Introduction

The Urban Water Management and Hydroinformatics group (UWMH) is referred to in this Privacy Policy as “UWMH”, "we", "us" and "our". UWMH, with premises at National Technical University's Campus, might process personal data of its clients, collaborators and any other individual while providing its services or within the scope of its activities.

This Privacy Policy applies only to the collection and processing of personal data in relation to the website of the Digital Twin published by UWMH and accessible over the domain https://dt.uwmh.eu/ (hereinafter the "Website" or the "Digital Twin" or the "Attica's Region Digital Twin”). Other sites of UWMH, such as uwmh.civil.ntua.gr or any other subdomain of uwmh.civil.ntua.gr, are not related to this Privacy Policy.

In this Privacy Policy, we describe the types of personal data we may collect from you and how we collect, use, share, disclose and store it. We also explain your choices regarding our use and processing of your personal data. As used in this policy, "GDPR" means Regulation (EU) 679/2016 of the European Parliament and of the Council (General Data Protection Regulation). The collection and processing of personal data by UWMH is in compliance with the GDPR and Greek legislation.

Contact Information

UWMH acts asData Controller under the GDPR. If you have any questions about the processing of your personal data, you may contact the Data Controller by email at uwmh@hydro.ntua.gr

Personal data we collect and purposes for which it is used

The Digital Twin will collect and retain the following personal data:

• Your profile data, which includes your first name and surname, your email address, your picture, your organisation's affiliation and position within it. This information is collected upon your registration and is used in order to allocate access rights and privileges to the different solutions and services of the digital twin and to contact you when necessary (e.g. to send you newsletters).

Who has access to your personal data

Your personal data will be available to our employees and might be shared with our affiliates and with other contracted service providers to enable them to provide our services to you or technical operations, as well as to perform other activities described in this Privacy Policy. Other parties to whom we may disclose personal data include:

• Governmental authorities pursuant to applicable laws or court process, or as we reasonably deem necessary to prevent harm, financial loss, fraud or illegal activity
• The successor in interest to all or a portion of our business or assets, provided that should such a transfer occur, we will require such successor to agree in writing to use, protect, and maintain the security, integrity, and confidentiality of the transferred personal data in accordance with our Privacy Policy
• Others pursuant to consent obtained from you.

We do not sell, rent or trade any personal data and we do not disclose personal data to third parties for any purposes other than those mentioned in this Privacy Policy.

Contractors and service providers that process personal data on our behalf must sign contracts with us that conform to the requirements of GDPR Article 28(3) and other applicable laws. Examples of data processing services that may be done for us by contractors are the following:

• Hosting of the digital twin website
• Maintaining, improving, or expanding the digital twin's functionality
• Integrating new solutions, pilots or services
• Acquiring web analytics data.

Regarding statistical analyses, we may use third-party service providers to monitor and analyze the use of the digital twin. In particular, we may use Google Analytics, a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of a service. This data is shared with other Google services. Google may use the information gathered to contextualize and personalize ads on its own advertising network. For more information on the privacy practices of Google, please visit Google Privacy & Terms

Transfers of personal data

We ensure that your Personal Data will not be transferred to a third country or to an international organisation outside the European Union, unless you give us your prior consent for such a transfer.

Personal data retention criteria and time frames

We will retain your personal data for a period of time consistent with the original purpose of its collection. We may also retain your personal data during the period of time needed for us to pursue our legitimate business interests, conduct audits, comply with our legal obligations, resolve disputes and enforce our agreements. We may delete your personal data for purposes that we determine necessary in our reasonable discretion.

Security of data

The Digital Twin has been developed by adopting the "security by design and by default" approach. We use strong encryption to store sensitive data in the database and the transmission of personal data is protected by SSL encryption when it is exchanged between your web browser and the Digital Twin. Other reasonable precautions have been taken to secure your data and we maintain appropriate technical, administrative and physical safeguards to protect personal data received or collected by us. However, no method of transmission over the Internet or method of electronic storage is 100% secure. Even though we do our best to protect your personal information, we can't guarantee that it will be completely safe.

Cookies

The Digital Twin website only uses cookies that are necessary for securely carrying out the transmission of the communication with the server (e.g. for the identification of the session or to prevent cross-site request forgery). Other than the cookies mentioned above, UWMH does not store any cookies on your computer.

Children's privacy

The Digital Twin does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we will take steps to remove that information from the Digital Twin.

Rights available to you

As an individual whose personal data is gathered as part of the aforementioned services, you have, in principle, the following rights, to the extent that no legal exceptions are applicable in individual cases:

• The right to request access to personal data (GDPR Article 15)
• The right to rectification of personal data (GDPR Article 16)
• The right to be forgotten/right to erasure (GDPR Article 17)
• The right to restrict processing of your personal data (GDPR Article 18)
• The right to data portability (GDPR Article 20)
• The right to object to the processing of your personal data (GDPR Article 21)
• The right to lodge a complaint with a supervisory authority (GDPR Article 77)
• The right to withdraw your consent (GDPR Article 7 (3))

Changes to this Privacy Policy

UWMH may, from time to time, amend and/or complete this Privacy Policy in compliance with the applicable legal framework. The updated version will always be available on the website of the Digital Twin. This Privacy Policy was last updated on 1st March 2025.