SAFE IN TOWN ONLINE LEARNING PLATFORM
PRIVACY POLICY & GDPR NOTICE
For Users of the Safe in Town Online Leaning Platform
The Safe in Town Project has received funding from the European Union's Justice Programme, CERV (2021-27), under Grant Agreement n°101195346. This document has been prepared in the Framework of the Safe in Town Project; however, it reflects the views of the authors only, and the European Commission cannot be held responsible for any use which may be made of the information contained therein.
1. Introduction and Scope
This Privacy Policy describes how personal data is collected, processed, stored, and protected in connection with the Safe in Town online learning platform (the 'Platform'), which is hosted on a Moodle Learning Management System (LMS). This Policy applies to all users of the Platform, including registered learners, trainers, administrators, and any other individuals whose personal data is processed in connection with the Platform.
The Safe in Town Platform is operated as part of a transnational project co-financed by the European Union under the CERV (Citizens, Equality, Rights and Values) Programme 2021-2027, Grant Agreement n°101195346. The Platform is designed to provide online training and educational resources on child safeguarding and violence prevention to professionals across EU Member States.
This Policy is issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, GDPR), and any applicable national implementing legislation of the EU Member States in which the Project operates.
2. Data Controller
The Data Controller responsible for the administration and operation of the Safe in Town Moodle Platform is:
Organisation: Defence for Children International Italy (DCI Italy)
Address: Piazza Don Andrea Gallo 5-6-7 R, 16124 Genova, Italy
Email: info@defenceforchildren.it
Tel: +39 010 0899050
Data protection contact: Caterina Parodi - childsafeguarding@defenceforchildren.it
The other project partner organisations (CESIS – Portugal, Defence for Children International Greece, Hope for Children – Cyprus) may process personal data only to the extent necessary for the legitimate purposes of the Safe in Town Project, in accordance with this Policy.
3. Legal Basis for Processing
The processing of personal data on the Safe in Town Platform is based on the following legal grounds, as established under Article 6 of the GDPR:
• Performance of a task carried out in the public interest (Art. 6(1)(e) GDPR), insofar as the Platform supports an EU-funded project aimed at combating violence against children and promoting child safeguarding.
• Legitimate interests pursued by the controller (Art. 6(1)(f) GDPR), for administering the learning platform, monitoring participation in training activities, and generating aggregated statistics for project reporting to the European Commission.
• Consent of the data subject (Art. 6(1)(a) GDPR), where users voluntarily register on the Platform and expressly agree to this Privacy Policy before creating an account.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR), where processing is required by applicable law or by the terms of the Grant Agreement.
Where special categories of personal data are processed, the additional conditions set out in Article 9 GDPR shall apply. The Platform is not designed to collect special categories of personal data and users are requested not to submit such data through the Platform.
4. Categories of Personal Data Collected
4.1 Registration Data
When a user registers on the Platform, the following personal data is collected:
• Full name
• Email address
• Username (chosen by the user)
• Country of residence or professional activity
• Professional role or sector (e.g., social worker, educator, law enforcement)
• Organisation or institution affiliation (optional)
4.2 Usage and Activity Data
During use of the Platform, the following data may be automatically collected and processed:
• Course enrolments and completion records
• Quiz and assessment results and scores
• Login timestamps and session duration
• IP address and browser/device information (collected automatically by the Moodle system)
• Forum posts, messages, and other user-generated content submitted on the Platform
• File uploads submitted as part of course activities
4.3 Communications Data
If users contact the Platform administrators or trainers via the internal messaging system or email, relevant correspondence and associated personal data will be retained.
4.4 Data Not Collected
The Platform does not intentionally collect or process financial data, payment information, biometric data, or data revealing racial or ethnic origin, political opinions, religious beliefs, health status, or sexual orientation. Users must not submit such data through the Platform.
5. Purposes of Processing
Personal data collected through the Platform is processed for the following purposes:
• Creating and managing user accounts and access to training materials
• Delivering online courses, training modules, and educational resources on child safeguarding
• Monitoring learner progress and issuing certificates of completion
• Administering the Platform and ensuring its technical functionality and security
• Generating anonymised or aggregated statistical reports required for monitoring and evaluation under the Grant Agreement
• Communicating with users regarding Platform updates, course information, and project activities
• Complying with obligations under Grant Agreement n°101195346 and applicable EU and national law
• Improving the quality and accessibility of training content based on user feedback and engagement data
6. Data Retention
Personal data will be retained for no longer than is necessary for the purposes for which it was collected. The following retention periods apply:
• Account registration data: retained for the duration of the Project and for a period of 5 years after the Project end date, in accordance with record-keeping requirements of the CERV Grant Agreement.
• Course activity and completion records: retained for 5 years after Project end date for audit and reporting purposes.
• IP addresses and technical log data: retained for a maximum of 12 months from the date of collection.
