Privacy Policy

01 Controller and scope

This Privacy Policy explains how Montana Research Foundation acts as controller for personal data processed through the Montana Research Foundation website, inquiries sent through it, and related communications. It applies when you browse the website, contact us, apply to join or collaborate with the foundation, or otherwise interact with us in a professional context.

02 Who this policy applies to

This policy is relevant to website visitors, researchers, prospective collaborators, applicants, press contacts, supplier contacts, and any other individuals whose personal data may be processed in the course of our communications, research activities, and operational administration.

03 Categories of personal data

• Identity and contact data such as name, email address, phone number, and location, where you choose to provide them.
• Inquiry and correspondence data, including the topic, affiliation, and message you submit through the contact form, or information shared by email, calls, or meetings.
• Academic and professional data submitted with internship or partnership applications, such as university or institution name, degree program and expected graduation, department, role, and areas of interest.
• Name, email address, and optional affiliation submitted to read or download a report or preprint, together with which document was requested.
• Links you provide to external profiles, such as a CV or resume, portfolio, GitHub, or LinkedIn.
• Availability and collaboration preferences you provide when applying, such as your availability window or the type of collaboration proposed.
• Technical data such as IP address, browser type, device information, pages requested, and timestamps, as recorded in ordinary server and hosting logs.

04 Sources of personal data

We collect personal data directly from you, automatically through your use of the website, from your employer or institution where you engage with us on its behalf, or from publicly available professional sources such as institutional pages, publication records, or introductions relevant to our research.

05 Purposes of processing and legal bases

• To respond to inquiries, applications, and collaboration requests, and to communicate with you. Our legal basis is our legitimate interest in operating the foundation and, where relevant, taking steps at your request before entering into an agreement.
• To provide access to a report or preprint you request, and to know who has read or downloaded our published work. Our legal basis is our legitimate interest in understanding and reporting on the reach of our research.
• To manage collaborations, contracts, compliance, and record-keeping. The legal basis may include contract performance, legal obligation, and legitimate interests.
• To maintain the security, availability, and performance of the website and related systems. The legal basis is our legitimate interest in protecting our services and infrastructure.
• To understand aggregate website usage through cookieless analytics that do not identify you individually. Our legal basis is our legitimate interest in understanding how the website is used.
• To measure website usage through Google Analytics, which uses cookies that identify your browser individually. Our legal basis is your consent, given through the cookie banner; Google Analytics is not loaded unless you accept, and you can withdraw consent at any time through "Cookie settings" in the footer.

06 Legitimate interests

Where we rely on legitimate interests, those interests include running and improving the foundation, answering inquiries efficiently, protecting our systems, documenting communications, managing relationships with collaborators and suppliers, preventing misuse of the website, and maintaining records needed for governance and continuity. We seek to do this in a way that respects the rights and expectations of the individuals concerned.

07 Sensitive or special category data

We do not intend to collect special category personal data through the website. If you voluntarily provide information of that nature, please avoid sharing more than is reasonably necessary.

08 Recipients and processors

We share personal data with a small number of service providers who help us operate the website and communicate with you. Those providers act under appropriate contractual safeguards where they process personal data on our behalf. We may also disclose information where necessary to comply with applicable law, enforce our rights, or protect the security of our systems.

09 Service providers we use

• Website hosting, CDN, DNS, and domain providers that serve the site and keep ordinary access logs. Web fonts are served from our own origin, not a third-party font provider.
• Cloudflare Web Analytics, a cookieless analytics service that measures aggregate page views and traffic without setting a cookie, using local storage, or building an individual profile of you. Cloudflare’s privacy policy (cloudflare.com/privacypolicy) describes how it handles this data.
• Google Analytics (GA4), which measures individual sessions and returning visits using cookies, only if you accept analytics cookies in the cookie banner. Google states that Google Analytics removes or truncates IP addresses from EU, UK, and Swiss visitors before logging data. Google’s privacy policy and data processing terms (policies.google.com/privacy) describe how it handles this data.
• Formspree, Inc., which receives and forwards messages submitted through the contact, internship, partnership, and report/preprint access forms. Formspree’s own privacy policy (formspree.io/legal/privacy-policy) describes how it handles that data.
• Cloudflare D1, a database used to record which report or preprint was accessed, by which email address, and when. This record exists so we know who reads our published work; it is separate from the message Formspree receives when you first request access.
• Email, scheduling, and productivity tools used to reply to you.
• Professional advisers, accountants, auditors, or legal advisers where required.

