Skip to main content

XR Sense

Menu
Linkedin Youtube

Privacy Policy

LAST UPDATED 24/08/26

Thank you for visiting the XR-SENSE website.

Who we are

XR-SENSE (hereinafter referred to as “XR-SENSE”, “we”, or “our”) is a research project funded by the European Union (“EU”) under Horizon Europe Call HORIZON-CL4-2025-03-HUMAN-14: Core technologies for virtual worlds (RIA). The project is coordinated by the University of Patras (Panepistimio Patron, UPAT), leading a consortium of 18 academic, research, and industrial partners across Europe and South Korea. More information of the XR-SENSE consortium members can be found here.

The overall responsibility for the processing activities described in this privacy policy is with the University of Patras (UPAT). UPAT acts in the capacity of data controller:

University of Patras (UPAT)

7QQP+M4 Panepistimioupoli Patron, Greece

+30 261 099 6683

For further information or data protection inquiries, we can be contacted at: xrsense.project@gmail.com.

Scope of this Privacy Policy

This privacy policy concerns the processing of personal data resulting from the operation of the official XR-SENSE project website. It aims to inform website visitors, consortium partners, and stakeholders about how we collect, process, and protect personal data. It covers both the personal data you provide directly through our website (e.g. by filling in the contact form) or through contacting us via e-mail, phone or social media and the data collected automatically during your visit (e.g. analytics on our website).

This privacy policy does not cover the processing of personal data of pilot/trial participants, who receive a separate, dedicated privacy notice and consent form before taking part in the research activities.

We are fully committed to processing personal data responsibly, securely, and proportionally in strict compliance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).

How We Collect Your Personal Data

We collect personal data directly and indirectly from individuals:

  • Directly: We obtain personal data directly from you when you subscribe to our project newsletter, fill out contact forms, register for workshops or pilot demonstrations, submit inquiries or interact with us via e-mail, phone or social media.
  • Indirectly: We obtain personal data indirectly to analyse website traffic, optimize system functionality, and improve user engagement. This data is collected and analysed through privacy-compliant analytics plugins (e.g., Matomo Analytics), which process aggregated statistical information.

What personal data do we process and why?

When you use our website, social media or communicate with us via phone, e-mail, fax or any other digital communication channel, we will collect and use your personal data to:

  1. allow for the communication between you and us, for which we rely on our legitimate interest to be able to respond to requests, questions or remarks or to contact you proactively for inquiries of whatever kind (e.g. when you respond to a blog or publication, use our contact form or contact us via social media, phone, e-mail or fax);
  2. improve the website’s and social media pages’ content and the overall experience, for which we rely on our own legitimate interest to offer our visitors an interesting online space;
  3. detect and prevent malware, illegal content and behaviour and other types of misuse, for which we rely on our legitimate interest to keep our online presence safe.

To achieve the above-mentioned purposes, we process the following personal data:

  • Contact & Professional Details, such as name, organizational affiliation, job title, role/function, and email address;
  • The content of your communication and the technical details of the communication itself (with whom you correspond at our end, date and time, etc.);
  • Technical information associated with the device you use, such as your IP address, browser type, session activity, visitor profiles, and approximate geolocation data and operating system;
  • Any other personal data you choose to provide to us.

When you register for our online newsletter, we will collect and use your personal data to send you our newsletter and other electronic communication. We will always ask for your explicit consent before sending you our newsletter. You will always have the opportunity to unsubscribe from our newsletter. To send you our newsletter, we only process basic identity information, i.e. your name and e-mail address.

In the process of the project activities, we will as a consortium organize events, workshops and stakeholder engagements. In case you are invited for such an engagement we will only process basic identity information to send you such invite and to give you additional information. We process this data in pursuit of our legitimate interest in fulfilling the project’s stakeholder engagement and the dissemination obligations under our Horizon Europe grant agreement.

Additionally, we will also process your personal data

  1. To comply with legal obligations or to comply as far as we are legally required to, with any reasonable request from competent law enforcement agents or representatives, judicial authorities, governmental agencies or bodies;
  2. To fulfill any reporting requirements mandated by the European Commission (EC) and to disseminate research outcomes to public, scientific, and industrial audiences as required by our grant agreement. We rely on our legitimate interest to fulfil our contractual obligations.

How We Secure Your Personal Data

We maintain robust technical and organizational security measures to protect your personal data against loss, misuse, unauthorized access, alteration, or destruction. Access to project databases is restricted strictly to authorized personnel bound by confidentiality agreements. Data stored within central project repositories is password-protected and encrypted. Security software and anti-virus systems are regularly updated.

Do We Share Personal Data with Third Parties?

Your personal data will in principle only be shared with the consortium partners who treat project data as strictly confidential and are bound by legal or contractual confidentiality obligations.

We may share limited personal data with trusted service providers acting as data processors bound by strict data-processing agreements (art. 28 GDPR), including:

  • Cloud hosting and collaborative tools (e.g., Nextcloud, Microsoft SharePoint).
  • Web analytics and communication platforms (e.g., Matomo Analytics, newsletter distribution services).
  • The European Commission (EC) and its auditing bodies as required by Horizon Europe reporting framework regulations.
  • Other governmental or judicial authorities insofar as we are required to send them your personal data (e.g. tax authority, police or law enforcement);

We will ensure that your personal data are processed and stored in the European Economic Area (EEA) or in countries that provide an equivalent level of protection. We may share your personal data with XR-SENSE partners situated outside the EEA (such as South-Korea). If a transfer would take place, we will take adequate safeguards to protect your personal data when transferred (e.g. by relying on the adequacy decision for South-Korea or by putting in place standard contractual clauses as drafted by the EC).

