Privacy notice
Demonstration site: these texts are owner-reviewed for demonstration (28 October 2026) and are not a legal review.
How the Quantum Europe portal uses personal data, and the cookies it sets. Most of the portal can be read without an account and without giving any personal data.
Last updated .
1. Who is responsible
The portal is run by the Quantum Europe platform team. The data controller of this demonstration is the portal owner, Oscar Diez, who operates this demonstration in a personal capacity.
Owner-reviewed for demonstration, 28 October 2026. Not stated yet on this demonstration site: a postal address and the contact of a Data Protection Officer. They will be published on this page before any real launch.
Questions about your data: The portal has no public mailbox yet. Until one is published here, use the suggestion form (no account needed) or, if you have an account, the feedback form; both are explained under Contact on the About page.
2. In short
- The portal holds records about organisations, projects and documents from public sources. People appear in the expert directory, with professional information from public sources (section 4a), and on organisation pages as board members, managers or shareholders named in official business registers (section 4b); elsewhere the portal keeps no names of people from its sources and imports no contact details.
- There are no advertising or tracking cookies. Public pages load no third-party analytics, fonts, maps or videos.
- Your data is not sold and is not used for advertising, profiling or automated decisions about you.
- Features that are off by default (partner matchmaking, Ask the portal, the personal briefing and e-mail digests) keep no data about you unless they are switched on and you choose to use them.
3. What we keep, why and for how long
| Activity | What is kept | Why and on what basis | How long |
|---|---|---|---|
| Registration (Join) | The username and e-mail address you choose, your confirmation that we may store them, the option you choose (member, organisation member, Commission staff or Member State representative) with the organisation or Member State you name, and a one-way hash of the confirmation link (never the link itself). The account stays blocked until you open the link sent to your address. Once confirmed, only the domain of the address (for example example.org) is kept with the registration, so that an editor or authoriser can check the access you ask for. A counter limits requests to five per hour from one network address. | To confirm your address, set up the account and check the access you ask for: your consent and steps you ask for before an account exists (GDPR Article 6(1)(a) and (b)). | An unconfirmed registration and its blocked account are deleted after 7 days. The registration record is deleted 90 days after the account is active or the authoriser decided; the decision stays in the security record (12 months). The account itself is kept as described in the next row. |
| Account and sign-in | Username, e-mail address, the password in hashed form (never readable), your roles and organisation, the times of access, and the session cookie described below. | To give you the service you asked for and to keep it secure (Article 6(1)(b) and (f)). | While the account exists. Deleting an account also deletes its saved items, interests, saved briefings, newsletter and alert choices and matchmaking data. |
| Sign in with Google (optional, where offered) | The identifier Google gives the account, your verified e-mail address and the name in your Google profile (scopes openid, email and profile). Accounts are never linked by e-mail address alone. | To let you sign in without a separate password, at your request (Article 6(1)(b)). Google acts as a separate controller for its sign-in. | While the account exists. |
| Areas for Commission and Member State staff | The role an administrator approves for your account. Restricted tools are never cached or indexed, and their exports are rate-limited. | To give approved staff access to restricted working tools (Article 6(1)(b) and (f)). | While the role is assigned. |
| Security record (audit log) | Sign-ins (also failed ones), role and permission changes, exports and consents: the time, the account and its roles, and the network address shortened to its first three parts (IPv4) or first three blocks (IPv6). | To protect accounts and restricted data (Article 6(1)(f)). | 12 months. |
| Server and application logs | Technical data of requests and error messages, which can include network addresses. | To run the service securely and find faults (Article 6(1)(f)). | No retention period is set yet for web server and application logs; one will be set before any real launch. |
| Suggestions of additions and corrections | The kind of record, the official page, your description (e-mail addresses and phone numbers in it are removed), the time and, if you are signed in, your account number. An e-mail address only if you give one. No name or network address is kept with the suggestion; added records never show who sent them. | To check and apply corrections (Article 6(1)(f)); the e-mail address with your consent, only to tell you the outcome (Article 6(1)(a)). | The e-mail address until the outcome is known, at most 90 days. Suggestions that are not used: one year. Applied suggestions stay as the source of the change, without who sent them. |
| Feedback form (members) | The kind of feedback, its title and message, the page it is about and your account number, plus a short line in the application log. No name, e-mail address or network address is stored with it. | To fix problems and improve the portal (Article 6(1)(f)). | No deletion period is set yet for feedback; one will be set before any real launch. |
