Privacy policy

1. Who we are

EU Proposals (“the Platform”, at proposal.theplentygroup.eu) is operated by SIA "Plenty Group", registration No. 40203061230, Draudzības iela 6A k-1–37, Ogre, Ogres nov., LV-5001, Latvia (“we”). It is where we prepare EU funding proposals with our clients and the organisations they invite into a consortium. Access is by invitation only. For anything about your personal data, write to security@theplentygroup.eu.

2. Our two roles

• We are the controller for your user account, our records of how the Platform is used and secured, and our own reference library of organisations and researchers (section 5).
• We are a processor for the personal data an organisation provides about its own people for a proposal — for example CVs, researcher profiles, planned effort and personnel-cost figures. That organisation is the controller, and we act on its instructions under our Data Processing Agreement. If your details are in a proposal because your organisation provided them, please address requests to your organisation; we will help it respond.

3. What we collect, and where it comes from

• Account details — your name, email address, role and organisation, from whoever invited you.
• Sign-in security — your password (kept only in hashed form), your two-factor authentication set-up and recovery codes, and a record of sign-ins, failed attempts and lockouts, with the IP address.
• A record of what you do — each change you save (which item, such as a section, a partner or a budget line, and when; not a copy of what you wrote), each document you export, each request to an AI feature, changes to accounts and access, invitations and acceptance of these texts, with the time, whether it succeeded and the IP address.
• Usage information — while you are signed in, the pages you open (the full address, including the tab or view you choose on a page) and how long the Platform is in active use. See the Cookie notice.
• Content — proposal texts, comments, work plans, partner and researcher details, effort and budget figures, and files, entered by you, your organisation or us.
• An AI provider key — only if you add your own for the AI features; it is stored encrypted.
• Enquiries — if you contact us or use the “Work with us” form: your name, email, organisation and message.

You need to give your name and email address to have an account.

4. Why, and our legal basis

• To provide the Platform to you and the organisation you work with — under a contract with you (GDPR Art 6(1)(b)) where there is one, otherwise in our and that organisation’s legitimate interest in carrying out the engagement (Art 6(1)(f)).
• To keep the Platform secure and keep a record of who did what, which the administrator reviews to supervise the work on proposals, settle questions about changes and protect the Platform — legitimate interest (Art 6(1)(f)).
• To measure how the Platform is used — which pages each person opens and for how long — so we can run and improve it and the administrator can see how each person uses it — legitimate interest (Art 6(1)(f)). You can object (section 9).
• To build consortia and prepare proposals from our reference library — legitimate interest (Art 6(1)(f)).
• To answer enquiries — at your request before a contract (Art 6(1)(b)), or legitimate interest.

We do not make decisions about you by automated means alone (Art 22). AI features only prepare drafts, analyses and suggestions for people to review.

5. Our reference library

We keep a library of organisations we work with or may work with, and of researchers and contact persons at them, to build consortia and prepare proposals. It holds professional information only — names, roles, affiliations, contact details, publications, research identifiers and project track records — obtained from the organisations themselves (for example the administrative forms partners provide for a proposal) and from public sources such as publication databases and records of EU-funded projects. Only our own staff use it. You can ask what we hold about you, have it corrected or deleted, or object to it, at security@theplentygroup.eu.

6. How long we keep it

• Account details — while your account is active; after it is closed, deleted or anonymised within 90 days.
• Sign-in and security records, and the record of what each person does — 365 days, also after an account is closed.
• Usage information — 90 days.
• Content — for the engagement or proposal it belongs to, as agreed with the organisation that provided it; then returned or deleted as our Data Processing Agreement describes, unless the law requires us to keep it.
• Reference library — for as long as it remains relevant to our work, or until you ask us to delete it.
• Enquiries — as long as needed to answer them and for any engagement that follows.

7. Who we share it with

• Our staff, on a need-to-know basis.
• The Platform's administrators, who see, for each person, the record of what they do and their usage information (section 3), and all content, including the Strategy profiles and funding calls people keep. The contents of your Canvas boards and Sketchbook items are the exception: only you see them, unless you share them.
• The other people invited to the same proposal, who see the names and contributions of those working on it.
• Service providers for hosting, email and AI features, bound by data-processing terms. Organisations can see the specific list in our Data Processing Agreement.
• Otherwise only where the law requires it.

8. Transfers outside the EU/EEA

The Platform runs in the EU. Some of our providers are established in the United States; transfers to them rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards.

9. Your rights

You can ask for access to your personal data, and for its correction, erasure or restriction, or a portable copy, subject to what the law requires us to keep. You can object to processing based on legitimate interest — including the usage measurement and our reference library. If you object to the usage measurement, we switch it off for your account and delete what it has recorded. You can also object to the record of what you do; because it serves security and accountability for work shared with others, we will tell you whether compelling legitimate grounds require us to keep it (Art 21(1)). Write to security@theplentygroup.eu. Where we act as a processor, we pass your request to the organisation concerned. You can also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv) or to the authority where you live.

10. Security

Every account uses two-factor authentication, each person sees only the proposals they are invited to, data is encrypted in transit, AI provider keys are encrypted at rest, and we keep regular backups.

11. Cookies and similar technologies

We use sign-in cookies that are strictly necessary, browser storage for display preferences you choose, and the usage measurement described above. Details are in the Cookie notice.

12. Changes and contact

If we change this policy we will update the date above; for a significant change we will ask account holders to accept the new version when they next sign in. Contact: SIA "Plenty Group", security@theplentygroup.eu.