This privacy policy (“Policy”) describes how your personal data is processed when you use the iotalabs website (the “Website”) and provides information about your rights. The Website is provided by Rising Phoenix 2 Ltd (“we”, “us” or “our”), a company registered in the British Virgin Islands. The Rising Phoenix 2 Ltd is committed to the highest integrity in dealings with users, investors, employees, collaborators, and other business partners, in accordance with applicable data protection laws, particularly the European General Data Protection Regulation (GDPR) and the BVI Data Protection Act 2021.
To properly operate and provide the Website, we must process your data. Rising Phoenix 2 Ltd is the controller of the personal data obtained via the Website, meaning it is the organization legally responsible for deciding how and for what purposes it is used.
When you use the Website or request information from us, we may collect, process, and/or use your personal data, as defined below, in accordance with this Policy. Further, we may either receive your personal data directly from you when you send us e-mails or otherwise provide your personal data in the course of other interactions with us, or indirectly from third parties who legally provide your Personal Data to us.
We use a combination of cloud servers and physical servers located in the EU to process the data. In case of any data stored on or transferred to servers outside EU/EEA, appropriate safeguards in the meaning of Article 44 GDPR, in particular, contractual and organizational measures are taken to ensure that the data is adequately protected and treated in accordance with applicable requirements.
This Policy may be amended or updated from time to time to reflect changes in our practices with respect to the processing of personal data, or changes in applicable law. We encourage you to read this Policy carefully and to regularly check this page to review any changes we might make in accordance with the terms of this Policy. Your continued use of the Website constitutes your agreement to be bound by this Policy, as amended or updated from time to time.
Rising Phoenix 2 Ltd
Trinity Chambers
PO Box 4301
Road Town
Tortola
British Virgin Islands
As a matter of principle, we process personal data of our users only to the extent that this is necessary for the provision of a functional website including our content and services. The processing of personal data of our users is regularly carried out only with the consent of the user. An exception applies in those cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by legal regulations.
Insofar as we obtain your consent for processing activities involving personal data, Article 6(1)(a) GDPR serves as the legal basis. When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures. Insofar as processing of personal data is necessary for the fulfillment of a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis. If the vital interests of the data subject or another natural person make the processing of personal data necessary, Article 6(1)(d) GDPR serves as the legal basis. If the processing is necessary to protect a legitimate interest of our foundation or a third party and the interests of the data subject do not override the first-mentioned interest, Article 6(1)(f) GDPR serves as the legal basis for the processing.
Your personal data will be erased or restricted as soon as the purpose of storage no longer applies. We may store your data for longer if the data is subject to a statutory retention period or other regulations or an order from a competent public authority we are subject to. The data will then be erased or restricted if the statutory retention period or official order expires unless there is a need for further storage of the data for the conclusion or performance of a contract. We may also store the data longer if it is necessary for the establishment, exercise, or defense of legal claims.
We temporarily store the IP address transmitted by your web browser for debugging purposes exclusively on our Traefik load balancers. We have a log file rotating system in place, ensuring that the data is deleted after a maximum of five days. The legal basis for the processing of this personal data is provided in Article 6(1)(f) GDPR.
If you apply for grants through the Website using the application form, we collect personal data necessary to process and assess your application. This data may include your name, contact information, project details, and any other information you provide relevant to the grant application.
The data collected through the grant application form includes:
The legal basis for this data processing is Article 6(1)(b) GDPR, as the processing is necessary for the performance of a contract or for taking steps prior to entering into a contract. The purpose of processing is to evaluate your eligibility and suitability for the grant and to manage the application process.
Your application data will be stored for the duration of the evaluation process and, if your application is successful, for the duration of the grant relationship, subject to any legal retention obligations. If your application is unsuccessful, your data will be deleted after a reasonable period, unless statutory retention periods apply or you consent to further storage for future opportunities.
You have the right to object to the processing of your application data and request its deletion in accordance with the GDPR. Additionally, you may request access to the data, rectify inaccuracies, or withdraw your application at any time. For more details, please refer to the section "Your rights as a user”. Please note, however, that if you object to the processing of your data, this may affect the proper handling and completion of your grant application.
If you choose to register via the registration form on the Website, we collect and process personal data necessary to complete the registration and provide you with access to certain features or services that require registration. The data collected in the registration form may include the following:
The processing of your personal data is based on Article 6(1)(b) GDPR. The purpose of the data processing is to enable the registration process and to provide you with access to registered user features on the Website. The data you provide during registration will be used solely to create and maintain your user account, manage your interactions on our platform, and provide you with the requested services or features (e.g., personalized content or access to member-only sections).
Your registration data will be stored for the duration of your active account. Should you decide to delete your account, your data will be erased unless we are legally required to retain it. You have the right to access, rectify, or delete the data stored in your account. Additionally, you may object to the processing of your personal data, restrict its processing, or request its portability in accordance with the GDPR. For more details on how to exercise these rights, please refer to the section “Your rights as a user” below. Please note that if you object to or request the deletion of your data, this may affect your ability to use the registered features of the Website.
You can contact us via the Email address [email protected]. In this case, you provide us with personal data like your name and your email address. You may provide us with further information, but you are not obligated to do so. The legal basis for processing is Article 6(1)(b) GDPR. We use your data exclusively to process your request. Your data will be deleted, as soon as it is no longer necessary for the initial purpose and will not be transmitted to third parties.