How Long Do We Retain Your Data?

We retain personal data only for as long as necessary to fulfill the purposes described above or, when asked for your consent, up until the time where you withdraw your consent.

  • All personal data collected through our interactions with you via the website, social media or e-mail  will be kept for as long as required to communicated with you, but we also keep an historical archive of our communications which is retained for up to 12 months following the formal conclusion of the XR-SENSE project.
  • All personal data we collect to send you our newsletter will be kept for as long as you remain subscribed to our mailing list, and after formal conclusion of the XR-SENSE project for up to 12 months.
  • All personal data related to your participation in events, workshops and stakeholder engagements will be kept for a period of up to 5 years after formal conclusion of the XR-SENSE project for auditing reasons.
  • In accordance with Horizon Europe financial and administrative regulations, technical records, attendance sheets, and documentation required for auditing by the European Commission will be retained for up to 5 years post-project closure.

Upon expiration of the retention period, personal data will be securely deleted or anonymized.

Cookies

Cookies are small text files placed on your device to ensure proper website functionality and improve user experience. The XR-SENSE website uses essential functional cookies and privacy-friendly analytics cookies. You can adjust your browser settings to reject or delete cookies; however, doing so may impact certain functionalities of our website. For more details, please review our Cookie Policy.

Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data, which you can exercise at any time by contacting us at xrsense.project@gmail.com.

  • Right to Withdraw Consent (Art. 7(3) GDPR): you can withdraw your consent for newsletters or communications at any time. You can unsubscribe at any time using the link included in every newsletter e-mail.
  • Right of Access (Art. 15 GDPR): you can ask us to provide you information regarding the personal data we have about you. You can even ask for a copy of your personal data. However, note that you must specify for which processing activities you would like to have access to your personal data. If you make the same request repeatedly, clearly causing us nuisance, we are allowed to refuse granting you these subsequent requests or charge an administrative fee covering the expenses. We can also refuse granting you a right to access your personal data, or only grant it partially, if such access would risk disproportional detriment to the rights and freedoms of others, including one of the consortium partners.
  • Right to Rectification (Art. 16 GDPR) & Erasure (Art. 17 GDPR): You can request the correction of inaccurate, incomplete or outdated data. You can request the deletion of personal data that is no longer necessary for the purposes mentioned above, or if the collection was illegitimate in the first place or if you have successfully exercised your right to withdraw your consent or your right to object to the processing of your personal data.
  • Right to Restriction of Processing (Art. 18 GDPR): You can request that we restrict the processing of your personal data:
    • during the time we are assessing your request for rectification;
    • during the time we are assessing your objection to the processing of your personal data;
    • when such processing was unlawful but you prefer restriction to erasure;
    • we no longer need your personal data, but you require them for the establishment, exercise or defence of a legal claim.
  • Right to Data Portability (Art. 20 GDPR): When we have collected your personal data on the basis of your consent or because they were necessary for the execution or the performance of an agreement with you, you have the right to obtain a copy from us in a structured, commonly used and machine-readable format. However, this right only applies to personal data you have provided to us.
  • Right to Object (Art. 21 GDPR): When we process your personal data on the basis of our own interests, i.e. you have not given us your consent and we do not need them for the execution or performance of an agreement nor to comply with legal obligations, you have the right to oppose our processing of your personal data. When our interest relates to direct marketing, we will grant you your request immediately. For other interests, e.g. our security interests, we will ask you to describe your specific circumstances giving rise to request. We then need to balance your circumstances against our interests. If this balancing exercise results in your circumstances outweighing our interests, we will cease processing your personal data. 
  • Automated decision-making (art. 22 GDPR): we do not use your personal data for any form of automated decision-making including profiling, that produces legal or similarly significant effects on you.

If you would like to exercise any of these rights, we ask you to send us an e-mail. You can reach us at xrsense.project@gmail.com. If you have any complaint regarding the processing of your data by UPAT or the project consortium, please first contact us through the e-mail address mentioned above. If you remain unsatisfied with our response, you have a right to lodge a complaint (Art. 77 GDPR) with the supervisory authority of your own country of residence or employment. The list of the European data protection authorities is available on the website of the European Data Protection Board (https://www.edpb.europa.eu/about-edpb/our-members_en).  In Greece (where the project is coordinated), you can contact the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

Third-party websites

Our website may contain links to or the ability for you to access third-party websites, including consortium partners, social media channels, and scientific repositories. This privacy policy applies solely to the XR-SENSE website. We are not responsible for the privacy practices employed by those third parties, nor are we responsible for the information or content their websites contain. We encourage you to read the privacy policies of any external sites you visit.

Updates to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changing technical, operational, or legal requirements. Any modifications will be posted directly on this page with an updated revision date. Where a change materially affects how we use your data, we will also notify you directly by e-mail.