Privacy policy
Last updated: 15 October 2026
This policy explains how the website of the Very High Energy Group for Astrophysics (VHEGA), including its member intranet, processes personal data, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Who we are and how to contact us
This website is developed and maintained by the VHEGA research group at the Instituto de Astrofísica de Andalucía (IAA-CSIC), Glorieta de la Astronomía s/n, 18008 Granada, Spain, under the domain provided by the institute. Personal data is handled in accordance with the data protection policy of the Consejo Superior de Investigaciones Científicas (CSIC).
- Questions about this website and your data: the VHEGA group, through the contact form.
- Data Protection Officer: delegadoprotecciondatos@csic.es or the DPO contact form.
What we process, why, and for how long
Contact form
Data: your name, email address, affiliation (optional) and message, and the members you choose to write to. Purpose: to deliver your message to those members so they can answer it. Legal basis: your consent when you send the message (GDPR art. 6.1.a). Retention: the message is not stored in the website's database; it is sent by email and removed from the sending queue as soon as it is delivered (or after 7 days if delivery fails). It stays in the recipients' mailboxes for as long as needed to handle your request.
Spam and abuse protection
To protect the contact form, the captcha and file uploads from abuse, we count requests per IP address. These counters expire after at most one hour. The captcha (ALTCHA) runs on our own server: it does not use cookies or third-party services. Legal basis: our legitimate interest in keeping the website secure (art. 6.1.f GDPR).
Member profiles
The public pages show the name, role and research topics of group members, and their publications and theses. Members choose in their intranet profile whether to show their profile, photo, biography, email address, ORCID and social links, and whether to appear in the contact form. New accounts start with all of these hidden. Legal basis: our legitimate interest in presenting the group and its scientific work (art. 6.1.f GDPR) for name, role and publications; consent (art. 6.1.a) for the optional information, which can be withdrawn at any time from the profile page. Retention: while the person is a member. Profiles of former members may remain as part of the group's history unless they ask us to hide or delete them.
Intranet accounts
Members sign in through the group's own single sign-on service (Authentik). We store the account identifier, username, email address and group membership, and the content members create (meeting minutes, notes, files, QR codes). Legal basis: our legitimate interest in organising the group's work (art. 6.1.f GDPR). Retention: while the person is a member of the group.
Meeting minutes newsletter
Members can choose to receive meeting minutes by email. Legal basis: consent (art. 6.1.a GDPR). You can unsubscribe at any time in your intranet profile; every newsletter links to it.
QR codes
When someone scans a QR code created on this site, we record the date and time, the approximate country and city derived from the IP address, and the browser and operating system. The IP address itself is not stored and the record is not linked to any person. Legal basis: our legitimate interest in knowing the reach of our outreach material (art. 6.1.f GDPR).
Publications
We retrieve public bibliographic records of the group's publications from the NASA Astrophysics Data System (ADS), using members' names and ORCID identifiers. Public publication metadata may also be analysed with an external automated text-classification service to decide whether a paper belongs to the group.
Security logs and backups
The servers keep technical logs for a limited time for security and troubleshooting. The database is backed up daily; backups are kept for up to 12 months on the group's storage at IAA-CSIC.
Who receives the data
- The group members you write to through the contact form.
- Google, whose Gmail service delivers the website's emails. Google may process data in the United States under the EU-U.S. Data Privacy Framework.
- Your browser loads map tiles from CARTO in the intranet QR statistics, and profile pictures hosted on other websites if a member chose one. Those providers receive your IP address.
- Public authorities, when required by law.
We do not sell personal data or use it for advertising or profiling.
Cookies
This website only uses cookies that are strictly necessary for signing in to the intranet. They are exempt from consent (art. 22.2 of Spanish Law 34/2002, LSSI), which is why there is no cookie banner. We do not use analytics, advertising or third-party cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| __Secure-next-auth.session-token | Keeps you signed in to the intranet | 7 days, renewed while you use the site |
| __Host-next-auth.csrf-token | Protects the sign-in process against cross-site request forgery | Browser session |
| __Secure-next-auth.callback-url | Remembers which page to return to after signing in | Browser session |
The single sign-on service sets its own technical cookies on its domain when you sign in. You can delete cookies in your browser settings; you will then need to sign in again.
Your rights
You can request access to, rectification or erasure of your data, restriction of or objection to its processing, and data portability, and withdraw any consent you gave. Members can change most of their data directly in their intranet profile. To exercise your rights, write to us through the contact form or contact the Data Protection Officer (delegadoprotecciondatos@csic.es). If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
See also the legal notice and the accessibility statement.