Your rights over your data

Law 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, amended and supplemented by law 25-11 of 24 July 2025, gives you rights over everything this portal holds about you. They are not exercised by writing a letter and waiting: most of them are on one screen.

The "My data" page

My data is in the Profile group of the left-hand menu of the researcher portal. It has three parts.

What is held

A summary of everything the portal keeps about your account: your profile — identity, contact details, affiliation, biography, skills — the number of education and employment records, the projects you lead and those you have joined, the assessments you have received, the invitations you have sent and received, and your last sign-ins.

The same section states how long it is all kept: your account for as long as it is active, then twelve (12) months after its deletion, at the end of which it is irreversibly anonymised; sign-in logs for twelve (12) months; an invitation sent to somebody who never signed up, thirty (30) days.

Download my data

One button gives you a complete, machine-readable copy of the above, as a JSON file (article 32 of law 18-07). It is yours: you can keep it, read it or hand it to somebody else.

Delete my account

Deleting is confirmed with your password, and it is not undone by a click:

your account is disabled at once and you are signed out;
it is kept twelve (12) months, so that a mistake can be repaired;
past that it is anonymised, definitively and irreversibly;
what is needed for the traceability of funding decisions — that a proposal was submitted, assessed, funded — is kept in a form that no longer identifies you.

One case is refused: if you still lead a running project, deletion waits. Hand the leadership to another member of the team, or wait for the project to close. A funded project must always have somebody answerable for it.

Exercising a right

The bottom of the same page sends a request to the data protection officer. Choose what you are exercising:

Access to my data — the list and a copy of what is held about you (art. 32);
Rectification — have an inaccurate datum corrected, completed or updated (art. 35);
Erasure — ask for data concerning you to be erased (art. 35);
Objection — object, on legitimate grounds, to a processing operation on your data (art. 36);
Complaint — report a shortcoming to the controller before referring the matter to the national authority.

Write what you are asking for: which data, which correction, on what ground. You receive an acknowledgement by email, and an answer within ten (10) days (art. 34). The officer sees the deadline on every open request, and it turns red once passed. You may also write to the officer directly; the address is on the contact page and on the privacy policy.

Consent

Two things on this portal are done only if you say so, and each is asked for on its own.

The privacy policy, accepted when you sign up. The box is never pre-ticked, and what is stored is the moment you ticked it and the version of the text you accepted. When the policy changes, you are asked to accept the new one before using the portal again — nobody is exempt, administrators included.

The ORCID import, on your profile. Nothing is fetched from orcid.org until you authorise it; withdrawing the authorisation stops any further import and erases the record of it. See Education and employment.

What protects your account

A password checked against the lists of passwords known to have leaked.
Two-factor authentication, offered to every account and forced on none: turn it on from your profile and keep the recovery codes it gives you.
A register of operations in which sign-ins, sign-outs, failed attempts and the readings of personal data are written with their date and origin.
Encryption of the most sensitive fields of your profile in the database, and private files served only through signed links that expire.

Cookies

The portal sets only the cookies it needs to work: your session, the protection of the forms, your display language and theme. No audience measurement, no profiling, no advertising cookie, no third-party tracker. This is what the banner on your first visit says, and it is the whole of it.