Fundación Pública Galega Centro Tecnolóxico de Supercomputación de Galicia (CESGA)
Coordinator — joint controller. NIF G15852981. Avenida de Vigo, s/n, 15705 Santiago de Compostela (A Coruña). DPO: dpo@cesga.es · privacy: rgpd@cesga.es
Data protection
Privacy & data protection
1HealthAI is public infrastructure, and it treats the personal data it collects the same way it asks its users to treat theirs: the minimum needed, for a stated purpose, for a limited time, under European law.
Joint controllers
Who processes your data
The data you give us on this website is processed jointly, as joint controllers (Art. 26 GDPR), by the two beneficiary entities that lead the 1HealthAI Factory (European One-Health AI Factory, grant agreement No 101314617): CESGA, as coordinator, and CSIC. The entities affiliated to the project access your data only on their behalf, as data processors.
Agencia Estatal Consejo Superior de Investigaciones Científicas, M.P. (CSIC)
Co-leader — joint controller. NIF Q2818002D. Calle Serrano 117, 28006 Madrid. DPO: delegadoprotecciondatos@csic.es
Universidade de Santiago de Compostela (USC)
Affiliated entity (processor). NIF Q1518001A. Colexio de San Xerome, Praza do Obradoiro s/n, 15782 Santiago de Compostela. DPO: dpd@usc.gal
Universidade da Coruña (UDC)
Affiliated entity (processor). NIF Q6550005J. Rúa da Maestranza 9, 15001 A Coruña. DPO: dpd@udc.gal · responsible: rpd@udc.gal
Universidade de Vigo (UVigo)
Affiliated entity (processor). NIF Q8650002B. Edificio Exeria, Campus Lagoas-Marcosende s/n, 36310 Vigo. DPO: dpd@uvigo.gal
Centro Tecnolóxico de Telecomunicacións de Galicia (Gradiant)
Affiliated entity (processor). NIF G36997229. Carretera do Vilar 56-58, 36214 Vigo. No DPO designated; contact: gradiant@gradiant.org
Asociación DIH DATAlife – Hub de Innovación Dixital DATAlife
Affiliated entity (processor). NIF G70603063. Avenida do Mestre Mateo 2, Edificio Emprendia, Campus Vida, Santiago de Compostela. Contact: info@dihdatalife.com
CESGA and CSIC have signed an agreement that divides their responsibilities. CESGA is the single point of contact for any question about your data (rgpd@cesga.es), hosts the website and the data, and coordinates the response to your requests; CSIC handles requests for data services; the affiliated entities only process the requests assigned to them, following the instructions of CESGA and CSIC and without using them for their own purposes. You can request the summary of the agreement at rgpd@cesga.es.
Scope
What we collect
Only what you type into a form. There is no other collection on this site.
Register Your Interest
Name and email, which are required; phone, organisation, type of organisation and country, which are optional; and whatever you write about your needs.
Your case
A registration becomes a case: a reference, the step it has reached, and what the team writes at each step. We generate a random address for it and email you the link.
Contact form
Name, email, the type of inquiry and your message. Organisation is optional.
Technical record
The date and time of submission and of acceptance of the data protection information.
We do not store your IP address or browser with submissions. The abuse limit that stops a form being submitted repeatedly compares addresses in memory only and keeps no record of them. The server keeps technical access logs (IP address, date, page, browser) for security, separate from the forms.
Do not send health data, patient data or other special categories of data. These forms are not a suitable environment for them; if we receive them, we will delete them.
Purpose and legal basis
Why we hold it, and on what basis
Each purpose has its own legal basis.
- To answer your inquiry or request and pass it on to the competent partner Steps taken at your request prior to entering into an agreement (Art. 6(1)(b) GDPR); public-interest mission of CESGA and CSIC (Art. 6(1)(e) GDPR).
- To study your case, propose services to you and keep you informed of its progress The same as the previous purpose.
- To prioritise which services the factory opens (aggregate analysis) Public-interest mission of CESGA and CSIC (Art. 6(1)(e) GDPR).
- To report to the funder (EuroHPC JU) and disseminate the project Only aggregated and anonymised data.
- Security of the site (server logs) Public-interest mission, in relation to the security of the systems (Art. 6(1)(e) GDPR).
We do not take automated decisions or build profiles.
Recipients
Who has access
The staff of the entity designated to triage requests.
The staff of CSIC or of the affiliated entity that has to handle your request, according to its area: CSIC (data services), USC (AI development), UDC (One Health services), UVigo (training), DATAlife (innovation, ethics and exploitation), Gradiant (cybersecurity and trustworthy AI). The affiliated entities act as data processors.
Nobody outside the consortium, except where required by law (authorities, courts, the Spanish Court of Auditors, the funder's audits).
We do not sell your data or use it for advertising. It is not transferred outside the EU.
Retention
How long we keep it
Each kind of data has its own period, and is deleted when it ends.
- Contact form inquiries12 months from the last communication
- Registration and case that does not lead to a serviceWhile the case is open, and 12 months from its closure
- Case that leads to a factory serviceUp to 5 years after payment of the final balance of the grant, because of the obligation to keep the project's documentation
- Server logs6 months
- Health or other special-category data sent by mistakeDeleted immediately (within one month at most)
When each period ends, the data is deleted. You can ask us to delete it sooner at any time — see your rights.
Your case
Following your registration
Registering your interest opens a case, and we email you a link to it. That link is the only way in, and it is how we keep you told.
The link contains a long random code. There is no account and no password: anyone who has the link can open the page, so treat it as you would a password, and do not post it anywhere public. If you forward it, the person you send it to sees the same page.
The page shows what you sent us, which of the five steps your case is on, and what the team has written at each step. We email you when it moves. Nothing on the page is visible to other people who registered, and the address is never indexed by search engines.
If you would rather we did not keep the case, tell us and we will delete it along with everything else we hold about you — see your rights.
Your rights
What you can ask us to do
Under the GDPR you can exercise all of the following, free of charge.
Access
Ask what we hold about you and get a copy of it.
Rectification
Have anything inaccurate or incomplete corrected.
Erasure
Have your data deleted — both the stored record and the emails.
Restriction
Have us hold the data but stop using it while a question is resolved.
Portability
Receive what you gave us in a structured, machine-readable format.
Objection
Object to processing based on our public-interest mission, on grounds relating to your situation.
Write to rgpd@cesga.es or contact CSIC: as they are joint controllers, you can exercise your rights against either of them (Art. 26(3) GDPR), and we will answer within one month.
If you believe we have not handled your data properly, you can complain to the Agencia Española de Protección de Datos; before that, if you wish, you can consult the DPO of CESGA (dpo@cesga.es) or of CSIC (delegadoprotecciondatos@csic.es).
The website
What this site does not do
We only use the lang cookie, to remember the language you choose. The site uses no tracking cookies, analytics, tracking pixels or advertising tags, and it loads nothing from a third party — no external fonts, no embedded players, no content delivery network. See the cookie policy.
Security
How it is protected
The data is hosted on CESGA infrastructure in Spain, encrypted in transit and with access restricted to the staff who need it. The partners apply the measures of the Spanish National Security Framework (ENS) or equivalent ones.
Data minimisation is deliberate rather than incidental: the fields are few, the optional ones are marked, the IP address and browser are discarded, and the deletion mechanism was built before there was anything to delete.
Changes
Changes to this policy
Last updated: 28 October 2026. If this policy changes materially, we will publish the new, dated version on this page. In case of discrepancy between language versions, the Spanish version prevails.
A question about your data?
Ask us directly. Requests to see, correct or delete what we hold are answered within one month.
