PlantACT! Privacy Policy

Last updated: October 2026

At PlantACT!, accessible from https://www.plant-act.org/, one of our main priorities is the privacy of our visitors. This Privacy Policy explains which personal data is processed when you visit this website, for which purposes, on which legal basis and which rights you have. It applies only to this website and not to information collected offline or via other channels. This Privacy Policy is based on the template of the Free Privacy Policy Generator and has been supplemented with the requirements of the General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the GDPR is:

Prof. Heribert Hirt (PlantACT! initiative)
4700 King Abdullah University of Science and Technology
Thuwal 23955-6900
Kingdom of Saudi Arabia
Email: heribert.hirt@kaust.edu.sa
Phone: +966 12 808 2959

General enquiries about the initiative: office@plant-act.org. If you have any questions about this Privacy Policy or about the processing of your data, please contact us at one of the email addresses above.

2. Legal bases

We process personal data only where a legal basis under Art. 6(1) GDPR applies, in particular:

• Consent (Art. 6(1)(a) GDPR) – e.g. for loading content from third parties. You can withdraw your consent at any time with effect for the future.
• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) – e.g. when you contact us about participation in the initiative, an event or a position.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Legitimate interests (Art. 6(1)(f) GDPR) – e.g. the secure and stable operation of this website, anonymous usage statistics and answering general enquiries.

3. Hosting and server log files

This website is hosted by World4You Internet Services GmbH, Linz, Austria (www.world4you.com). The servers are located in the European Union. When you visit the website, the hosting provider automatically records information in so-called server log files that your browser transmits: IP address, date and time of the request, the page requested, referring page (referrer), browser type and version, operating system and the amount of data transferred.

This data is required to deliver the website, to ensure its security (e.g. to detect attacks) and to analyse technical problems. It is not combined with other data sources and is deleted as soon as it is no longer required for these purposes. The legal basis is our legitimate interest in the secure and error-free operation of the website (Art. 6(1)(f) GDPR). The hosting provider processes this data on our behalf as a processor within the meaning of Art. 28 GDPR.

4. Website security

To protect this website against attacks (e.g. repeated failed login attempts), we use the security plugin Kadence Security (Solid Security). It processes the IP address of visitors locally on our server in order to detect and block attacks. The data is not transmitted to third parties. The legal basis is our legitimate interest in protecting the website (Art. 6(1)(f) GDPR).

5. Cookies and privacy preferences

This website only uses technically necessary cookies. When you visit the website for the first time, a privacy banner is displayed. Your choice (accept or reject) is stored in a cookie on your device (names: uncode_privacy[consent_types] and uncode_privacy[privacy_bar]) so that the banner is not shown again on every page. These cookies do not contain any information that identifies you. The legal basis is § 165(3) of the Austrian Telecommunications Act (TKG 2021) and our legitimate interest in being able to document and respect your choice (Art. 6(1)(f) GDPR).

You can change or withdraw your consent at any time via the link “Privacy Preferences” in the footer of every page. You can also delete or block cookies in the settings of your browser.

6. Usage statistics

To understand which content is of interest to our visitors, we use the plugin Burst Statistics in cookieless mode. The statistics are created on our own server; no cookies are set, no data is passed on to third parties and IP addresses are not stored in full. We only see aggregated figures such as the number of page views, the pages visited, the referring website and the type of device. The legal basis is our legitimate interest in improving our website (Art. 6(1)(f) GDPR). You can object to this processing at any time by contacting us.

7. Translations

This website is available in several languages. The translations are created with the plugin TranslatePress and stored on our own server. When you visit a translated page, no personal data is transmitted to translation services.

8. Videos, social media and external links

Videos of our events (on Vimeo and YouTube) and our profiles on social media (Facebook and Instagram) are only linked from this website and are not embedded. No data is transmitted to these providers when you visit our pages. Only when you click on such a link are you taken to the provider’s website, where the provider’s privacy policy applies:

• Vimeo – Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA. Privacy policy: vimeo.com/privacy
• YouTube – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy
• Facebook and Instagram – Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Privacy policy: facebook.com/privacy/policy

Should content from such platforms be embedded on this website in the future, it will only be loaded after you have given your consent in the privacy preferences (Art. 6(1)(a) GDPR). Links to other external websites (e.g. members, partner institutions, conferences) are ordinary links; data is only transmitted to these websites when you click on the link.

9. Fonts

The fonts used on this website are hosted locally on our server. No connection to servers of Google or other font providers is established when you visit the website.

10. Contact by email

If you contact us by email, we process the data you provide (name, email address, message and any further information you choose to provide) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual measures (e.g. participation in the initiative or an event), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete your data once your enquiry has been answered completely, unless statutory retention obligations apply.

11. Your rights

Under the GDPR you have the following rights regarding your personal data:

• the right of access (Art. 15 GDPR),
• the right to rectification (Art. 16 GDPR),
• the right to erasure (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to processing based on legitimate interests (Art. 21 GDPR),
• the right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise these rights, please contact us at heribert.hirt@kaust.edu.sa. We will respond within one month. Exercising your rights is free of charge.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, your place of work or the place of the alleged infringement. In Austria, where this website is hosted, the competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.

12. Children’s information

This website is not directed at children. We do not knowingly collect personal data from children under the age of 16. If you believe that your child has provided personal data on this website, please contact us and we will delete it promptly.

13. Changes to this Privacy Policy

We may update this Privacy Policy when the website or the legal situation changes. The current version is always available on this page.