Privacy policy

    Last updated: 30/09/2026

    This page explains how the RECEBA website (circulareconomyskills.eu) and the RECEBA learning platform handle personal data. It covers browsing the site, writing to us through the contact form, subscribing to updates, registering for an event, and creating an account on the learning platform. Surveys and other research activities come with their own information notice, which you receive before taking part. If anything here is unclear, write to us at [email protected].

    Who is responsible for your data?

    RECEBA (Regional Circular Economy Business Acceleration) is a European project co-funded by the Erasmus+ programme of the European Union (ERASMUS-EDU-2025-PEX-COVE, project 101260639). It brings together 17 organisations in six European regions to develop skills for the circular economy. It is coordinated by Sistemi Formativi Confindustria (SFC).

    ACR+, the Association of Cities and Regions for Sustainable Resource Management, is the data controller for the data collected through the website. This means ACR+ decides how your data is used and is responsible for protecting it.

    ACR+ AISBL
    Avenue des Arts 3-4-5
    1210 Brussels, Belgium
    [email protected]

    Learning Digital, the RECEBA technical partner, owns and operates the website. The website runs on servers rented from DigitalOcean in Frankfurt, Germany. For the website, Learning Digital processes data on behalf of ACR+ under a data
    processing agreement and in compliance with the GDPR.     Learning Digital also owns and operates the RECEBA learning platform, and is the data controller for the data collected there, including micro-credentials.

    Learningdigital SRL
    Via Maroncelli 45
    50137 Florence, Italy
    [email protected]

    For any question about your data, write to [email protected]. For questions about your account on the learning platform or your micro-credentials, you can also write directly to [email protected].

    What data do we collect, and why?

    When you browse the website

    The server automatically records technical information such as your IP address, browser type, and the date and time of your visit. We use it to run the site, keep it secure and fix problems. (Legitimate interest, Art. 6(1)(f) GDPR)

    Some features, such as visitor statistics and embedded videos, use cookies or similar tools. We only activate those that are not strictly necessary if you accept them in the cookie banner. (Consent, Art. 6(1)(a) GDPR)

    The maps on the website use OpenStreetMap data served from our own servers, so no data about your visit is sent to OpenStreetMap.

    Visitor statistics

    If you accept statistics cookies, we use Google Analytics and WordPress Stats to measure how the website is used. These tools record which pages and resources you view, how long you stay, the type of device and browser you use, and your approximate location. We use the figures to measure the reach of the project, which we report to the European Commission, and to improve the website. (Consent, Art. 6(1)(a) GDPR)

    When you use the contact form

    We ask for your name, email address, the subject of your enquiry and your message. These fields are required, because we need them to answer you. You can also tell us your organisation, your country or region, and the type of organisation you work for. These fields are optional, and leaving them empty does not affect our reply.

    • We read and answer your message, and keep the conversation going if follow-up is needed. (Legitimate interest, Art. 6(1)(f) GDPR)
    • We pass your message to the RECEBA partner best placed to answer it. This may be the project
      coordinator, the partner working in your region, or the team responsible for communication, partnerships or the website.       (Legitimate interest, Art. 6(1)(f) GDPR)
    • If you write about a specific RECEBA activity, we use your details to follow up on that request and
      nothing else. This covers business challenges, Circular Business Labs, mentoring, training and micro-credentials, regional panels, cooperation, the Community of Practice, and media or event requests.       (Legitimate interest, Art. 6(1)(f) GDPR)
    • We keep a record of your message and our reply, so that we can follow up consistently. (Legitimate interest, Art. 6(1)(f) GDPR)
    • If you use the form to exercise your data protection rights, we use your details to handle that request. (Legal obligation, Art. 6(1)(c) GDPR)
    • Where needed, we translate messages automatically so that partners in other countries can read them. (Legitimate interest, Art. 6(1)(f) GDPR)

    The contact form has two optional boxes, both unticked by default. Ticking one, both or neither makes no difference to our reply:

    • RECEBA updates – We add you to the RECEBA newsletter and send you invitations to RECEBA events and news on project results and training, as described in the next section.
    • Research and feedback – We invite you to take part in RECEBA research and feedback activities, such as surveys, interviews and focus groups on circular economy skills.

