to engage a wide-range of stakeholders and other participants while also introducing our products. Regardless of the exact type of these events, fundamental data security standards will apply uniformly. Attendance at any event is always voluntary, no attendee may be compelled or coerced into participating. However, if someone chooses to attend, their personal data may be collected based on the legal basis of informed consent. At events where a prior registration is required, after reading the provided information that will be published on the website where a registration can be submitted participants may voluntarily choose to provide their personal data (e.g. name, contact details). In some cases, participants may also be notified via confirmation emails about the extent of data collection and processing during the event (e.g. that recording may take place). If an individual is previously signed up to our newsletter, this notification may be sent out beside an invitation to the event via emails without the registration process.

For public events (e.g. promotional workshops) that do not require registration, appropriate information about data collection will still be provided. This may include notices on the event’s promotional website, cautionary signage at the venue or verbal announcements during the event. These notices inform attendees that recordings may take place. By attending with awareness and understanding of this possibility, individuals are generally considered to have given informed, valid consent to appear in such recordings (e.g. group photos, short videos). However, attendees must retain the right to define the limits regarding their consent, being recorded or photographed must not be a precondition for attending the event. Any attendee who does not wish to be included in such media, must be given a clear opportunity to express their will explicitly and cannot be compelled to appear in recordings solely on the basis of attending the event.

At events that require personal invitation (e.g. closed testings or demonstrations), the partners may need to access a limited set of personal data (e.g. email addresses or other contact details) to establish contact with potential participants (e.g. customs authorities, transport companies) whom the partners intend to involve in the project. This data will be processed based on the partners’ legitimate interest and will be deleted if no cooperation is established and the data is no longer necessary for future collaboration, or if a new legal basis applies (e.g. a contract is concluded between the parties, or a tester gives its informed consent to participate). Legitimate interest may justify data collection when such activity is carried out for statistical purposes (e.g. participation numbers or attendance figures). Data collection may sometimes be required by legal obligations during events, such as when an accident occurs and the appropriate authorities need to be notified.

The PACK project also intends to invite policymakers to main events. Personal data collected from them during their participation will be managed in the same manner outlined above.

At some events short videos and photographs may be taken and posted of the project website and/or other social media platforms. Being featured in these recordings depends fully on the informed consent of the data subject. In these situations, the scope of this consent is determined by the data subject who gave it, which means that they may agree to certain data processing activities (e.g. participation in a group photograph, interviews) while refusing others (e.g. videos taken while they use our products). 

Feedback from the participants will also be gathered at the venue as well as online (e.g. via email). In accordance with the principle of data minimization, it is unlikely that new personal data will be processed alongside the already collected data (e.g. the email address to which the message is sent) by the project during gathering feedback. 

During the project, partners may conduct surveys with stakeholders (or other participants). In addition, PACK aims to carry out a dedicated survey targeting customs authorities, truck operators, truck and trailer manufacturers, logistics and transport companies and ITS companies to assess the conditions and intentions for including deployment of PACK products in their future improvement plans. Project partners will also conduct interviews with representatives of ministries and/or other industrial experts. Participation is voluntary in both instances. Personal data from individuals filling out our surveys or participating in interviews can be only processed after obtaining informed consent from them. 

Website and dissemination materials

A publicly available PACK website will be created and launched under the leadership of SFC to reach the general public and share information on the project’s achievements. The project website will serve as the main dissemination platform, providing access to the latest publications related to PACK, updated project information and a schedule of events (e.g. workshops, conferences) organised by the partners. The project website will also be used to attract participants to the project’s public workshops, including information about such events and offering the option to register for participation. 

Upon visiting the website, cookies and similar tracking technologies will be used to enhance functionality and to analyse usage. These trackers might collect certain types of personal data (e.g. IP-address, browsing behaviour). The website clearly distinguishes between different categories of cookies, such as essential (strictly necessary) and non-essential (e.g. preference, marketing) ones. Essential cookies ensure the functionality of the website and cannot be disabled via the cookie consent tool. They are used based on legitimate interest, as the website and its specific services (e.g., logging in) would not function correctly without them. The use of non-essential cookies requires the visitor’s informed consent, which must be obtained prior to the activation of any such cookies. Right after accessing the project website, visitors will be provided with clear information about the types of data each cookie tracks and the purposes of such processing, using plain and easily understandable language. A cookie consent popup will inform visitors of their right to give informed consent, the scope of data processing during their visit, and the option to access more detailed information about the trackers used. Visitors will be able to manage their cookie preferences at any time through the website settings. Non-essential cookies that require consent will stop tracking data if consent is withdrawn.

