3.1 Does your organisation collect, store, use or share any personal data in DiverSea? (e.g. names, e-mails, affiliations, photos, videos, recordings, attendance lists, survey answers)

3.2 Do you receive personal data from other DiverSea partners?

3.3 Do you send personal data to other DiverSea partners or to people/organisations outside the consortium?

4.1 Citizen science activities

4.2 Workshops, forums, stakeholder meetings or events

4.3 Surveys, interviews or questionnaires

4.4 Online meetings that are recorded

4.5 Names and contact details (e-mail, phone)

4.6 Institution, school or employer

4.7 Photos, video or audio recordings of people

4.8 Location data linked to a person (e.g. GPS of citizen science observations)

4.9 Special categories of data (health, ethnicity, religion, political opinion, genetic or biometric data)

4.10 Children or minors (under 18) take part

4.11 People who may be vulnerable or unable to give informed consent take part

4.12 Representatives of army, navy, coast guard or other security bodies take part (see also Section 12)

5.1 We know and have written down the legal basis for each type of processing (usually consent).

5.2 Participants get a clear information sheet before taking part (who we are, why we collect data, how long we keep it, their rights, contact person).

5.3 The information sheet and consent form are in a language the participants understand.

5.4 We collect written or electronic informed consent before collecting any personal data.

5.5 Consent for photos, videos and recordings is asked separately and clearly.

5.6 For children, we collect consent from a parent or legal guardian, and assent from the child.

5.7 We keep the signed consent forms in a safe place and can show them if asked.

5.8 Consent was in place before the first citizen science / stakeholder activity started. (If NO, give dates in the comment field.)

6.1 Participants are told they can withdraw at any time, without giving a reason.

6.2 We have a simple procedure for withdrawal (who to contact, how).

6.3 When someone withdraws, we delete their personal data (or explain clearly why some data cannot be deleted, e.g. already anonymised).

6.4 We have set a deadline for withdrawal of data (e.g. up to 2 weeks after data collection), and participants are told about it. (Write the deadline in the comment field.)

6.5 We can answer requests from people who want to see, correct or delete their data.

6.6 Participants have a named contact person for data questions.

7.1 We only collect personal data that is really needed for the DiverSea task.

7.2 We use personal data only for the DiverSea purposes explained to participants.

7.3 Where possible, we anonymise or pseudonymise data (remove or replace names) before analysis.

7.4 We do not use personal data for profiling, tracking or systematic monitoring of individuals.

8.1 Files with personal data are encrypted when stored (e.g. encrypted drives, encrypted cloud storage). (Name the tool in the comment field.)

8.2 Data is encrypted when sent (e.g. HTTPS, secure file transfer, no unprotected e-mail attachments).

8.3 Access is protected by passwords and, where possible, two-factor authentication.

8.4 Only named staff who need the data have access to it.

8.5 Laptops, USB sticks and external drives with personal data are encrypted.

8.6 Paper forms (e.g. signed consent forms) are kept in a locked place.

8.7 Regular back-ups are made and stored securely.

8.8 Personal data on the DiverSea project platform / dashboard is protected by access control.

9.1 We know the physical location of all servers where we keep DiverSea personal data, including cloud storage. (Write the provider and country in the comment field.)

9.2 All DiverSea personal data is stored on servers inside the EU/EEA.

9.3 Personal data collected in a non-EU/EEA country (e.g. Ghana, Tanzania, Türkiye, Ukraine, UK) is transferred into the EU/EEA.

9.4 Personal data is sent from the EU/EEA to a non-EU/EEA country.

9.5 If data leaves the EU/EEA, a legal safeguard is in place (EU adequacy decision or Standard Contractual Clauses). (Name it in the comment field.)

9.6 Data collected in a non-EU/EEA country also follows that country’s national data protection law.

9.7 We did not send any personal data to UC San Diego while it was a DiverSea partner (relevant to Recommendation R1).

10.1 We have set a retention period for DiverSea personal data. (Write the period in the comment field, e.g. “until end of project + 5 years”.)

10.2 The retention period is written down and told to participants.

10.3 Personal data is deleted or anonymised when the retention period ends.

10.4 We use a secure deletion method (not only moving files to the recycle bin).

10.5 Contact lists for newsletters or events are kept separately and people can unsubscribe.

11.1 Our organisation has a Data Protection Officer (DPO) or a named person responsible for data protection.

11.2 The DPO (or responsible person) has been informed about our DiverSea activities and has checked them.

11.3 Our DiverSea processing is listed in our organisation’s record of processing activities (GDPR Art. 30).

11.4 We have checked whether a Data Protection Impact Assessment (DPIA) is needed and, if needed, done it.

11.5 Our organisation has an ethics committee, or access to one, that can review DiverSea activities.

11.6 We have a procedure for data breaches, including reporting to the authority within 72 hours when required.

11.7 Staff working with DiverSea personal data have had basic GDPR / data protection training.

11.8 We have data processing agreements with external service providers (e.g. cloud, survey tools, subcontractors) that handle personal data for us.

11.9 We share personal data with other DiverSea partners only under agreed rules (e.g. Consortium Agreement, data sharing agreement).

12.1 Personal data and project data we collect are used for civil purposes only.

12.2 No personal data is given to army, navy, coast guard or intelligence bodies, even if their representatives attend as observers.

12.3 Observers from security bodies are informed that project data is for civil use only.

13.1 We use AI or machine learning tools in DiverSea.

13.2 Personal data (e.g. photos with people, names, citizen scientist records) is used as input to AI tools.

13.3 If YES above: we have checked that the AI tool provider stores and handles this data in line with the GDPR.

13.4 Faces and other identifying details are removed or blurred from images before AI processing, where possible.

14.1 Overall, our organisation handles DiverSea personal data in line with the GDPR (or, for non-EU/EEA partners, in line with GDPR-equivalent standards when handling data of EU/EEA residents).