Privacy & Cookie Policy
Last updated: July 2026
1. Who is responsible for your data
PXL University of Applied Sciences and Arts, Elfde-Liniestraat 24, 3500 Hasselt, Belgium ("PXL", "we", "us"), is the data controller for personal data processed through this website, as coordinator of the PULPIT Erasmus+ project (2023–2026, project consortium of 10 partner organisations across Europe).
For privacy questions: privacy@pxl.be. For general project questions: pulpit@enfermagem.ulisboa.pt or the contact form.
2. What personal data we collect
- Contact form: name, email address, phone number (optional), and the content of your message.
- Champion registration: name, email address, password (stored as a salted bcrypt hash, never in plain text), institution, country, preferred language, optional short bio, and optional profile photo.
- Champion directory & messaging: your name, institution and country are visible to other approved Champions; messages you send to another Champion include your name, institution and reply-to email address.
- E-learning activity: course progress, completion status, quiz/interaction data (xAPI statements) and earned badges, linked to your Champion account.
- Admin accounts: name, email address and password hash, for PXL staff who manage site content.
- Technical data: a session cookie that keeps you signed in, and standard web server logs (IP address, browser type, requested page) kept by our hosting provider for security and reliability purposes.
3. Why we process your data (purpose & legal basis)
| Purpose | Legal basis |
|---|---|
| Responding to your contact request | Legitimate interest in answering enquiries |
| Creating and managing your Champion account, granting access to the portal and e-learnings | Performance of a contract (our terms of participation) / consent given at registration |
| Displaying your profile to other Champions and enabling Champion-to-Champion messages | Consent (implicit in opting into the Champion directory at registration; you may ask us to hide your profile at any time) |
| Tracking e-learning progress and awarding badges | Performance of a contract |
| Sending project-related updates by email | Consent, withdrawable at any time |
| Security, fraud prevention and keeping the site running | Legitimate interest |
4. Who else sees your data (recipients & subprocessors)
We use the following service providers to operate this website. Each acts as our data processor and only processes data on our instructions:
- Microsoft (Azure, via PXL) — website and database hosting in the EU (all site content, accounts and e-learning progress).
- Upstash, Inc. — short-lived counters of IP addresses to block repeated login and form abuse.
- Cloudinary Ltd. — storage and delivery of images and uploaded e-learning course files.
- Resend — delivery of transactional emails (contact form replies, registration confirmations, Champion-to-Champion messages).
Some of these providers may process data on servers located outside the European Economic Area (EEA), including in the United States. Where this occurs, transfers are governed by the providers' Standard Contractual Clauses or an equivalent legal safeguard recognised under the GDPR. We do not sell your data to any third party, and we do not use advertising or analytics trackers.
5. How long we keep your data
- Contact form submissions: kept for as long as needed to handle your enquiry, and no longer than 2 years.
- Champion accounts: kept for the duration of the project (2023–2026) plus 1 additional year for archival and reporting obligations to the Erasmus+ programme, unless you ask us to delete your account sooner.
- Rejected Champion applications: deleted within 6 months of the decision.
- E-learning activity data: retained for as long as your Champion account exists, for the same period as above.
6. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to any legal retention obligations;
- Restrict or object to certain processing;
- Port your data to another provider in a structured, machine-readable format;
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact privacy@pxl.be. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.
7. Cookies
This website uses two categories of cookies. You control the second category through the cookie banner shown on your first visit, or at any time via the "Cookie settings" link in the footer.
| Category | Purpose | Consent required? |
|---|---|---|
| Strictly necessary | Keeps you signed in (session cookie) and protects the site against cross-site request forgery. Set by our authentication system (Auth.js). Cannot be disabled. | No — exempt under the ePrivacy rules as strictly necessary for a service you requested. |
| Media | Loads embedded YouTube videos. Once loaded, YouTube (Google) may set its own cookies (e.g. to remember playback preferences or measure views). | Yes — the video is only loaded after you accept this category. We use YouTube's privacy-enhanced (youtube-nocookie.com) embed mode to minimise this. |
We do not use advertising cookies, analytics trackers, or social media widgets that set cookies on this site.
8. Security
Passwords are never stored in plain text — they are hashed with bcrypt before being saved. The site is served exclusively over HTTPS, and access to administrative functions is restricted to authenticated PXL staff.
9. Children
This website is intended for healthcare professionals, students and educators, and is not directed at children. We do not knowingly collect personal data from individuals under 16.
10. Changes to this policy
We may update this policy from time to time, for example to reflect new features or legal requirements. The "last updated" date at the top of this page indicates when it was last revised.
11. Contact
For any question about this policy or your personal data, contact us via privacy@pxl.be, the contact form, or by post at the address in section 1.