10 International transfers

Formspree, Inc., which processes messages submitted through our forms, is based in the United States, so personal data submitted through those forms is transferred outside the European Economic Area. We rely on the contractual commitments described in Formspree’s own privacy policy for that transfer. We have not separately verified that Formspree holds an EU-U.S. Data Privacy Framework certification or has executed Standard Contractual Clauses with us, and we encourage you to review Formspree’s privacy policy directly if this matters to you. If you accept Google Analytics cookies, Google LLC, also based in the United States, will process the resulting data; Google states that it is certified under the EU-U.S. Data Privacy Framework and that it removes or truncates EU, UK, and Swiss IP addresses before logging analytics data. Other service providers, such as our hosting, CDN, or DNS provider, may also process data outside the European Economic Area under their own standard safeguards. If you would rather not have your information transferred outside the EEA, please contact us so we can discuss an alternative way to reach us.

11 Data minimisation

We aim to collect only the information that is reasonably necessary for the relevant purpose and to avoid holding data longer or more broadly than needed. The contact form asks for a name, an email address, an optional affiliation, a topic, and your message. The internship and partnership application forms ask for additional academic or professional details, such as university, degree program, or institution, because that information is necessary to evaluate an application; fields not required for that purpose are marked optional. The report/preprint access form asks only for a name, an email address, and an optional affiliation, plus which document you requested.

12 Retention

We keep personal data only for as long as it is reasonably necessary for the purpose for which it was collected, including managing inquiries, documenting communications, fulfilling agreements, complying with legal obligations, resolving disputes, and protecting our legitimate interests. Retention periods vary depending on the nature of the relationship and the information involved.

13 Retention approach in practice

• General inquiry correspondence is retained for a reasonable period to manage follow-up, and deleted once it is no longer needed.
• Internship and partnership applications that do not proceed are retained for up to 12 months from submission, then deleted, unless a longer period is needed to comply with law or resolve a dispute.
• Report and preprint access records (email address, document, and timestamp) are retained to maintain an ongoing record of who has read our published work, and are not subject to a fixed deletion schedule; you may request erasure as described under "Your rights under the GDPR" below.
• Collaborator and supplier records are retained for the life of the relationship and for an additional period where needed for legal, tax, accounting, or contractual reasons.
• Technical logs are retained by our hosting providers for their standard periods, in line with security and operational needs.

14 Security

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, misuse, loss, alteration, or disclosure. No transmission or storage system can be guaranteed to be completely secure.

15 Automated decision-making

We do not use solely automated decision-making that produces legal effects or similarly significant effects on individuals through this website. If that changes, we will update this policy and provide the legally required information.

16 Children

Our website is intended for research and professional audiences. We do not knowingly collect personal data from children. If you believe that a child has submitted personal data to us in error, please contact us so we can review and address it.

17 Your rights under the GDPR

• Right of access to the personal data we hold about you.
• Right to request rectification of inaccurate or incomplete personal data.
• Right to request erasure in circumstances provided by law.
• Right to request restriction of processing in certain cases.
• Right to object to processing based on legitimate interests, including direct marketing where applicable.
• Right to data portability where processing is based on consent or contract and carried out by automated means.
• Right to withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.

18 Exercising your rights

To exercise any of these rights, use the contact form and select "Privacy request" as the topic. We may ask for information necessary to verify your identity and understand the request. Certain rights are not absolute and may be limited where exemptions or conflicting legal obligations apply.

19 Complaints and contact

If you believe our processing of your personal data does not comply with applicable data protection law, you may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy). You may also contact us first through the contact page, selecting "Privacy request" as the topic, so we can try to address the issue directly.

20 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, guidance, website functionality, providers, or internal practices. The latest version published on the website will apply from its effective date.