Privacy notice

Last updated: 16 September 2026

This notice explains how the ELEVATE doctoral network handles personal data collected through this website. It covers applicants, the referees they name, and visitors to the site. It does not cover other websites of the consortium's partner institutions, each of which has its own policy.

In short

  • We collect only what we need to run the recruitment: your application, your referees' contact details, and their reference letters.
  • Your data is used to assess applications for ELEVATE doctoral positions and for nothing else. We do not use it for marketing and we do not sell it.
  • It is stored on servers in the European Union and shared only with the people who evaluate applications.
  • We keep it for no longer than six months after the positions have been filled, unless you are recruited.
  • The site uses one essential cookie and no tracking or analytics.
  • You can ask to see, correct or delete your data at any time: recruitment@elevate-ejd.eu.

Who is responsible for your data

The data controller is the University of Cyprus, on behalf of the ELEVATE consortium.

  • Data Protection Officer, University House "Anastasios G. Leventis", 1 Panepistimiou Avenue, 2109 Aglantzia, Nicosia, P.O. Box 20537, 1678 Nicosia, Cyprus
  • Recruitment team: recruitment@elevate-ejd.eu
  • Data Protection Officer: dpo@ucy.ac.cy, +357 22894361

What we collect, and why

If you apply

Data Why
Your name and email address To identify your application, confirm receipt, and contact you about it
Your project preferences To route your application to the right supervisors
Documents you upload (CV, transcripts, cover letter, anything else you add) To assess your application
Your referees' names and email addresses To request reference letters on your behalf
The date and time you applied, your IP address and your browser type To keep a record of the submission and to detect and prevent abuse of the form
Copies of the emails we send you So we have a record of what we told you and when

Legal basis: processing is necessary to take steps at your request before entering into an employment contract (GDPR Article 6(1)(b)).

If you are named as a referee

The applicant gave us your name and email address, and told us you had agreed to provide a reference. We use them only to send you a secure upload link and to confirm receipt. We also store the letter you upload, when you uploaded and confirmed it, and copies of the emails we sent you.

Your reference letter is never shown to the applicant.

Legal basis: our legitimate interest in obtaining references to assess candidates fairly (GDPR Article 6(1)(f)).

If you were not expecting this request, or do not wish to provide a reference, contact us at recruitment@elevate-ejd.eu and we will delete your details.

If you just visit the site

We do not keep access logs of the pages you visit. To protect the forms from abuse, our server briefly holds visitors' IP addresses in memory to count requests. These counts are never written to disk.

Cookies

The site sets one cookie, named session. It is strictly necessary:

  • It protects the forms against cross-site request forgery.
  • It lets the confirmation page show your application right after you submit.
  • It keeps staff logged in to an internal page.

It expires when you close your browser; for staff it lasts up to 7 days. Because it is strictly necessary, it does not require your consent. There are no analytics, advertising or third-party cookies, and the site loads no content from other websites.

Who can see your data

  • Evaluators: members of the ELEVATE recruitment and evaluation committees at the consortium's partner institutions.
  • Service providers who process data on our behalf under data-processing agreements, and only as needed to run the site:
    • website hosting: Akamai/Linode, Germany
    • sending emails: Scaleway, France
    • the recruitment mailbox: Migadu, Switzerland
    • encrypted backups: Backblaze, data centre in Amsterdam, Netherlands. Backups are encrypted before they leave our server, so the provider cannot read them.
  • Funders and authorities: the European Commission / European Research Executive Agency, or other public authorities, where the law or the grant agreement requires it (for example an audit).

We do not sell your data or use it for marketing.

Where your data is stored

On servers in the European Union and Switzerland.

How long we keep it

  • Unsuccessful applicants and their referees: deleted no later than six months after the positions have been filled.
  • Recruited candidates: your application becomes part of your employment record at the hiring institution and is kept under that institution's policies.
  • Backups: deleted data can remain in encrypted backups for up to six more months, after which the backups are destroyed. It is not restored or used during that time.
  • Server error logs: these can contain an email address, for example when a message fails to send. They are kept for a maximum of six months.

How we protect it

  • The site is served only over encrypted connections (HTTPS).
  • Uploaded documents are stored on the server, never in a publicly accessible location.
  • Links in our emails are unique and time-limited.
  • Access is restricted to the few people who need it.
  • Backups are encrypted.

Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy;
  • correct inaccurate or incomplete data;
  • erase your data (as an applicant, this withdraws your application);
  • restrict processing while a request is being resolved;
  • object to processing based on legitimate interest (relevant to referees);
  • data portability: receive the data you gave us in a machine-readable form.

To exercise any of these, email recruitment@elevate-ejd.eu or our Data Protection Officer. We respond within one month. We make no decisions about you by purely automated means: every application is assessed by people.

You also have the right to complain to the supervisory authority:

Office of the Commissioner for Personal Data Protection

  • Iasonos 1, 1082 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia)
  • Tel. +357 22 818 456
  • commissioner@dataprotection.gov.cy
  • www.dataprotection.gov.cy

Changes to this notice

If we change this notice, we will update the date at the top of this page.