SHARE-SoHO Platform Privacy Statement and Cookie Policy


This Privacy Policy describes how the SHARE-SoHO platform (accessible via https://www.sharesoho.eu) processes personal data. SHARE-SoHO operates as a standard Moodle Learning Management System (LMS) dedicated to educational and collaborative activities within the framework of the SHARE-SoHO service.

Last updated: 11 September, 2026

Data controller and data ownership

During the active lifecycle of the service, the data controller is European Health and Digital Executive Agency - HaDEA (Head of Unit HaDEA A.2). KPMG Advisory acts as processor, and Zadig as sub-processor for this platform.
Upon final completion of the service, full control, ownership, and responsibility for the project assets and data will be transferred to the HaDEA / European Commission.
Non-acceptance of the Privacy policy does not allow you to proceed with registration, as the data requested is essential for the provision of the Service itself.

How user accounts are created (no open registration)

Users cannot register freely or create accounts on their own via the website.
User profiles are generated manually by platform administrators using official lists provided directly by the competent national authorities of participating European Member States.
The personal data processed during account creation typically includes basic identification and contact details (e.g., first name, last name, email address).

Purpose and legal basis for data processing

Personal data is processed strictly for the following purposes:

  • Providing access to the Moodle learning platform and its course contents.
  • Managing user participation, activities, and educational/collaborative progress.
  • Fulfilling obligations related to the management and reporting of the service.

The processing is carried out based on legitimate public interest and official authority vested in the participating institutions and service framework, as well as the necessity to execute the specific activities of the project.

Technical cookies only

This platform uses only essential technical session cookies required for the proper functioning of Moodle:

  • MoodleSession: A technical session cookie necessary to maintain your log-in state across pages. It is automatically deleted when you close your browser or log out.

No third-party tracking cookies, analytical profiling cookies, or marketing cookies are utilised on this site.

Data storage, hosting, and replication

Your data is hosted and maintained securely within the European Union under strict physical and technical security standards:

  • Primary Hosting: Primary physical servers are located at Aruba’s webfarm in Arezzo, Italy.
  • Database Replication: For disaster recovery and business continuity purposes, the database is securely replicated to two internal, non-public servers located in Rome and Milan, Italy.

Retention period and data anonymisation

Personal data is retained only for as long as necessary to achieve the service’s objectives.

  • End-of-Service Anonymisation: Upon the official expiration and conclusion of the service, all user accounts and associated personal data will be anonymised (or erased where appropriate), removing any direct or indirect link to individual identities, unless further retention is strictly mandated by EU regulatory frameworks or HaDEA.

Data sharing and recipients

Personal data is kept strictly confidential and will not be sold, rented, or commercially distributed.
Access to data is restricted to authorised project personnel, administrative staff, and relevant EU authorities (including HaDEA) for auditing and compliance purposes.

Your rights under GDPR

Under the General Data Protection Regulation (GDPR), users have the right to:

  • Access their personal data processed on the platform,
  • Request rectification of inaccurate or incomplete personal data,
  • Request erasure or restriction of processing, subject to legitimate project obligations,
  • Object to data processing where applicable.

To exercise any of these rights, users should contact the project management team or their nominating national authority.