    If you tick a box, we add your name, email address, organisation, country or region, and type of organisation to the RECEBA contact list. We contact you only for what you chose. (Consent, Art. 6(1)(a) GDPR)

    When you subscribe to RECEBA updates

    There are two ways to subscribe: through the “Stay informed” form, or by ticking the updates box when you write to us through the contact form.

    Through the “Stay informed” form, we ask for your email address, and you can tell us your region of interest and the type of organisation you represent. If you subscribe through the contact form, we use the details you gave there.

    We use these details to send you the RECEBA newsletter, invitations to RECEBA events online and in person, and news on project results and training. We use your region and type of organisation to send you what is most relevant to you. You
    can unsubscribe at any time through the link in every message or by writing to     [email protected]. (Consent, Art. 6(1)(a) GDPR)

    The newsletter is sent from the website itself, so your details stay on our servers. Our emails record whether they were opened and which links were clicked, so we can understand what interests our readers.

    When you register for a RECEBA event

    To register, we ask for your first name, surname, email address and organisation. We use them to manage your registration, send you practical information about the event and any follow-up material, and prepare the attendance list.
    (Legitimate interest, Art. 6(1)(f) GDPR)

    The attendance list is part of the evidence RECEBA must keep to show the European Commission that the project carried out its activities. We share it only with the RECEBA partners organising the event and, on request, with the European
    Commission, the European Education and Culture Executive Agency (EACEA) or their auditors.

    Some events are photographed or recorded, and the images may be used on the RECEBA website, on social media and in project reports. For each event, the registration form tells you whether this is planned and asks for your permission in a separate, optional box. If you do not tick it, you can still attend. At online events, keep your camera and microphone off. At events in person, tell the organisers when you arrive and we will make sure you are not featured. (Consent, Art.
    6(1)(a) GDPR)

    Online events take place on Microsoft Teams, as described under external services below. Registering for an event does not add you to the RECEBA mailing list unless you provide explicit authorization.

    When you create an account on the learning platform

    This section concerns data for which Learning Digital is the controller. To follow RECEBA courses or join the Community of Practice spaces, you create an account on the RECEBA learning platform, which runs on Moodle. We ask for nd we ask for your first name, surname, organisation and email address. (Contract, Art. 6(1)(b) GDPR)

    We use your account data to give you access to courses and spaces, record your progress, activity completion and assessment results, and issue the micro-credentials you earn. Only you can see your own progress reports. Platform-wide reports are restricted to administrators and managers, who use them to run the courses and to report on the project to the European Commission without exposing individual data. Other participants in the same course or space can see your name and what you contribute there, such as forum posts, shared pages and uploaded documents.

    Plugins added to the platform are checked for compliance with Moodle’s privacy framework, and none may send data outside the platform without authorisation. From your privacy settings on the platform, you can download a copy of your
    data and request the correction or deletion of your account.

    Micro-credentials

    This section also concerns data for which Learning Digital is the controller.

    When you complete a course, the platform issues a digital micro-credential through MICOO, a credentialing service connected to Moodle. The credential states who issued it, who earned it, and which skills it certifies, so that employers and training institutions can check it independently. You can share your credentials or export them to your own digital wallet, including in Open Badges, Europass and European Digital Credentials formats. (Contract, Art. 6(1)(b) GDPR)

    Surveys and research

    RECEBA runs surveys, interviews and focus groups on circular economy skills. Each activity has its own information notice, which explains how your answers are used and which you receive before deciding whether to take part. We do not use messages sent through the contact form as research data.

    Statistics

    We count messages, subscriptions, event registrations and accounts, and group them by region and type of organisation. We use these figures to see who the project is reaching and to improve the website. The figures never include names or contact details. (Legitimate interest, Art. 6(1)(f) GDPR)

    Who can see your data?

    • The RECEBA partner or partners who need your data to answer you, run an event or deliver a course. You
      can find the full list of partners on the Partners page.       They use your data only for that purpose.
    • Learning Digital, which operates the website on behalf of ACR+ and runs the learning platform.
    • DigitalOcean, which provides the servers in Frankfurt, Germany, where the website runs.
    • The European Commission, EACEA and their auditors, for event attendance lists, and only on request.
    • The external services used by the website, listed in the next section.

    Nobody else sees your data, unless the law requires us to share it. We never sell your data.

    Which external services do we use?

    Google Analytics – If you accept statistics cookies, Google Analytics measures your visit. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may transfer data to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. See Google’s privacy policy at policies.google.com/privacy.