| Personal briefing (newsletter) | Only when the operator has switched the briefing on and you subscribe: your choices, the time and version of your consent, whether you want e-mail, the identifiers of your last 26 issues and a private feed token. Opens and clicks are not tracked. | Your consent (Article 6(1)(a)); you can unsubscribe at any time. | Until you unsubscribe or delete the account. |
| Alerts | The kinds of alert you choose, kept with your account. E-mail digests are off by default. | To show the alerts you asked for (Article 6(1)(b)). | Until you change them or delete the account. Public alert items: 90 days. |
| Saved items, interests and saved briefings | The pages you save (up to 100), the topics and countries you follow and the briefings you save (up to 20). | To provide My Quantum Europe at your request (Article 6(1)(b)). | Until you remove them or delete the account. |
| Partner matchmaking (off by default) | When it is switched on and you opt in: your matchmaking profile and the introductions you ask for or accept. The other member sees your e-mail address only after an accepted introduction. | Your consent (Article 6(1)(a)). | Profiles must be confirmed every 12 months and are deleted 24 months after the last confirmation; open requests expire after 30 days; closed requests are deleted after 12 months. |
| Ask the portal (off by default) | When it is switched on, for members only: your question, with e-mail addresses, phone numbers and identity or bank numbers removed, is sent without your name or account to the AI service described below. The question is not stored or logged by the portal. | To answer the question you ask (Article 6(1)(b)). | Not kept. |
| Usage statistics | Daily counts per page, with the kind of visitor (anonymous or a type of member account), the device class and where the visit came from, in broad classes. No network address, no account, no cookie and no session. The browser identification is read only to leave out robots and is not kept. Do Not Track and Global Privacy Control are respected. | To learn which pages are used and improve them (Article 6(1)(f)). | 13 months. |
| Analytics accounts | For approved analysts only: e-mail address, display name and access level are sent to the portal's own analytics server (Metabase), which runs on the same infrastructure. | To give analysts access to the aggregate dashboards (Article 6(1)(b)). | While the access level is assigned. |
| Backups | Copies of the database and files, which contain the data above. | To restore the service after a fault (Article 6(1)(f)). | No fixed retention period is set yet for backups; one will be set before any real launch. |
4a. Expert and contact directory
The expert directory lists researchers, principal investigators and official contacts active in quantum technology with a European affiliation, from public sources (OpenAlex, OpenAIRE, Wikidata, INSPIRE-HEP, Semantic Scholar, the ORCID Public API, official ERC and Commission lists, official grant and contact pages, the person’s own homepage at their organisation’s domain, free images on Wikimedia Commons). It shows professional information only. The basis is legitimate interest (Article 6(1)(f)). The data is not obtained from the people listed; the information notice for them (Article 14) explains the sources, who sees what, how long entries are kept and how to have an entry removed or corrected.
A work e-mail address, where the person made it public on ORCID or their own homepage at their organisation’s domain shows it, is shown only to signed-in EC and Member State staff and editors, for professional contact; it is never taken from papers, exported or searchable.
Owner-reviewed for demonstration, 28 October 2026. This section and the information notice describe what the directory does today. They are not a legal review: IE Legal and the Data Protection Officer review them before any real launch.
4b. Board members, managers and shareholders on organisation pages
Information for the people named, whose data was not obtained from them (Article 14). The "Ownership and control" section of an organisation page names the members of its management and supervisory bodies and, for signed-in EC and Member State staff only, the natural persons who hold its shares, as official business registers publish them: the Polish National Court Register (KRS API), the Register of Enterprises of Latvia (open data, CC0 1.0), the Brønnøysund Register Centre in Norway (NLOD 2.0), the Czech public register through ARES and, once its free API key is installed, the persons with significant control of Companies House in the United Kingdom.
Why and on what basis: to show who owns and directs the companies of the European quantum ecosystem, for EU and national policy work such as investment screening and supply-chain security. The basis is legitimate interest (Article 6(1)(f)); the assessment is published with the portal documentation (company intelligence, "Ownership and control").
- What is kept: the name, the role or body (for example "Member of the management board"), the appointment date where the register states it and, for shareholders, the share or nature of control as stated, each with the register, the date it was read and its licence.
- What is never kept: birth dates, identity numbers (such as the PESEL, which the KRS masks), addresses, nationality, titles, beneficial ownership data or any special category of data; no trait is inferred.