Besides the project website, several social media channels (e.g. YouTube channels, Facebook and X page, LinkedIn account) will be set up to produce, publish and post content following the project’s progress. For example, pictures taken and recordings made at the events, as mentioned above, will be posted on these platforms, if informed consent has been previously obtained from the data subjects. SFC is responsible for both the creation and management of these social media platforms. In addition, partners will post project news on their own media accounts to further promote PACK. These social media platforms will also facilitate a channel of communication where the interested members of the general public can interact with the project partners in a lively manner. Project partners will process the minimal amount of personal data necessary to facilitate this type of communication (e.g. email address, social media account, name) on the basis of informed consent which is considered given when an individual reach out to us voluntarily. 

Since SFC is mainly in charge of managing the website and the social media platforms, access to personal data necessary for their smooth operation will be primarily accessed by it (e.g. data tracked by cookies). However, all partners will have the opportunity to provide their own introductions, share posts about their activities, or publish news on the project platforms besides their own accounts, and thereby they may access a limited set of personal data based on their legitimate interest. Partners may also gain access to the acquired data in some cases, for example, a guest who created an account on the website could receive an invitation to an event from any member via the email address provided or get notified through their social media account. 

To properly inform the interested public, the PACK project will distribute an electronic newsletter and/or direct social media messages at regular intervals. Subscription to these newsletter or massages will be available online via the project website or on the social media platforms. When a data subject signs up, certain types of data must be provided in order for the project members to establish contact with the individual. The processing of this data is based on informed consent given electronically by the data subjects themselves. Subscribers to the newsletter will have the option to unsubscribe at any time. By unsubscribing, data subjects withdraw their consent, and their data related to the newsletter will be deleted.

Scientific community and publications 

Among the activities aimed at exploiting the results of the project, particular emphasis will be placed on the scientific community and dissemination focused on them. Multiple research institutions will be approached in order to request their insights and collaboration in advancing the project. To enhance their engagement, several scientific conferences (e.g. ETC, TRB, WCTR, IEEE IV symposium, etc.) and dedicated workshops will be organized. Participation at the events centred around the invitation of members from the scientific community will be fully voluntary by the invited and interested participants. Personal data collected and processed in connection with these occasions will be subjected to the same regulations as previously outlined (e.g. appearing in recordings depends on the informed consent of the individual). The involvement of the research community includes publications in targeted scientific journals, the internal peer review of articles or the presentation of the project at conferences. 

Research outcomes will be published in high-impact journals. Since the PACK project is fully committed to Open Science, several steps will be taken to comply with its practices and principles. For example, the outcomes and findings of the PACK project are published in fully open-access venues, open-source software developed during the project is made publicly available through repositories such as GitHub and most results can be accessed via the Horizon Results Platform. Validity is an important aspect to ensure the quality of the project’s process, therefore the methodology relies on a large range of external participants to test the project outputs. However, when individuals are involved in a research-focused part of the project, we ensure that their data is anonymised or pseudonymised before publication whenever possible. For example, co-creation processes and feedback will be documented, although personal data related to their sources will be anonymised. And only participation data that has undergone pseudonymisation will be provided to demonstrate the representativeness and reliability of stakeholder engagement. Participants will be informed about the potential for open publication, and only data necessary to validate or understand the research findings is made publicly available. Research publications will not include personally identifiable information unless explicit and informed consent has been obtained, such consent can be withdrawn at any time for future use. Prior to the release of any external publications, a detailed publication and quality assurance process will be presented to which our research partners will be informed and adhere. This quality assurance process is subjected to internal peer reviews and the approval of the project coordinator. During these quality assessments, it is possible that the project coordinator or other members of the consortium may gain access to a researcher’s personal data. However, even in such cases, these data will not be processed beyond what is necessary for the processors’ legitimate interest (e.g. storing email addresses for future cooperation), for fulfilling contractual obligations (e.g. transferring agreed remuneration to a bank account specified in the contract), or for complying with legal obligations (e.g. submitting data to tax authorities after payment has been made).