General project information

EDIBLE CITIES: “Edible Cities: transforming vacant urban spaces into green jobs for NEET youth” is a European project funded by the European Union’s Erasmus+ programme, under Key Action 2 — Cooperation Partnerships in Youth (KA220-YOU), with contract number 2025-2-DE04-KA220-YOU-000375269.

EDIBLE CITIES runs from 1 March 2026 to 28 February 2029. Its aim is to broaden training, employment and participation opportunities for young people, with particular attention to those not in education, employment or training (NEET) and to young people with fewer opportunities, through the transformation of disused urban spaces and the development of green, employability and entrepreneurship skills.

Within the framework of the project, the following are developed: training activities, meetings, webinars, events, learning resources and materials, communication and dissemination actions, publications, studies, handbooks, an online course and other project results.

The project is carried out by eight organisations from eight European countries:

• Comparative Research Network e.V. (CRN) – Germany, coordinating organisation.
• Federação das Associações Juvenis do Distrito do Porto – Portugal.
• Istituto Foggiano di Psicologia Sociale ed Ambientale S.r.l. – Italy.
• Center for Education and Innovation – Greece.
• Wonderland – Platform for European Architecture – Austria.
• Connect Your City – Brussels – Belgium.
• Fundación Maude – Spain.
• New Arctic Kitchen – Denmark.

This Privacy Policy applies to the processing of personal data carried out in connection with the project’s official website, www.ediblecities.eu, as well as to processing linked to project activities managed through its channels and participation mechanisms.

Data processing and contact

Personal data collected through this website and through the project activities managed via it are processed by the EDIBLE CITIES participating organisation responsible for developing and managing the official website, within the framework of project activity A5.3.

Data protection contact: cooperation@fundacionmaude.com

The other participating organisations process the personal data they collect in the context of the activities they organise or manage, and inform the data subjects accordingly at the appropriate time.

Personal data processed

1.  Data provided directly by the user

• First name and surname.
• Email address.
• Organisation or entity to which the person belongs, where necessary for the activity.
• Data provided when registering for project activities, events, meetings or webinars.
• Information on accessibility needs or other specific needs, where the participant communicates them and they are necessary for organising an activity.

2. Data related to participation in the project

Data necessary to manage registrations, attendance and participation, draw up participant lists, monitor activities and comply with the project’s monitoring, reporting, control and evaluation obligations.

3. Technical and browsing data

Where technically necessary or where measurement and analytics tools are used: data relating to the device, browser, IP address, date and time of access, pages visited, downloads and interactions. However, please note that the use of cookies is governed by the project’s Cookie Policy.

4. Images and recordings

Photographs and audio or video recordings taken at project activities.

No special categories of data within the meaning of Article 9 of the GDPR are requested. However, information on accessibility needs that a participant chooses to communicate could reveal data concerning health or beliefs; in that case, it will be processed as set out in the purposes and legal bases for processing

Purposes and legal bases for processing

Personal data may be processed for the purposes set out below, on the legal basis indicated in each case.

1. Website management

To enable the operation, maintenance and security of the website, technically manage the published content and resources, and prevent fraudulent use, abuse and security incidents.

Legal basis: legitimate interest in the proper functioning and security of the website (Art. 6(1)(f) GDPR).

2. Project information and dissemination

To provide information about the project, its objectives, activities, results and participating organisations; to publish news, activities, materials, studies, handbooks and other results; and to disseminate them through the project’s communication channels.

Legal basis: legitimate interest in disseminating the project and its results (Art. 6(1)(f) GDPR).

3. Newsletter subscription

To manage subscriptions to the project newsletter, send communications about its progress, activities, news and results, and handle unsubscribe requests.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR and Art. 21 of the Spanish Information Society Services and Electronic Commerce Act, LSSI-CE).

4. Registration and participation in activities

To manage registrations for events, meetings, webinars and training activities, organise and deliver them, draw up participant lists and record attendance.

Legal basis: legitimate interest in managing the activity requested by the data subject (Art. 6(1)(f) GDPR).

 5. Addressing specific needs communicated

To address the accessibility needs or other specific needs communicated by the participant for the proper organisation of an activity.

Legal basis: explicit consent, where the information provided reveals data belonging to the special categories of Article 9 of the GDPR (Art. 9(2)(a)).

 6. Images and recordings of activities

To capture, use and disseminate photographs and recordings of project activities.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

 7. Project monitoring, evaluation and reporting

To prepare reports and monitoring documentation, provide evidence that activities were carried out and of participation, and meet the control, evaluation, reporting and audit obligations arising from the Erasmus+ programme and the funding received.

Legal basis: obligations arising from the Erasmus+ Grant Agreement and applicable legal obligations (Arts. 6(1)(c) and 6(1)(f) GDPR).

8. Website usage analytics

To obtain aggregated or statistical information on visits, pages viewed, downloads, views and interaction with content.

Legal basis: consent given through the cookie panel (Art. 6(1)(a) GDPR).

9. Compliance with accounting, tax and administrative obligations

Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

No automated decisions are made and no profiling is carried out using the personal data processed.

Images and recordings

At project events, training meetings, webinars and other activities, photographs and audio and video recordings may be taken for documentation, communication and dissemination purposes, including publication on the project website, its social media profiles, dissemination materials and reports submitted to the competent European body.

The legal basis for this processing is the consent of the data subject, which will be obtained specifically and separately at the time of registration or at the start of the activity.

Participants will be informed in advance of any webinars and online meetings that are to be recorded. Participation with camera or microphone will, in any case, be entirely voluntary.

