Overview
The AgrospAI Data Space Portal is designed with privacy and GDPR compliance at its core. The platform implements a comprehensive privacy preference center that gives users full control over their data and consent preferences.The portal processes minimal personal data and does not use cookies or web storage for marketing, statistics, or tracking purposes. Only technically essential web storage is used to enable portal functionality.
Privacy-First Architecture
The portal follows a privacy-by-design approach:- Minimal data collection: Only IP addresses are processed for technical requirements
- No persistent tracking: Users are never tracked across websites
- Privacy-focused analytics: Umami analytics is self-hosted and GDPR/PECR compliant
- No third-party tracking: No Google Analytics or similar tracking services
- Cookie-free analytics: Umami does not use cookies or similar technologies
Cookie Consent Management
The portal includes an optional GDPR-compliant cookie consent banner and privacy preference center. This feature can be enabled or disabled via configuration.Configuration
Inapp.config.js:
GDPR Content Configuration
The consent banner content is defined incontent/gdpr.json:
The
optionalCookies array can be populated with cookie definitions that require user consent. Each cookie should include title, desc, and cookieName properties.Cookie Consent Context
The portal provides a React Context for managing cookie consent throughout the application.Using the Consent Context
TheuseConsent() hook provides access to consent management:
Consent Status Values
The consent system uses three status values:Managing Consent Programmatically
Implementing Custom Cookie Logic
The consent context insrc/@context/CookieConsent.tsx includes handlers for accept and reject actions:
GDPR Metadata Hook
TheuseGdprMetadata() hook provides access to GDPR configuration:
Personal Data Processing
The portal processes minimal personal data in accordance with GDPR:Data Collected
-
IP Address: src/@context/CookieConsent.tsx:64
- Purpose: Technical requirement for portal communication
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
- Retention: Only as long as needed for service provision
-
Email Address (if you contact support):
- Purpose: Responding to inquiries
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
- Retention: As long as needed to process inquiries
User Rights Under GDPR
Users have the following rights regarding their personal data:- Right of access (Art. 15 GDPR): Confirm what personal data is processed
- Right to rectification (Art. 16 GDPR): Correct inaccurate personal data
- Right to erasure (Art. 17 GDPR): Request deletion of personal data
- Right to restriction (Art. 18 GDPR): Restrict processing under certain conditions
- Right to data portability (Art. 20 GDPR): Receive data in machine-readable format
- Right to object (Art. 21 GDPR): Object to processing based on legitimate interests
- Right to lodge a complaint (Art. 77 GDPR): File a complaint with supervisory authority
Data Controllers and Processors
Controller:- Universitat de Lleida (UdL)
- Víctor Siurana, 1, 25003 Lleida, Spain
- Email: [email protected]
- Email: [email protected]
Cross-Border Data Transfer
Backend components managed by deltaDAO are hosted on:- Exoscale servers in Frankfurt, Germany
- OVH Cloud servers in Germany, France, and Poland
Best Practices
- Enable privacy preference center only if you use optional cookies
- Customize gdpr.json with clear, user-friendly text
- Implement consent checks before activating any tracking services
- Respect consent across sessions by properly storing and retrieving preferences
- Provide easy access to privacy settings throughout the portal
- Never store personal data in metadata or on-chain data