We use cookies on the Website. Cookies are small pieces of data that are stored and read on your end device. A distinction is made between session cookies, which are deleted when you close your browser, and permanent cookies, which are stored even after your visit has expired. Cookies may contain data that enables the recognition of the device being used. However, in some cases, cookies only contain information on certain settings that are not personal data.
We use session cookies and permanent cookies on the Website. The data is processed in accordance with Article 6(1)(a) GDPR, your consent.
Please be aware that you can set your browser to inform you when cookies are being stored or used on the Website you are visiting. Thus, any use of cookies is transparent to you.
For more information, please refer to our Cookie Policy.
We use the software tool Google Analytics on the Website to analyze the surfing behavior of our users. The software sets a cookie on your computer.
Google Analytics does not log or store individual IP addresses. It provides coarse geo-location data by deriving the following metadata from IP addresses: City (and the derived latitude, and longitude of the city), Continent, Country, Region, Subcontinent (and ID-based counterparts). For EU-based traffic, IP-address data is used solely for geo-location data derivation before being immediately discarded. It is not logged, accessible, or used for any additional use cases. When Analytics collects measurement data, all IP lookups are performed on EU-based servers before forwarding traffic to Analytics servers for processing.
For more information, please refer to Google Analytics' data protection and privacy statement.
When accessing the Website, you are informed about the use of cookies for analysis purposes and your consent to the processing of personal data used in this context is obtained. In this context, a reference to this privacy policy is also made. The legal basis for the processing of personal data using cookies for analysis purposes is Article 6(1)(a) GDPR.
The analysis cookies are used to improve the quality of the website and its content. Through the analysis cookies, we learn how the Website is used and can thus constantly optimize our offer. The processing of your personal data enables us to analyze the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of the Website. This helps us to continuously improve the Website and its user-friendliness.
Cookies are stored on your computer and transmitted from it to our site. Therefore, you also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for the Website, it may no longer be possible to use all functions of the Website in full.
The collected data is stored in the log files of Google Analytics. IP addresses are not associated with data collected by analytics services. The storing period for the log files is limited to fourteen (14) days.
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights towards the controller:
You may request confirmation from the controller as to whether personal data concerning you is being processed by us.
If there is such processing, you may request access from the controller to the following information:
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
where the personal data are not collected from the data subject, any available information as to their source;
the existence of automated decision-making, including profiling, referred to in Article 22 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning yourself.
You may request the restriction of the processing of personal data concerning you under the following conditions:
if you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
if the controller no longer needs the personal data for the purposes of the processing, but you need them for the establishment, exercise, or defense of legal claims;
You have objected according to Article 21(1) GDPR pending the verification of whether the legitimate grounds of the controller override yours.
Where the processing of personal data relating to you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
If the restriction of processing has been applied in accordance with the above-mentioned conditions, you will be informed by the controller before the restriction of processing is lifted.
You may obtain from the controller the erasure without undue delay of personal data concerning you, and the controller shall have the obligation to erase such data without undue delay if one of the following reasons applies:
the personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
you withdraw consent on which the processing is based according to Article 6(1)(a) GDPR, and where there is no other legal ground for the processing;
you object to the processing according to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing according to Article 21(2) GDPR;
the personal data concerning you has to be erased for compliance with a legal obligation in applicable law to which the controller is subject.
If the controller has made the personal data concerning you public and is obliged to erase it according to Article 17(1) GDPR, it shall take reasonable steps, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that you, as the data subject, have requested them to erase all links to, or copies or replications of, that personal data.
The right to erasure shall not apply insofar as the processing is necessary:
ffor compliance with a legal obligation that requires processing under applicable law to which the controller is subject or for the performance of a task carried out by a public authority or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health in accordance with Article 9(2)(h) GDPR;
for archiving and research purposes to the extent that the right referred to in Article 17(1) GDPR is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
You have a right to receive clear, transparent, and easily understandable information about your rights and how we use your personal data. That is why we are providing you with the information in this Policy.
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, in accordance with Article 19 GDPR, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed of these recipients by the controller.
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another controller without hindrance from the controller to whom the personal data has been provided, if
In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, insofar as this is technically feasible. This must not affect the freedoms and rights of other persons.
The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Articles 6(1)(e) and 6(1)(f) GDPR; this also applies to profiling based on these provisions.
The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the purpose of asserting, exercising, or defending legal claims.
If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
You have the possibility, in connection with the use of information society services, to exercise your right to object by means of automated procedures using technical specifications.
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
This does not apply if the decision:
is necessary for entering into, or performing a contract between the data subject and a data controller;
is required or authorized by applicable law (including for fraud prevention, anti-money laundering, and security and integrity purposes) and in respect of which (i) the controller has, as soon as reasonably practicable, notified you in writing that a decision has been taken based solely on automated processing; and (ii) you have not, before the end of a period of 1 month beginning with the receipt of the notification, requested the controller to either reconsider the decision or take a new decision that is not based solely on automated decision making.
However, these decisions must not be based on special categories of personal data unless Article 9(2)(a) or 9(2)(h) GDPR applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the applicable supervisory authority, the Commissioner of Data Protection, or the Office of the Information Commissioner in the BVI, for individuals resident in BVI, if you consider that the processing of personal data concerning you infringes your rights.
The supervisory authority will inform you of the status and outcome of the complaint, including, where applicable, the possibility of a judicial remedy pursuant to Article 78 GDPR.