Privacy Policy

The following privacy policy informs you about the nature, scope, and purpose of the processing of personal data on the website of the European Humanoid Reference Platform (EHRP) in accordance with the General Data Protection Regulation (GDPR) and the German Telecommunications-Telemedia Data Protection Act (TDDDG).

1. Controller

The controller responsible for data processing on this website pursuant to Art. 4(7) of the General Data Protection Regulation (GDPR) is:

European Humanoid Reference Platform (EHRP)
(in formation / in Gründung)
c/o isento GmbH
Ostendstraße 242
90482 Nuremberg, Germany
Commercial Register: Amtsgericht Nürnberg HRB 33143
Managing Director: Dr. Shota Okujava
E-mail: contact@ehrp.eu

2. Hosting and Server Logs

This website is statically hosted on servers located within the European Union (Germany).

When you visit this website, the web server automatically records technical connection parameters in server log files. The recorded data includes:

• IP address of the accessing system (anonymized or stored strictly for security purposes)
• Date and time of the request
• Requested URL and HTTP method
• HTTP status code
• Transmitted volume of data in bytes
• Referrer URL (if transmitted by your browser)
• Browser type, version, and operating system

The temporary processing of this data is necessary to deliver the website, ensure stability and operational security, and prevent denial-of-service attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and fault-free technical operation of the website). Server logs are automatically deleted or anonymized within 7 to 14 days, unless preservation is required to investigate security incidents.

3. Contact and Contributions by E-mail

When you reach out to us by e-mail (e.g. via contact@ehrp.eu or comments@ehrp.eu), the personal data transmitted with your message (such as your name, e-mail address, organizational affiliation, and the content of your inquiry or technical feedback) is processed solely to respond to your request and coordinate standardisation activities.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with industry peers, working groups, and researchers) or Art. 6(1)(b) GDPR if the inquiry concerns membership or contractual steps. Data is deleted once your request is resolved, provided statutory retention periods do not require continued storage.

4. Web Form Inquiries and Concept Proposals

When you submit an inquiry, request working group participation, or submit a technical concept proposal via our web forms, the personal data provided in the form fields (such as your salutation, first and last name, organisation or institution, business e-mail address, focus area, and message or proposal details) is collected and stored.

Purpose and legal basis: Processing of this data is strictly purposeful to evaluate and respond to your inquiry, coordinate working group access, or process technical proposals (Art. 6(1)(b) GDPR for steps leading toward participation or cooperation, and Art. 6(1)(f) GDPR for our legitimate interest in facilitating transparent European robotics standardisation). Form data is retained for the duration of the collaborative evaluation and deleted once the inquiry or proposal process has concluded, unless statutory or archival retention rules apply.

5. CRM and Website Analytics / Tracking via HubSpot

We use the cloud-based CRM and web analytics infrastructure of HubSpot (HubSpot Ireland UC, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland / HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA).

Customer Relationship Management (CRM): When you submit an inquiry, concept proposal, or review comment via our forms, your contact details, organization, and message context are processed within our HubSpot instance and made accessible to designated EHRP secretariat and working group leads for coordination.

Website Tracking and Web Analytics: Our website integrates the HubSpot tracking code (loader script). This code enables us to analyze how visitors navigate our website, which documentation and specification drafts are viewed, time spent on pages, and interaction patterns. The collected information helps us optimize our documentation, evaluate stakeholder engagement with technical specifications, and ensure platform performance.

HubSpot utilizes tracking technologies, including first-party cookies (e.g. __hstc, hubspotutk, __hssc, __hssrc) and browser storage, to distinguish unique visitors, track sessions, and monitor form interactions. The data collected includes IP address (truncated/anonymized where applicable), approximate geographic location (country/region), browser type, referring URL, and visited pages.

Legal basis: Processing of contact and form data is based on Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interest in efficient communication). Website tracking and analytics processing is based on Art. 6(1)(f) GDPR (our legitimate interest in analyzing web traffic, measuring document reach, and improving pre-standardization material) and § 25(2) TDDDG.

