Privacy Policy

Introduction

Subalta ("we", "our" or "us") is committed to protecting your privacy and personal data that we obtain from or about you. This privacy notice explains how we process information obtained from or about you when you use our websites, applications, platforms and associated services (collectively "Services"), and how you can exercise your rights.

Subalta SRL, domiciled at Rue de Belle-Vue 18, 1480 Tubize, Belgium, under company number BE 1004.905.845, is the data controller for your personal data. You can contact us by email at contact@subalta.com or by post at the address mentioned above.

Personal data we collect

We collect different types of personal data through different methods in order to provide, improve and secure our Services.

Data you provide directly

We collect information you provide directly when you create an account, communicate with us, or identify yourself as a representative of an organisation. This includes:

Account information

When you create an account, we collect information associated with it, including your name, contact details, account authentication information, subscription status, and transaction history. You sign in with your email address and a one-time code sent to that address; Subalta does not ask you to create a password. Subscriptions are currently invoiced, and Subalta does not collect payment card details.

Communication information

If you communicate with us (e.g. by email, social media, or support channels), we collect personal data including your name, contact details, and message content. These data help us respond to queries, resolve issues, and improve our Services.

Other information you provide

We may collect additional information that you choose to provide when you contact us, participate in a survey, or request support. We use this information to respond to you and operate the Services.

Data resulting from your use of our Services

We automatically collect certain types of personal data when you interact with our Services. This helps us ensure the platform works correctly and allows us to improve our Services. The categories of data we collect are:

Cookies and similar technologies: We use cookies and similar technologies to manage and administer our Services and improve your experience. You can manage your cookie preferences. For more details, please see our cookie policy.

Usage data: We may record pages you open and the features you use to monitor functionality and identify areas for improvement.

Content provided to the platform: Subalta starts from public information and asks you only for what it needs to tailor results to your work. When you add information, such as organisation details, consortium briefs, partner shortlists or notes, this content may contain personal data. We process it solely to provide the requested Services, and it is not used to improve our Services. Your projects and their content stay in your own workspace and are not visible to other users. Some organisation information, once validated, is shared with the other users of the same organisation. Within Subalta, access is limited to the people who operate and support the Services.

Organisation information

To provide our Services, we collect organisation and professional information from previous funding-call publications, project results, official registers, government databases, websites, search engine results, other publicly accessible online sources, and specialist data providers.

While we focus on company-related information such as names, addresses, registration numbers, financial data, sector classifications, or similar details, it is possible that some private or personal data may appear in these collected datasets.

Subalta does not contact the people whose professional information appears in these sources. Most of this information comes from public research and funding records without contact details, and informing each person individually would involve disproportionate effort (Article 14(5)(b) GDPR). This privacy policy is our notice to them: it describes the sources, purposes, legal basis and rights that apply. Anyone can ask us at contact@subalta.com which information we hold about them, have it corrected or deleted, or object to its use.

Where relevant to a professional collaboration request, this may include professional roles and business contact details. We use this information solely to provide organisation discovery, consortium recommendations and collaboration workflows, not to sell personal data or market third-party products.

This data remains secure and is used in strict compliance with this privacy policy and applicable data protection laws. Please contact us if you believe that organisation data contains personal information requiring further review or specific action.

Information from additional sources

We may receive professional information from data providers and other partners to enrich organisation profiles, identify relevant collaboration contacts, ensure security, prevent fraud or abuse, and improve Service delivery.

How we use personal data

We use personal data for the following purposes:

Provide, operate, and maintain our Services: This includes responding to user requests, providing core features, and ensuring operational reliability.

Improve and develop our Services: We analyse data to improve our platform, create new features, and drive innovation.

Communicate with you: We send updates, announcements, and information about our Services, including platform changes and improvements.

Prevent fraud and ensure security: We monitor and process data to prevent fraudulent activities and protect our Services and systems.

Meet legal obligations: We use data to comply with regulatory requirements and protect the rights, privacy, safety, and property of users, our company, and third parties.

Disclosure of personal data

We may disclose personal data to third parties in compliance with applicable laws. Below are the categories of third parties with whom we may share personal data and the reasons for disclosure:

Vendors and service providers

To support and ensure the effectiveness of our Services, we may disclose personal data to trusted vendors and service providers who assist with hosting, data storage, IT infrastructure, artificial intelligence services, customer support, payment processing, analytics, and other business operations. These parties process personal data only according to our instructions and for the purposes specified in this policy.