• User-generated content (forum posts, assignments): retained for the duration of the Project and for up to 2 years thereafter, unless the user requests earlier deletion.
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised. Users may request early deletion of their personal data, subject to the limitations described in Section 8 below.
7. Data Sharing and Transfers
7.1 Sharing with Project Partners
Personal data may be shared among Safe in Town project partner organisations strictly for project management and reporting purposes. All partner organisations are bound by the terms of a Data Processing Agreement and this Privacy Policy.
7.2 Sharing with the European Commission
As required under the Grant Agreement, anonymised or aggregated data on Platform usage and learner participation may be shared with the European Commission or its authorised representatives for monitoring, audit, and evaluation purposes. No directly identifiable personal data will be disclosed to the European Commission without a specific legal basis.
7.3 Third-Party Service Providers
The Platform may use third-party service providers (e.g., hosting providers, technical support) acting as data processors. Such providers are engaged under written data processing agreements in accordance with Article 28 GDPR and may only process personal data on documented instructions from the Data Controller.
7.4 International Transfers
Personal data is processed and stored within the European Economic Area (EEA). Where any transfer of personal data outside the EEA is necessary, such transfer will only take place in compliance with Chapter V of the GDPR, including the use of appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
7.5 No Sale of Data
Personal data collected through the Platform will never be sold, rented, or disclosed to third parties for commercial or marketing purposes.
8. Rights of Data Subjects
In accordance with the GDPR, users of the Platform have the following rights in relation to their personal data:
• Right of access (Art. 15 GDPR): the right to obtain confirmation of whether personal data concerning you is being processed and, if so, to obtain a copy of that data.
• Right to rectification (Art. 16 GDPR): the right to request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17 GDPR): the right to request deletion of personal data, subject to applicable legal obligations and legitimate interests.
• Right to restriction of processing (Art. 18 GDPR): the right to request that the processing of your personal data be restricted in certain circumstances.
• Right to data portability (Art. 20 GDPR): the right to receive personal data provided by you in a structured, commonly used, and machine-readable format, where processing is based on consent or contract.
• Right to object (Art. 21 GDPR): the right to object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: the right to lodge a complaint with the competent national supervisory authority in your country of residence.
To exercise any of the above rights, users may contact the Data Controller at the address provided in Section 2. Requests will be processed within one month, extendable by two further months in complex cases, in accordance with Article 12 GDPR.
9. Cookies and Tracking Technologies
The Moodle Platform uses cookies to ensure its proper functioning. Cookies are small text files stored on the user's device. The following categories of cookies may be used:
• Strictly necessary cookies: required for user authentication, session management, and core Platform functionality. These cannot be disabled without affecting Platform operation.
• Functional cookies: used to remember user preferences and settings across sessions.
• Analytics cookies: used to collect anonymised data on Platform usage for the purpose of improving the service. These may be disabled without affecting core functionality.
The Platform does not use third-party advertising or profiling cookies. Users may manage cookie preferences through their browser settings. A cookie consent notice is displayed upon first access to the Platform.
10. Security Measures
The Data Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. These measures include, but are not limited to:
• Encryption of data in transit using TLS/SSL protocols
• Secure password storage using cryptographic hashing
• Role-based access controls limiting data access to authorised personnel
• Regular security updates and patch management for the Moodle platform
• Automated backups and disaster recovery procedures
• Access logging and monitoring for anomaly detection
In the event of a personal data breach, the Data Controller will notify the competent supervisory authority without undue delay and within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. Affected data subjects will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR).
11. Children
The Safe in Town Platform is designed exclusively for use by adult professionals working in child safeguarding, education, social services, law enforcement, and related fields. The Platform is not intended for use by individuals under the age of 18 and does not knowingly collect personal data from minors.
Any training content on the Platform that references children or young people is presented in an educational and professional context. No personal data relating to children is collected, stored, or processed through the Platform.
12. Changes to This Privacy Policy
This Privacy Policy may be updated periodically to reflect changes in applicable law, Platform functionality, or data processing practices. Users will be notified of material changes via a notice on the Platform and, where feasible, by email. The date of the most recent revision is indicated at the top of this document.
Continued use of the Platform following notification of changes constitutes acceptance of the updated Policy. Users who do not accept the revised terms may request deletion of their account and associated personal data.
13. Supervisory Authorities
Users have the right to lodge a complaint with the data protection supervisory authority of their EU Member State of residence. Contact details for national supervisory authorities across the EU are available on the website of the European Data Protection Board (EDPB) at:
https://edpb.europa.eu/about-edpb/about-edpb/members_en
14. Contact
For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data, please contact:
Defence for Children International Italy (DCI Italy)
Data protection contact: Gabriella Gallizia
Email: childsafeguarding@defenceforchildren.it
Address: Piazza Don Andrea Gallo 5-6-7 R, 16124 Genova, Italy
Tel: +39 010 0899050
