Privacy notice

This notice covers the AquaBEHERweb interface. The project is developed within the Translational Plant Genomics group at Sant’Anna School of Advanced Studies, Pisa. External map and Shiny services have separate policies.

For website enquiries, contact the project team. Sant’Anna’s institutional privacy office and Data Protection Officer are listed below for matters within the School’s responsibility. Their details do not establish who controls every independently hosted copy of the software.

For processing carried out by the School, its published notice identifies Scuola Superiore Sant’Anna, represented by the Rector, as controller: Piazza Martiri della Libertà 33, 56127 Pisa, Italy; certified email (PEC): protocollo@sssup.legalmailpa.it. Its Data Protection Officer is reachable at dpo@santannapisa.it. Independently hosted copies must identify their own responsible operator.

Technical requests support page delivery, map exploration and security; language storage remembers your choice; correspondence allows the team to answer enquiries. Optional location access helps centre the map and is not required to browse.

Sant’Anna’s general notice identifies legal obligations and tasks in the public interest as bases for its institutional activities (GDPR Article 6(1)(c) and (e)), and contractual obligations where relevant (Article 6(1)(b)). The operator must specify the basis applicable to each activity in this deployment. Browser location permission alone does not establish the legal basis for all subsequent provider processing.

Website and infrastructure providers receive technical information needed to return pages and operate the service, such as IP address, browser information, request time and requested URL. Security and diagnostic logs may include these details.

Map tiles, selected layers, dates and pixel queries generate service requests. The website forwards agroclimatic data requests to its configured GeoServer. The requested area or coordinates can appear in request URLs and logs. Avoid using personal identifiers or confidential information in searches.

Place search sends the search text to Mapbox and may use the map view to improve results. Basemap requests also reveal the viewed area to the map provider.

Locate me requests your device location only when activated and permitted by your browser. It centres the map on that position; subsequent map requests can reveal the area. You may refuse or revoke permission in browser settings.

The address bar and copied map links can contain the map centre, zoom, layer and date. Browser history, shared URLs and exported files can therefore disclose locations. Check them before sharing.

When the Contact page map loads, your browser connects to Google Maps. Map and Street View interactions are handled by Google; IP address, browser information and service identifiers may be processed under its policy. Directions links open Google Maps separately.

The first-party NEXT_LOCALE cookie remembers the language you select. Its configured lifetime is up to one year from the most recent language selection. You can remove it through browser settings or select a different language; removing it resets the preference.

This version does not include a first-party advertising or audience-analytics script. This does not mean external services collect no data: Mapbox, the embedded Shiny service and hosting infrastructure may use technical identifiers, storage or logs under their own policies.

Google Maps and Turnstile may also process technical identifiers or use browser storage under their respective policies.

When configured, sending the contact form transmits your name, email, topic, message, selected language and verification token to Formspree. Formspree processes submissions and routes notifications to the recipients configured by the project operator. Message history and retention depend on the selected service plan and settings.

Cloudflare Turnstile checks for automated submissions. Its widget receives technical browser and network information for verification; Formspree validates the resulting token. The form cannot send until verification succeeds.

The alternative email links open your own email application. Share only information needed for your enquiry and avoid sensitive personal data. Public GitHub issues and discussions are visible to others.

Mapbox supplies basemaps and place search. When the Shiny application loads, your browser connects to shinyapps.io, operated by Posit. Data entered in that application is handled by that service and its application operator, separately from this explorer.

Hosting, network, map, email and Shiny providers may process technical or submitted information. Some processing may take place outside the European Economic Area. Consult the relevant provider’s policy for its recipients, retention and transfer safeguards; this notice does not guarantee EU-only processing.

The contact page additionally uses Google Maps, Formspree and Cloudflare Turnstile when configured. These providers process map interactions, submitted messages or verification information as described above.

The language-cookie period is specified above. Server-log, service-provider and correspondence retention depends on the actual hosting and institutional arrangements; a single verified period for those records is not available in this prototype notice. Ask the team about the service and information concerned.

The institutional notice also describes retention duties for administrative or accounting records. These do not establish a blanket ten-year retention period for map requests or all website logs.

Do not treat this public research interface as confidential storage. Use the site’s secure HTTPS address when available, and review recipients, shared coordinates and downloaded files before distributing them.

Subject to the applicable conditions, data-protection rights may include access, correction, erasure, restriction, objection and portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to the Italian Garante or another competent supervisory authority.

For a request, identify the website, service and information concerned. The project team can help route it; for processing within Sant’Anna’s responsibility, use its privacy office or DPO. The explorer does not use personal profiles to make decisions with legal or similarly significant effects about visitors.