Business transfers

If Subalta is involved in a merger, acquisition, reorganisation, bankruptcy, or other transaction involving the transfer of business assets, personal data may be disclosed to the relevant parties during due diligence and transferred to the successor entity as part of the transaction. We will ensure that any shared data continues to be protected in accordance with this privacy policy.

Legal compliance and rights protection

We may disclose personal data to government authorities, regulators, or other third parties where required by law or where we believe disclosure is necessary to: comply with applicable legal or regulatory obligations; protect our rights, property, or safety, and those of our users, employees, or the public; detect, investigate, and prevent fraud, security breaches, or other illegal activities; respond to legal claims or disputes, or enforce our terms of use or other policies.

Third-party integrations and links

Our Services may include integrations or links to third-party websites, applications, or services. By interacting with these third parties, you may share data directly with them, subject to their privacy policies. We encourage you to review the privacy practices of any third-party services you access. Inclusion of links or integrations does not imply our endorsement of or responsibility for those services.

We do not sell or rent personal data to third parties for marketing. All disclosures are made to meet legitimate business needs, ensure the safety and security of our users, or comply with legal obligations. Where applicable law requires, we ensure appropriate safeguards are in place for any transfer of personal data, particularly when transfers occur outside the European Economic Area (EEA).

Retention periods

We retain your personal data for as long as necessary to provide our Services, fulfil our contractual obligations, and meet legitimate business needs, including resolving disputes, ensuring safety and security, and complying with legal requirements. Retention depends on factors such as:

Your relationship with us: We retain data while your account is active or as necessary to provide our Services.

Purpose of collection: Data is only retained until it has fulfilled its specific function.

Legal and regulatory obligations: Certain information must be retained to comply with laws or resolve disputes.

Potential risks: We assess the sensitivity of data and potential risks of unauthorised use or disclosure.

When personal data is no longer required, we delete it, anonymise it, or securely store it until deletion is possible. Specifically, we retain:

Account, communication, service-usage, and billing records are retained only for the period needed for the purpose for which they were collected, subject to applicable legal, accounting, tax, and dispute-resolution obligations.

Uploaded content for as long as your account or your organisation's account is active.

Public website statistics: daily totals, kept for 13 months.

Professional information from public sources: up to 24 months after we last collected it.

Your rights

As a user of Subalta's Services, you have the following rights regarding your personal data under applicable data protection laws:

Access your personal data: You have the right to request access to the personal data we hold about you and information about how it is processed.

Rectify or update your personal data: If any of your personal data is inaccurate or out of date, you can ask us to correct or update it.

Delete your personal data: You can ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected, or if you withdraw your consent (where applicable).

Restrict how we process your personal data: You can request a restriction on processing in certain circumstances, such as while a dispute about the accuracy or lawfulness of your data use is resolved.

Transfer your personal data (data portability): You can ask us to provide your data in a structured, commonly used, machine-readable format for transfer to another organisation.

Withdraw your consent: Where we rely on your consent to process personal data, you have the right to withdraw it at any time. You can withdraw website analytics consent through our Cookie Policy and contact us at contact@subalta.com for other consent-based processing. This does not affect the lawfulness of processing carried out before withdrawal.

Object to processing: You may object at any time to the processing of your personal data for direct marketing purposes. If you object to processing based on legitimate interests, we will evaluate your objection and balance it against our legitimate grounds for processing.

Lodge a complaint: If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Belgian Data Protection Authority or your local supervisory authority within the EEA.

How to exercise your rights

To exercise any of these rights, contact us at contact@subalta.com or through your user account where applicable. You can also ask us to export or delete your account data at contact@subalta.com. For security reasons, we may request additional documents to verify your identity before processing your request.

We will respond without undue delay and in any event within one month of receiving a valid request. Where necessary because of the complexity or number of requests, this period may be extended by two further months. We will inform you of any extension and the reasons for it within one month of receiving your request.

Security

We are committed to protecting your personal data. We implement commercially reasonable technical, administrative, and organisational measures designed to protect personal data against loss, misuse, and unauthorised access, disclosure, alteration, or destruction.

