Privacy Notice

Last updated: 7 October 2026

This Privacy Notice explains how personal data submitted through the ECHOES / PLAY-CLOUD Consultation questionnaire are processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).

This notice specifically concerns the information submitted through the PLAY-CLOUD questionnaire. Data relating to the ordinary use of the mdbr.it website, such as technical logs and cookies, are governed separately by the privacy and cookie policies of Museo dei Bambini S.C.S. you could find here: https://mdbr.it/privacy-policy/ | https://mdbr.it/cookie-policy/

1. Data Controller

The Data Controller for the personal data collected through the PLAY-CLOUD Consultation is:

Hands On! International Association of Children in Museums
Friedrichgasse 34
A-8010 Graz
Austria
Email: secretariat@hands-on-international.net

Hands On! coordinates the PLAY-CLOUD project and determines the purposes for which the personal data collected through this consultation are processed.

2. Technical hosting and data processing

The questionnaire is hosted on the website of:

Museo dei Bambini S.C.S.
Via Flaminia 80/86
00196 Rome
Italy

Museo dei Bambini S.C.S. provides the technical infrastructure required to host the questionnaire and the database used to store the submitted data and acts, for these activities, on behalf of the Data Controller.

The survey database is hosted on servers located in Alblasserdam, the Netherlands, within the European Union.

Access to the database is restricted to authorised personnel and technical administrators who require access for the operation, security and analysis of the consultation.

3. What data do we collect?

The questionnaire collects information concerning the participant’s professional and institutional context and responses relating to cultural heritage, digital practices, technologies, educational practices, professional needs and opinions.

Depending on the answers provided, this information may include, for example:

• age group;
• gender identification;
• level of education;
• country or geographical area;
• institution or organisation;
• professional status and role;
• professional fields and areas of expertise;
• information about the participant’s professional practices, use of technology and training needs;
• opinions and responses provided through open-text questions.

The questionnaire does not require participants to provide their name or surname.

Participants are requested not to include sensitive personal information or personal data concerning third parties in open-text answers unless strictly necessary.

An email address may be provided voluntarily if the participant wishes:

1. to receive the results of the PLAY-CLOUD Consultation; and/or
2. to be contacted about the possibility of participating voluntarily in a follow-up interview related to the PLAY-CLOUD project.

Providing an email address is not required in order to participate in or complete the questionnaire.

4. Purposes of the processing

Questionnaire responses are processed for the following purposes:

• conducting and analysing the ECHOES / PLAY-CLOUD Consultation;
• understanding the needs, practices and challenges of professionals working in Cultural Heritage Institutions;
• mapping digital, technological and educational practices;
• identifying training and capacity-building needs;
• informing the design and development of the PLAY-CLOUD training programme;
• producing aggregated statistics, reports and research outputs relating to the project.

The optional email address is processed exclusively for the purposes separately selected by the participant:

• sending the results of the consultation; and/or
• inviting the participant to take part in a voluntary follow-up interview.

Email addresses will not be used for newsletters, marketing communications or unrelated ECHOES activities unless separate consent is obtained.

Participation in a follow-up interview will be entirely voluntary. If additional personal data are collected during an interview, participants will receive appropriate information about that processing before the interview takes place.

5. Legal basis

Participation in the PLAY-CLOUD Consultation is voluntary.

The processing of personal data submitted through the questionnaire is based on the participant’s consent pursuant to Article 6(1)(a) GDPR.

The processing of the optional email address for receiving survey results or being contacted about a follow-up interview is also based on consent.

These optional purposes are independent from participation in the questionnaire and refusing to provide an email address will have no effect on the participant’s ability to submit the questionnaire.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Who may access the data?

Personal data may be accessed only by persons authorised to process the information for the purposes of the PLAY-CLOUD Consultation, including:

• authorised personnel acting on behalf of the Data Controller;
• authorised technical personnel of Museo dei Bambini S.C.S. where access is necessary for hosting, database administration, security or technical support;
• technical service providers involved in hosting the infrastructure, where necessary and subject to appropriate data-protection obligations.

Personal data collected through the questionnaire will not be made publicly available.

Personal data will not be sold or used for commercial purposes.

Reports, publications, presentations and other outputs resulting from the consultation will contain only aggregated and/or anonymised information so that individual participants cannot reasonably be identified.

7. Data storage and retention

Personal data collected through the questionnaire will be stored for a maximum period of 120 days from collection, during which the information may be processed and analysed for the purposes of the PLAY-CLOUD Consultation.

At the end of this period, personal data contained in the survey database will be deleted or irreversibly anonymised.

Optional email addresses will also be deleted once the purposes for which they were provided have been fulfilled and, in any event, no later than 90 days after collection.

Aggregated statistics, reports and genuinely anonymised research outputs may be retained beyond this period because they no longer constitute personal data under the GDPR.

8. Location of processing and international transfers

The PLAY-CLOUD survey database is hosted on servers located in the Netherlands, within the European Union.

No transfer of the PLAY-CLOUD survey database outside the European Economic Area is planned for this processing.

Should a transfer outside the European Economic Area become necessary, it will take place only in accordance with the requirements of Chapter V of the GDPR and with the appropriate safeguards required by applicable data-protection law.

9. Automated decision-making and profiling

The personal data collected through this consultation will not be used for automated decision-making or profiling producing legal or similarly significant effects on participants.

10. Your rights

Under the GDPR, and where applicable to the processing concerned, participants have the right to:

• request access to their personal data;
• request correction of inaccurate personal data;
• request deletion of their personal data;
• request restriction of processing;
• request data portability;
• withdraw consent at any time.

These rights may be exercised by contacting:

Hands On! International Association of Children in Museums
Email: secretariat@hands-on-international.net

Once questionnaire data have been irreversibly anonymised and can no longer be related to an identifiable individual, they no longer constitute personal data and cannot be linked back to an individual participant.

Participants also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement.

11. Relationship with ECHOES

PLAY-CLOUD is implemented within the framework of the ECHOES – European Cloud for Heritage OpEn Science project.

This Privacy Notice provides specific information concerning the processing carried out through the PLAY-CLOUD Consultation questionnaire.

For further general information about data protection within the ECHOES project, participants may also consult the ECHOES Privacy Policy available in the Legal section of the ECHOES website.

12. Contact

For questions concerning this Privacy Notice or the processing of personal data through the PLAY-CLOUD Consultation, please contact:

Hands On! International Association of Children in Museums
Email: secretariat@hands-on-international.net