    WordPress Stats – If you accept statistics cookies, WordPress Stats also counts your visit. The service is provided by Automattic Inc., which processes data in the United States and participates in the EU-US Data Privacy Framework. See Automattic’s privacy policy at automattic.com/privacy.

    Vimeo videos – Some pages show videos hosted on Vimeo, a service provided by Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. When you play a video, Vimeo receives your IP address and technical data about your device, and it may set cookies. Videos load only if you accept them in the cookie banner. Vimeo processes data in the United States and is certified under the EU-US Data Privacy Framework. See Vimeo’s privacy policy at  vimeo.com/privacy.

    Microsoft Teams – Online events take place on Microsoft Teams, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you join, Microsoft processes your name, email address and technical data about your connection. It also processes your audio, video and chat messages if you use them. The meeting is set up by the RECEBA partner hosting the event. Microsoft may transfer data to Microsoft Corporation in the United States, which is certified under the EU-US Data Privacy Framework. See Microsoft’s privacy statement at privacy.microsoft.com.

    Links to LinkedIn and Vimeo –  The links to our LinkedIn page and Vimeo channel are plain links and send no data to those platforms. If you click them, you leave our website, and the platform’s own privacy policy applies.

    Does your data leave the European Union?

    We choose service providers based in the European Union or the European Economic Area wherever we can. The website, the learning platform and the newsletter run on servers in the EU.

    Some external services transfer data outside the EEA. We allow this only in two cases:

    • where the European Commission has recognised the destination as offering an adequate level of protection, as with companies certified under the EU-US Data Privacy Framework;
    • where the provider has signed the Commission’s standard contractual clauses.

    How long do we keep your data?

    Contact form messages – If you only sent us a message through the contact form, we delete it 12 months after our last exchange.

    Subscriptions, accounts and micro-credentials – If you subscribed to updates or research invitations, created an
    account on the learning platform, or earned a micro-credential, we keep your details until the project ends on 31 March 2030. We delete them earlier if you unsubscribe or delete your account. When the project ends, we will write to ask
    whether you want to keep hearing from us or keep your account. We will keep your details only if you say yes, and we will ask again every year. If you do not reply, we delete your details. Credentials you have exported to your own wallet remain yours.

    Event registrations – We keep registration details and attendance lists until 31 December 2035, or longer if an audit of the project is still open, because the grant agreement requires us to keep evidence of project activities for that period. We then delete them.

    Photos and recordings – If you agreed to be photographed or recorded, you can ask us at any time to remove
    images of you from material we publish. We cannot recall material that has already been printed or shared by others.

    What we do not do

    • We do not sell your data or use it for anyone else’s marketing.
    • We do not add you to any mailing list unless you ask to be added.
    • We do not use your data to make automated decisions about you or to build a profile of you.
    • We do not pass your data to any other organisation after the project ends without telling you first and, where required, asking for your consent again.
    • If you are under 18, you can write to us and we will answer. We will add you to our mailing lists only with the consent of a parent or guardian.
    • Please do not include information about your health, religion, political opinions or other sensitive matters in your messages. If you do, we will use it only to answer you.

    What are your rights?

    You can ask us at any time to:

    • see the data we hold about you;
    • correct it if it is wrong;
    • delete it;
    • limit how we use it;
    • stop using it for purposes
      based on our legitimate interest;
    • send you the data you gave us
      with your consent, or for your account, in a format you can reuse
      elsewhere.

    You can also withdraw your consent at any time. This does not affect anything we did with your data before you withdrew.

    To use any of these rights, write to [email protected]. For your account on the learning platform or your micro-credentials, you can also write to [email protected], or download your data and request deletion from your privacy settings on the platform. It is free, and we will reply within one month.

    Questions and complaints

    If you have a question, or you think we have not handled your data properly, please write to us first at [email protected].

    You also have the right to complain to a data protection authority. You can complain to the authority in the country where you live or work. For the website, the lead authority is the Belgian Data Protection Authority, because ACR+ is based in
    Belgium: Rue de la Presse 35, 1000 Brussels,     [email protected], www.dataprotectionauthority.be. For the learning platform, it is the Italian Data Protection Authority, because Learning Digital is based in Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.

    Changes to this policy

    If we change how we use your data, we will update this page and the date at the top. If a change affects something you consented to, we will ask for your consent again.