While we strive to secure your data, no system, network, or transmission method is entirely safe. You should therefore exercise care when deciding what information you provide to our Services. We are also not responsible for circumvention of privacy settings or security measures in the Service or on third-party websites.

These measures include encryption of data in transit and access restricted to the people who need it to operate and support the Services.

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk. Where a breach is likely to result in a high risk, we also notify affected individuals without undue delay.

If you have concerns about the security of your personal data, contact us at contact@subalta.com. We are committed to addressing any potential security issues promptly. If you detect suspicious activity, inform us immediately.

Legal bases for processing

Providing the Services and managing accounts: We process account details, organisation representatives, service content, subscriptions, billing information, and support requests because this is necessary to enter into or perform our contract with you under Article 6(1)(b) GDPR.

Organisation discovery and consortium recommendations: We process relevant professional information from public organisation sources, previous funding-call publications and specialist data providers to build organisation profiles, identify potential consortium partners, and support collaboration. We rely on our legitimate interests in operating and improving a professional collaboration service under Article 6(1)(f) GDPR, after balancing those interests against the rights and reasonable expectations of the people concerned.

Security, fraud prevention, and service integrity: We process account, device, log, and usage information where necessary for our legitimate interests in protecting users, organisations, and the Services under Article 6(1)(f) GDPR.

Product improvement: We analyse limited service usage and feedback to understand performance and improve features based on our legitimate interests in maintaining and developing the Services under Article 6(1)(f) GDPR. Optional analytics on the public website are treated separately and require consent.

Public website statistics: Our server counts the pages of subalta.com it delivers, errors, response times and the volume of data served. To do so, it reads the address requested and reduces it, as it answers, to one of our public pages or to a type of resource. These statistics contain no IP address, browser details, full address, visitor identifier or individual browsing history; they are daily totals, kept for 13 months. We rely on our legitimate interest in keeping the website working and knowing which pages are used (Article 6(1)(f) GDPR). They are separate from the logs mentioned under "Security, fraud prevention, and service integrity", and work whether or not you allow optional analytics.

Service communications: We use contact details to send operational messages and respond to requests where necessary to perform our contract under Article 6(1)(b) GDPR. Where we send permitted business communications about Subalta, we rely on our legitimate interests under Article 6(1)(f) GDPR and provide a way to object or opt out.

Legal and regulatory compliance: We process and retain information where necessary to comply with accounting, tax, regulatory, court, or other legal obligations under Article 6(1)(c) GDPR.

Optional website analytics: We use Google Analytics only after you consent, under Article 6(1)(a) GDPR. You can withdraw that consent at any time through our Cookie Policy. Withdrawal does not affect processing carried out before withdrawal.

Where we rely on legitimate interests, you may object to the processing. We assess objections case by case by balancing your rights and freedoms against any compelling legitimate grounds for continuing the processing.

Data transfers

Subalta's application and its databases are hosted on servers in the European Union. Some of our service providers, such as Google for optional website analytics, may process personal data outside the European Economic Area (EEA), including in the United States. We apply the protections described in this privacy policy regardless of where your data is processed.

When transferring personal data outside the EEA:

We rely on adequacy decisions issued by the European Commission under Article 45(1) GDPR for jurisdictions considered to offer adequate levels of protection.

For transfers to jurisdictions without adequacy decisions, such as the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR and the UK data transfer addendum to ensure compliance.

Transfers to non-EEA jurisdictions are limited to the purposes necessary for Service delivery and are retained only to the extent necessary to achieve those purposes.

For more information on the transfer mechanisms we use, contact us at contact@subalta.com.

Children's privacy

The Services are intended only for users aged 18 or older. Minors are not permitted to register for or use the Services, including with parental or guardian consent. If we learn that a user under 18 has provided personal data through the Services, we will take appropriate steps to disable the account and delete the data, subject to any legal retention obligation.

If you believe we have inadvertently collected data about a child under 18, please contact us at contact@subalta.com and we will resolve the matter promptly.

Privacy policy updates

We may update this privacy notice to reflect changes in our practices, legal obligations, or operational requirements. When we make updates, we publish the revised notice with a new "last updated" date and provide additional notice where required by law.

Contact us

For any question or concern not already addressed in this privacy policy, contact us at contact@subalta.com or write to us at our registered office: Rue de Belle-Vue 18, 1480, Tubize, Belgium.