1. Who is responsible for your data?
The controller is ΕΞΕΛΙΞΙΣ ΔΙΑΧΕΙΡΙΣΗ ΕΡΕΥΝΑΣ ΚΑΙ ΕΠΙΚΟΙΝΩΝΙΑ Ε.Ε. (trade name: Exelixis Research Management & Communication), a Greek limited partnership.
Registered office: Kleisthenous 187, 153 44 Gerakas, Attica, Greece.
GEMI: 127135503000 · VAT / Greek Tax Identification Number (AFM): 800521378.
Contact: euprojects@exelixisrm.com · +30 210 604 7515.
2. Data we may process
When you contact us, we may process your name, email address, organisation, telephone number, the content of your message and any information you choose to provide. The website’s hosting and security infrastructure may also process limited technical information such as IP address, browser and device information, timestamps, requested pages and security logs.
3. Purposes and legal bases
- To respond to enquiries and take steps you request before entering into a contract, on the basis of Article 6(1)(b) GDPR; where an enquiry is not connected with a possible contract, on the basis of our legitimate interest in responding to professional enquiries under Article 6(1)(f).
- To manage professional and contractual relationships, on the basis of Article 6(1)(b), and to meet related legal obligations under Article 6(1)(c).
- To maintain website security and availability and prevent misuse, on the basis of our legitimate interests under Article 6(1)(f).
- To comply with legal obligations, on the basis of Article 6(1)(c), and to establish, exercise or defend legal claims, on the basis of our legitimate interests under Article 6(1)(f).
Optional website analytics
If you allow analytics, we measure pages viewed, referring website domains, campaign labels, approximate country, browser and device category, visible-tab time, scroll depth and key interactions such as link clicks and successful contact or newsletter signup requests. Analytics does not collect names, email addresses, form contents, full referring URLs or IP addresses in its event records. Our hosting infrastructure may separately process technical connection data as described above.
Analytics is operated by EXELIXIS using the website’s hosting and database infrastructure. Reports are restricted to the website owner. A random session identifier is stored in your browser tab and expires after 30 minutes of inactivity or when the tab is closed. Event records are retained for up to 90 days and older records are removed on the next analytics request. We do not use this information for advertising or cross-site tracking.
Analytics is optional and starts only after your consent. Refusing it does not affect the website. You can stop future collection at any time through in the footer and choose “Essential only”. This clears the current session identifier; it does not delete earlier event records. We also respect the browser’s Do Not Track and Global Privacy Control signals by disabling analytics.
Newsletters
Newsletter signup is optional and separate from contacting us. We process your email address and a record of your opt-in (date, consent wording, privacy notice version and signup source) to send newsletters about EU research funding, projects, events and EXELIXIS services, based on your consent under Article 6(1)(a) GDPR.
The subscriber list is stored privately by our hosting provider and is accessible to authorised EXELIXIS personnel and service providers supporting newsletter delivery. Signup requests are held pending verification of email ownership before newsletters are sent. Unverified signup records are removed when the service next processes a request after seven days. We retain active subscriptions until consent is withdrawn. You can withdraw using the unsubscribe link in a newsletter or by emailing euprojects@exelixisrm.com. Withdrawn subscriptions are excluded from mailing lists; their consent and withdrawal records are retained for up to 12 months and removed when the subscription service next processes a request after that period. We do not use this list for automated decision-making or profiling.
4. Recipients and international transfers
Data may be processed by carefully selected website-hosting, security, IT and email service providers acting under appropriate arrangements, and by professional advisers or public authorities where legally required. We do not sell personal data. Some partner and team images are delivered from third-party source or content-delivery hosts; those providers may receive standard connection information when an image is requested. Links to LinkedIn, YouTube and other external websites are activated only when you choose to follow them and are governed by those providers’ own notices.
Where personal data is transferred outside the European Economic Area, EXELIXIS relies on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, as required. Information about the relevant safeguards may be requested using the contact details above.
5. Retention
Unsuccessful or general enquiries are normally retained for no longer than 12 months after the last meaningful communication. Information connected with clients, contracts, accounting or legal claims may be retained for longer where necessary under the applicable contractual, tax, accounting or legal requirements.
6. Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We normally respond within one month.
To exercise your rights, email euprojects@exelixisrm.com. You may also lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority.
7. Information required when contacting us
Your name, email address and message are required so that we can identify and respond to your enquiry. Organisation details are optional. If the required information is not provided, we will not be able to process or respond to the enquiry. EXELIXIS does not use automated decision-making or profiling when handling website enquiries.
8. Updates
We may revise this notice when our services, providers or legal obligations change. The current version is dated 26 October 2026.