Data Processing Agreement and International Transfers: We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with HubSpot. Where personal data is transferred to HubSpot, Inc. in the United States, such transfers are safeguarded under the EU-U.S. Data Privacy Framework (DPF) and the European Commission's Standard Contractual Clauses (SCCs).

Opt-out: You can prevent HubSpot from collecting and processing your data by configuring your browser to reject cookies, using browser privacy extensions (such as script blockers), or enabling "Do Not Track". Further details on HubSpot's data protection practices can be found at: https://legal.hubspot.com/privacy-policy.

6. Newsletter and Milestone Updates via rapidmail

For sending platform announcements, specification milestone updates, and founding assembly notices, we utilize the German newsletter service provider rapidmail (rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i.Br., Germany).

If you subscribe to updates (e.g. via our contact forms or update opt-in fields), the data you enter (such as your e-mail address and, optionally, your name and organization) is transmitted to and stored on rapidmail's ISO 27001-certified servers located exclusively within Germany (European Union).

Double Opt-in Procedure: Subscriptions follow a verifiable Double Opt-in (DOI) procedure. After submitting your subscription request, you receive a verification e-mail from rapidmail containing a confirmation link. The subscription is activated only after you click this confirmation link. The registration timestamp, IP address, and confirmation time are logged for proof of compliance under Art. 7(1) GDPR.

Performance Measurement: Newsletters sent via rapidmail may contain a technical web beacon (tracking pixel) and tracked links to evaluate statistical open rates and click rates. This statistical analysis is used exclusively to improve the relevance and technical quality of our communications.

Legal basis: The dispatch of newsletter updates and associated performance measurement are based on your explicit consent pursuant to Art. 6(1)(a) GDPR.

Right of Withdrawal: You can withdraw your consent to receive updates at any time with effect for the future. An unsubscribe link is included at the bottom of every newsletter, or you may contact us at contact@ehrp.eu.

We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with rapidmail GmbH. Further information regarding rapidmail's privacy and security measures is available at: https://www.rapidmail.de/datenschutz.

7. Access to the Drafts Area

Access to full normative pre-publication drafts and working group specifications under /drafts/ is restricted to participating organizations via Bearer Token authentication (with the exception of the Signal Convention draft, which is freely accessible for public review).

• Tokens are issued on an organizational basis (one token set per member organization).
• Authentication tokens are verified directly by the web server configuration when requesting protected content fragments.
• No individualized tracking, profiling, or behavioral monitoring of draft access takes place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in safeguarding working drafts and collaborative pre-standardization material prior to official consensus and release). Organizational tokens can be modified or revoked upon request.

8. Cookies and Local Storage Technologies

Our website utilizes limited storage technologies for operational and analytical purposes:

• HubSpot Analytics Cookies (Opt-in via Cookie Banner): As detailed in Section 5, HubSpot sets first-party analytics cookies only after you have given your explicit consent via our cookie consent banner. If you choose "Essential only", no analytics cookies or tracking scripts are loaded.
• SessionStorage for Draft Access: When an authorized member authenticates to access restricted working drafts under /drafts/, the Bearer Token is stored strictly locally in your browser's temporary session storage (SessionStorage) for the duration of the browser tab so you do not need to re-enter it on each document. It is never transmitted to analytics providers or third parties.
• Self-Hosted Core Assets: Fonts, stylesheets, icons, and document downloads are self-hosted on our European server infrastructure to minimize unnecessary third-party data transmission.

Managing your consent: You can adjust or revoke your cookie and analytics preferences at any time by clicking the "Cookie settings" button in the footer of our website.

9. Your Rights under the GDPR

As a data subject, you hold the following rights under Articles 15 to 21 GDPR regarding personal data concerning you:

• Right of access (Art. 15 GDPR): Confirmation as to whether data is processed and details regarding that processing.
• Right to rectification (Art. 16 GDPR): Correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17 GDPR): Deletion of your stored personal data where grounds apply.
• Right to restriction of processing (Art. 18 GDPR): Restriction of data processing under statutory conditions.
• Right to data portability (Art. 20 GDPR): Receiving your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): Right to object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR).

To exercise any of these rights, please contact us at contact@ehrp.eu.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The responsible supervisory authority for our jurisdiction in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Website: www.lda.bayern.de