We process personal data only as far as necessary to run this website, to answer your requests and to carry out the RAA-PERMIT-BOOST project, in line with the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), the Austrian Data Protection Act and Article 15 of the project’s Grant Agreement. How the project handles data in general is set out in its Data Management Plan (deliverable D1.2), which will be published in the library.
Who is responsible
Controller for this website and the contact form:
Österreichische Energieagentur – Austrian Energy Agency (AEA), Mariahilfer Straße 136, 1150 Vienna, Austria
Email: erneuerbare(at)energyagency.at
Data protection officer of the AEA: the external data protection officer Dr. Sonja Hebenstreit, attorney at law, Herbst Kinsky Rechtsanwälte, 1010 Vienna, Austria, datenschutz(at)energyagency.at
Each project partner is the controller for the personal data it collects directly in its own project activities, for example interviews, national stakeholder groups, webinars, clinics or Community of Practice meetings. Before such an activity you receive a data protection statement naming the responsible partner and a contact person.
Data protection contact of the RAA-PERMIT-BOOST project: Jan Bormans, Th!nk E, jan(at)think-e.be
Visiting the website
This website is hosted by Cloudflare, Inc. (Cloudflare Pages). When you visit it, Cloudflare processes technical data such as your IP address, date and time, the page requested and your browser type, to deliver the pages and protect them against attacks (legitimate interest, Art. 6(1)(f) GDPR). Cloudflare may process data outside the European Economic Area; it is certified under the EU-US Data Privacy Framework. We do not store server log files ourselves. Cloudflare processes this technical data only as long as necessary to deliver the website and protect it against attacks, in line with Cloudflare’s privacy policy.
This website does not use cookies and does not load fonts or scripts from other providers.
Contacting us and helpdesk requests
The contact form on this website does not send or store any data. When you click the button, the website prepares an email with the details you entered (name, organisation, type of organisation, country, topic and message) and opens it in your own email program. Only when you send that email do we receive it, at erneuerbare(at)energyagency.at, together with your email address. The prepared email contains a short confirmation that you have read this notice, which we keep as a record.
We process your email to answer your request and, where relevant, to provide helpdesk and clinic support. As you contact us in connection with the project, typically in a professional capacity, the legal basis is our legitimate interest in carrying out the action funded under the Grant Agreement (Art. 6(1)(f) GDPR). Your email is stored in the project’s Microsoft 365 environment, hosted in the EU, and shared with the consortium partner best placed to answer only where this is necessary. Helpdesk requests are pseudonymised before they are summarised in the project’s public helpdesk report (D4.4).
Please do not send special categories of personal data (for example on health, political opinions or religious beliefs).
Names, quotes, photos and recordings
Contributions to the project are normally attributed to an organisation, not to a person. We only publish a quote with a person’s name, a photograph or video in which someone is identifiable, or a webinar recording showing participants, with the explicit consent of the person concerned (Art. 6(1)(a) GDPR). Anyone quoted is offered the chance to review the text before publication, and can withdraw their consent at any time.
Videos on YouTube
Videos are only loaded from YouTube (Google Ireland Ltd.) after you click “Play video”. Only then is your IP address transferred to YouTube. We use the privacy-enhanced mode (youtube-nocookie.com). The legal basis is your consent by clicking (Art. 6(1)(a) GDPR). YouTube may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework.
Links to LinkedIn and other services
Links to LinkedIn and partner websites are plain links. No data is transferred to these services unless you click a link; their own data protection rules then apply.
Web analytics
To report the project’s communication indicators to the European Union, for example page views, downloads and video views, we use GoatCounter, an open-source analytics service (goatcounter.com). GoatCounter does not use cookies, does not store your IP address and does not track you across websites. It records the page visited, the referring website, browser and operating system, screen size and the country derived from the IP address, and counts repeat visits using a short-lived, non-identifiable hash. We also count, without any personal data, when a document is downloaded, a video is started, a country is opened on the map or a form is submitted.
We only see aggregated statistics. The legal basis is our legitimate interest in measuring the reach of the publicly funded project (Art. 6(1)(f) GDPR). GoatCounter is operated by Martin Tournoij, Ireland. The data is stored on servers of Hetzner Online GmbH in Finland and Germany, so it does not leave the European Union. Statistics are only collected on www.raa-permit-boost.eu.
Who receives your data
Access is limited to project staff who need the data for their tasks and who are bound by confidentiality obligations. Within the consortium, data is shared only where necessary for the project. In aggregated or anonymised form it may be shared with the funding agency, the European Climate, Infrastructure and Environment Executive Agency (CINEA), for reporting. Audit bodies such as CINEA or the European Court of Auditors may access data in the context of an audit. Your data is not passed on to any other third party unless we are legally required to do so. It is not used for automated decision-making or profiling.
Transfers outside the EU
Project data shared between partners is stored on Microsoft 365 services hosted in the EU. Some tools used for communication, such as website hosting, YouTube, LinkedIn and the podcast host, may transfer data outside the European Economic Area. Before a tool is used, the project checks that an adequacy decision, such as the EU-US Data Privacy Framework, or Standard Contractual Clauses cover the transfer.
How long we keep your data
We keep personal data only as long as necessary for the purpose for which it was collected. Contact and helpdesk requests are deleted once they have been answered and are no longer needed for the project, at the latest at the end of the project, unless they are needed as proof that the project was properly carried out. Such records are kept for five years after the final payment under the Grant Agreement, as required by the Grant Agreement.
Your rights
You have the right to access your personal data (Art. 15 GDPR), to have it corrected (Art. 16), and, under certain conditions, to have it erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to its processing (Art. 21). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. Where processing is based on your consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before.
To exercise your rights, write to erneuerbare(at)energyagency.at, to the AEA’s data protection officer at datenschutz(at)energyagency.at or to the project’s data protection contact. We answer within one month; where necessary, this period can be extended by two further months, in which case we tell you why.
You also have the right to lodge a complaint with a data protection supervisory authority. In Austria this is the Datenschutzbehörde (www.dsb.gv.at). A list of all national authorities is available from the European Data Protection Board.
Last updated: 22 October 2026