Where minors take part, consent will be obtained from their legal representative. Minors taking part in this type of event linked to the Erasmus+ programme (education and training) do so together with a so-called “accompanying person”: qualified teaching staff who facilitate the learning process.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. Following withdrawal, use of the material will cease and it will be removed from the project’s own channels, although removal may not be technically possible for materials already distributed or published by third parties.

Retention periods

These are set out below:

• Newsletter: for as long as the subscription remains active. After unsubscribing, only evidence of the request and of the withdrawal of consent will be kept, for the period necessary to demonstrate how it was handled.
• Registrations and participation in activities: for the duration of the activity and, thereafter, for five years from payment of the project’s final balance, in accordance with the record-keeping obligations set out in the Erasmus+ Grant Agreement.
• Images and recordings: for as long as consent is maintained and for the lifetime of the dissemination materials in which they have been included.
• Technical and browsing data: in accordance with the configuration of the tools used.
• Data subject to accounting, tax or administrative obligations: for the legally established periods.

Once the stated periods have elapsed, the data will be erased or blocked so that they can only be made available to judges, courts and competent authorities to address any liabilities arising from the processing.

In all cases, the principles of data minimisation and storage limitation will be applied.

Recipients and disclosure of data

Personal data may be disclosed or made accessible to third parties only where necessary for the management, implementation, dissemination, monitoring, evaluation, reporting, control or audit of the project, or where required by a legal obligation.

I. Project partners

Certain personal data may be shared with other participating organisations where necessary for carrying out activities, managing participants, organising events, evaluation, monitoring, communication, dissemination or reporting. Access will be limited to data that are adequate, relevant and necessary for each purpose. Each organisation that receives data for its own activities processes them as an independent controller, in accordance with applicable data protection legislation.

II. Service providers

External providers necessary for the operation of the website and the project may be involved, in particular for hosting, maintenance and technical support, communication and newsletter tools, measurement and analytics tools, and platforms used to deliver training. These providers process personal data on behalf of the organisation responsible for managing the website, in accordance with its instructions and the safeguards required by Article 28 of the GDPR.

III. Erasmus+ institutions and bodies

Where necessary for the management, monitoring, evaluation, reporting, control or audit of the project, certain data may be made available to the National Agency managing the grant and to the competent institutions and bodies of the European Union, as provided for in the project’s Grant Agreement.

IV. Social media and external platforms

The project may use social media and external platforms for its communication and dissemination activities, including LinkedIn, Instagram, Facebook, YouTube and TikTok. When a person interacts with the project’s profiles or content, the relevant provider may process their data in accordance with its own privacy policies.

 V. No commercial disclosures

Personal data will not be sold or disclosed for commercial or advertising purposes unrelated to the project.

International data transfers

As a result of using certain technology providers, communication platforms or social media, personal data may be processed or accessed from countries outside the European Economic Area.

Where an international transfer takes place, it will be carried out in accordance with Articles 44 et seq. of the GDPR.

The European Commission’s Adequacy Decision on the EU-U.S. Data Privacy Framework is currently in force, allowing transfers to U.S. entities that have signed up to that framework. Where no adequacy decision applies, Standard Contractual Clauses or other safeguards provided for in the GDPR will be used.

In the case of YouTube, the service is provided in the European Economic Area by Google Ireland Limited. Data may be transferred to Google LLC in the United States, an entity that has signed up to the EU-U.S. Data Privacy Framework.

For TikTok, the service is provided in the European Economic Area by TikTok Technology Limited (Ireland). However, its users’ data may be accessible from third countries, including China, which does not benefit from a European Commission adequacy decision. These transfers are the responsibility of TikTok, which states that it relies on Standard Contractual Clauses for them. Please note that the legislation of those countries may allow their public authorities to access personal data without a level of protection equivalent to that of the GDPR. The project will not publish on TikTok any images or recordings in which identifiable minors appear

Data security

Appropriate technical and organisational measures are applied to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, aimed at preserving the confidentiality, integrity, availability and resilience of the systems and services used. Providers acting as processors must provide sufficient guarantees in accordance with Article 28 of the GDPR. In the event of a personal data breach, action will be taken in accordance with Articles 33 and 34 of the GDPR.

Rights of data subjects

Persons whose data are processed may exercise their rights of access, rectification, erasure, restriction of processing, objection and data portability, as well as withdraw their consent at any time and not be subject to decisions based solely on automated processing. These rights may be exercised by writing to cooperation@fundacionmaude.com, stating the right you wish to exercise. Requests will be handled without undue delay and, in any event, within one month of receipt, which may be extended by two further months depending on the complexity and number of requests, in which case the data subject will be informed of the extension and the reasons for it within the first month. Data subjects have the right to lodge a complaint with the competent supervisory authority, in particular in the country of their habitual residence, place of work or place of the alleged infringement. In Spain, the supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Cookies and links to third-party websites

The website may use cookies and similar technologies to ensure certain functionalities and, where applicable, to obtain statistical information on its use. Cookies that are not strictly necessary will only be installed with the user’s prior consent; users may accept, reject or configure them through the panel provided and change their choice at any time. Detailed information is available in the project’s Cookie Policy, at the following link.

The website may contain links to pages, platforms or services managed by third parties, whose privacy practices are outside our control. We recommend reviewing each third party’s privacy information before providing personal data or using their services.

Updates to this Policy

This Privacy Policy may be amended to reflect regulatory changes, the development of the project, new processing operations or changes in the services used. The updated version will be published on this website.

Where an amendment requires additional information, a new legal basis or new consent, the necessary measures will be taken before processing begins.

Date of latest version: September 2026.