BLOSSOM Bankability Tool - Privacy Policy
1. About this policy and who we are
This policy explains how Climate KIC handles your data when you use the BLOSSOM Bankability Tool at https://bankability-tool.blossom-project.eu/. The tool helps cities and regions assess the bankability of climate adaptation projects and build a financing strategy.
The tool was developed under the BLOSSOM project, funded by the European Union's Horizon Europe programme (Grant Agreement No. 101214563). Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Climate, Infrastructure and Environment Executive Agency (CINEA). Neither the European Union nor the granting authority can be held responsible for them.
The data controller is Stichting Climate-KIC International Foundation, a foundation (no. 77373154) duly incorporated under the laws of Netherlands, with its registered office at Plantage Middenlaan 45, 1018 DC Amsterdam, the Netherlands, (Foundation). For any questions about this policy or your data, contact privacy.office@climate-kic.org.
2. What data we collect
We collect only what the tool needs to work. We collect no data for advertising or tracking.
| Category | What it includes | When we collect it |
|---|---|---|
| Account data | Your email address, your password (stored only in a hashed form that nobody can read, including us), your role, your sign-up date and your last sign-in time | When you register or an administrator creates your account |
| Project data | The information you enter about your projects (use cases), such as costs, revenues, risks, funding sources and assessment answers, plus the scores, shortlists and reports the tool generates | As you use the tool |
| Guest data | Project data entered without an account, linked only to a random ID, with no email address, name or IP address (see Section 5) | If you use the tool without an account |
| Technical logs | Which pages and functions were used, and an approximate location (city or region) derived from your IP address. We do not store the IP address itself. | Each time you use the tool |
| Sign-in cookie | A strictly necessary cookie that keeps you signed in | When you sign in |
Project data can include free text, such as project descriptions and locations. This may identify a city, organisation or person, and may be commercially sensitive. Please avoid entering personal data about other people or confidential information belonging to third parties in these free-text fields.
Creating an account is optional: you can always use the tool as a guest.
3. Why we use your data and our legal basis
We use your data only to provide the tool to you. That means:
- creating and managing your account
- saving your projects so you can return to them
- generating your scores, recommendations and reports
- keeping the tool secure and fixing problems
- reporting anonymous, aggregate usage figures to CINEA (the European Climate, Infrastructure and Environment Executive Agency), which funds BLOSSOM.
Our legal basis under the GDPR is Article 6(1)(f), our legitimate interest in providing a publicly funded tool to cities and regions, keeping it secure and reporting on the project to its funder.
4. Where your data is stored and how we protect it
Your data is stored in Climate KIC's own Microsoft Azure environment in the West Europe region (the Netherlands), within the European Union. This covers the tool, its database, backups and technical logs.
We protect it in these ways:
- Encryption. Data is encrypted in transit and at rest.
- Controlled access. Anyone can use the tool as a guest. Creating an account requires a sign-up code from Climate KIC.
- Separate storage. Guest data is kept in a separate database table and never mixed with account data.
- Session limits. Sign-in sessions expire after 12 hours of inactivity.
- Backups. Database backups are kept for 7 days, in the same region.
Who at Climate KIC can see your data:
- Tool administrators can see every account's email address, sign-up and last sign-in dates, and all project data (read-only). They can also create and delete accounts and reset passwords.
- Technical staff with administrator rights on the underlying Azure environment could technically access the database. They do so only to run, secure and support the tool. Access is limited to named staff who need it for that purpose, is logged, and is covered by confidentiality obligations.
Password resets are handled by an administrator on request.
5. Using the tool without an account
You can use the tool as a guest without registering. Guest data is linked only to a random ID, with no email address, name or IP address, and is kept separate from account data.
Your guest work is saved in two places:
- On our server, so your work is not lost. We delete it automatically 30 days after your last edit.
- In your browser's local storage, so your work survives a page refresh. It stays only in that browser on that device, your browser may delete it, and it is erased if you clear your browsing data or use private mode. On a shared computer, the next person could see your work, so clear your browsing data when you finish.
You can also export your work to a file and import it later. If you create an account, your guest work moves into your new account.
We use guest inputs to understand how the tool is used and to improve it. Guest data is not fully anonymous: free text you enter could identify a city or a person.
6. Who we share your data with
We use these service providers. None of them receive the project data you enter for its own use.
| Provider | Role | What it can access |
|---|---|---|
| Microsoft Azure | Hosts the tool, database and technical logs as our data processor | Stored data, with no routine access under Microsoft's data protection terms |
| GitHub (Microsoft) | Stores the tool's source code | No user data |
| Sprinto | Climate KIC's compliance-monitoring tool | Read-only access to the Azure configuration and technical logs, not the database |
| Google Fonts | Supplies a font used on the tool's pages | Your IP address, which your browser sends when the page loads. No project data. |
If we ever plan to share project data with BLOSSOM consortium partners, we will update this policy and ask for your consent before sharing it.
We do not currently use your project data for benchmarking or research. If we plan to, for example to build anonymised comparisons across projects, we will update this policy and ask for your consent first.
7. How long we keep your data
| Data | Kept for |
|---|---|
| Account and project data | Until the account is deleted. There is currently no time limit. |
| Deleted accounts | Removed immediately; backup copies expire within 7 days |
| Guest data on our server | 30 days after your last edit |
| Guest data in your browser | Until you or your browser clear it; we cannot delete it remotely |
| Technical logs | 90 days |
| Sign-in sessions | 12 hours of inactivity |
You can delete individual projects and export your data (Excel or JSON) at any time. You can ask us to delete your whole account at any time (see Section 9). We will do so without undue delay and within one month at the latest.
8. Cookies and browser storage
The tool uses no analytics, advertising or tracking tools. The only cookie is the sign-in cookie.
| Item | Purpose | How long it lasts |
|---|---|---|
| Sign-in cookie | Keeps you signed in securely | Until you sign out, or after 12 hours of inactivity |
| Guest browser storage | Saves guest work on your computer (Section 5) | Until you or your browser clear it |
Because these are strictly necessary for the tool to work, we do not ask for cookie consent.
9. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you
- correct inaccurate data
- have your data deleted
- receive your data in a portable format (you can also export your projects from the tool yourself)
- object to how we process your data or ask us to restrict it
To use any of these rights, email privacy.office@climate-kic.org. We will reply within one month.
If you are unhappy with how we handle your data, you can complain to your national data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens. The tool generates scores and recommendations for projects. We do not make decisions about you based on automated processing of your personal data.
10. Changes to this policy and contact
We will update this policy if the tool or our use of data changes, for example if we start benchmarking. We will tell registered users about significant changes before they take effect. Last updated: 4th November 2026. Questions: privacy.office@climate-kic.org.