- Who sees what: board members and managers are public on the organisation page, which is not part of site search, exports, open data, statistics or AI prompts. Natural-person shareholders are shown only to signed-in EC and Member State staff, each view logged, and never exported.
- How long: each organisation is read again every 30 days; an entry no longer in the register disappears at the next read, and stored entries are deleted after 120 days without a successful read.
- Your rights: you can ask for access, correction or removal and object at any time with "Remove or correct a name" on the organisation page. A removal hides the name at once; once an editor confirms it, a hash of the name goes on the permanent suppression list shared with the expert directory, so the name is never stored or shown again. You can also complain to a data protection supervisory authority.
Owner-reviewed for demonstration, 28 October 2026. This section describes what the portal does today. It is not a legal review: IE Legal and the Data Protection Officer review it before any real launch.
4. Who receives data
- Microsoft Azure hosts the portal on a virtual machine in its West Europe region, as a processor.
- Google receives and returns sign-in data only if you choose to sign in with Google.
- OpenRouter, an AI routing service, and the model providers it uses receive public text from the portal's sources for labelled AI-assisted summaries, and the questions of Ask the portal when that is switched on. Only providers that declare they do not keep prompts are used. No account data is sent.
- An e-mail delivery service sends account messages. The provider for a public service is not named yet; it will be named here before any real launch.
- Administrators and editors see account data only as far as their role needs.
- Authorities may receive data where the law requires it.
5. Transfers outside the European Economic Area
The portal is hosted in the EU. Google and the AI services can process data outside the European Economic Area.
Owner-reviewed for demonstration, 28 October 2026. Not stated yet on this demonstration site: the safeguard that applies to each of these transfers.
6. Your rights
You can ask for access to your data, its correction or deletion, a restriction of its use and a copy to take elsewhere, and you can object to uses based on legitimate interest. Where we rely on your consent you can withdraw it at any time; this does not affect what was done before. Members can change their interests, newsletter and alert choices themselves in My Quantum Europe.
To use these rights: The portal has no public mailbox yet. Until one is published here, use the suggestion form (no account needed) or, if you have an account, the feedback form; both are explained under Contact on the About page. We aim to reply within one month.
You can also complain to a data protection supervisory authority, for example in the EU country where you live or work.
7. Security
Access depends on roles and is kept to what each role needs. Passwords are stored only in hashed form, session cookies cannot be read by scripts, account requests and forms are rate-limited, and the AI service key is kept outside the code and the database. The portal claims no security certification.
8. Cookies and storage in your browser
The portal sets only the cookies it needs to work. They need no consent, so no cookie banner is shown. If optional cookies are ever added, they will stay off until you accept them, and refusing will be as easy as accepting.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| SESS… or SSESS… (session cookie) | Keeps you signed in and protects forms. Only set when you sign in or send some forms; it cannot be read by scripts and is not sent with requests from other sites (HttpOnly, SameSite=Lax). | Until you sign out, or at most about 23 days (the Drupal default) | This portal |
| klaro | Would remember your choices in the consent tool. Only set if optional services are switched on; none are today. The tool is installed, but every optional service is off and it shows no dialog. | 180 days, if it is ever set | This portal |
If you choose to sign in with Google, you are taken to Google’s own sign-in page. Google sets its own cookies there, on google.com, under Google’s privacy policy; the portal does not set or read them. The portal receives only the identity data it needs to sign you in, listed in section 3.
A few pages keep small settings in your browser’s own storage (not cookies). They stay on your device and are never sent to the portal. Clearing your browser data removes them.
- Your opt-out from usage statistics, if you choose it, until you opt in again.
- Which Learn pages you have opened, to show your progress.
- Your plan in the PQC product navigator: the products, versions, uses and context you entered, until you clear it.
- The view you last chose on the technology taxonomy map, which opens again when you come back.
- That you closed the “Contribute to Quantum Europe” panel, so it stays closed.
- For the open browser tab only (session storage, removed when you close the tab): a flag so that a small greeting in the browser’s developer console is printed once.
You can delete or block cookies in your browser; without the session cookie you cannot sign in.
Owner-reviewed for demonstration, 28 October 2026. The approach of necessary cookies only, without a consent banner, is the owner’s decision for this demonstration site. It is not a legal review and is checked again before any real launch, and whenever an optional cookie is proposed.
9. Changes to this notice
Changes are published on this page with their date.