Privacy Policy

Last updated: 29 October 2026

This policy explains what personal data Renovate Europe collects through this website and its activities, why, and what rights you have. It applies to renovate-europe.eu, the Renovate Europe Newsletter, and the events we organise, such as Renovate Europe Day and the C4E Forum.

Who we are

Renovate Europe is a campaign of Efficient Buildings Europe ASBL, a non-profit association registered in Belgium under enterprise number 0898.506.941 (RPM Bruxelles). Efficient Buildings Europe is the data controller for the personal data described here. It is listed in the EU Transparency Register under N° 99 00 544 15 48 – 23.

Efficient Buildings Europe ASBL
Rue d’Arlon 63-67
1040 Brussels, Belgium
info@renovate-europe.eu

For any question about your data, or to use your rights, write to info@renovate-europe.eu.

What data we collect and why

When you visit the website

Our web server records technical data for every visit: IP address, browser type, the pages requested and the time of the request. We use it to keep the site running and secure. The legal basis is our legitimate interest in operating a safe website.

If you accept statistics cookies, we use Google Analytics to count visits and see which pages are read. Google Analytics is set up so that it does not receive data from logged-in editors, and we do not use it for advertising. The legal basis is your consent, which you can withdraw at any time on our cookie policy page.

When you subscribe to the newsletter

We ask for your first name, last name and email address, and on the subscription page also your organisation and position. We use them to send you the Renovate Europe Newsletter, reports and invitations to our events. The mailing list is shared with Efficient Buildings Europe. The legal basis is your consent.

Every email has an unsubscribe link. We keep your details until you unsubscribe.

When you write to us

If you email us, we use your name, email address and the content of your message to reply. We keep the correspondence as long as needed to follow up on it. The legal basis is our legitimate interest in answering questions about the campaign.

When you attend our events

To register you for an event we collect your name, organisation, position and email address, and sometimes dietary or accessibility needs. We use them to organise the event and to send you related information. Some events are filmed or photographed, and pictures may be published on this website and our social media channels. We tell you about this at registration and at the event. The legal basis is your consent or the performance of the registration you asked for.

When you have an account for the Renovate Europe EPBD Tracker

Parts of the Renovate Europe EPBD Tracker are open only to people with an account: staff of Renovate Europe partner organisations, and policymakers, journalists and public authorities who ask for access.

If you ask for access, you fill in the request form on this website with your name, professional email address, organisation, the group you belong to, your country, your position and, if you wish, a short justification of why you are eligible. The form is stored on our website only, and our team receives an email about it. We use it to decide on your request and to create your account. If we approve your request, your details become your account (see below). If we decline it, we delete it after 90 days. Partner staff may be invited directly, using the contact details we already hold to run the partnership.

When you are logged in, you can use “Suggest an update” to tell us about a change in a country. We store your message, the country and topic you chose, any link you add, and your name, email address and organisation, so that we can check the change and ask you about it if needed. We delete the message 90 days after we have dealt with it.

Your account holds your name, email address, organisation, the group you belong to (partner, policymaker, media, public authority) and the date we sent your welcome email. There is no password. To log in, you enter your email address and we send you a 6‑digit code, which expires after 10 minutes. We store the code only in scrambled form and delete it once it’s used. To stop misuse, we count login requests without storing your email or IP address in that count. While you are logged in, the website keeps a record of your session (time, IP address and browser) for up to 30 days, or until you log out. Our security plugin also keeps a short log of login attempts. We also note the date of your last login and how many times you have logged in, so we can see how the tracker is used and delete accounts that have not been used for two years.

The legal basis is the performance of the service you asked for. For partner staff we invite, it is our legitimate interest in running the partnership. We keep your account until you ask us to close it, until your organisation stops being a partner, or after two years without use. To close your account, write to info@renovate-europe.eu.

Political support, partners and speakers

We publish the names, positions and photographs of Members of the European Parliament, national politicians, business and community leaders who have signed our manifestos or pledges, and of speakers at our events. We publish them with the agreement of the person concerned. We also keep contact details of the people who represent our partner organisations, to run the partnership. The legal basis is consent for publication and our legitimate interest for partner contacts.

Cookies

This website uses a small number of cookies:

• Functional cookies remember your cookie choices. They do not need consent.
• Log-in cookies keep you logged in to your Renovate Europe EPBD Tracker account for up to 30 days. They are functional and do not need consent.
• Statistics cookies from Google Analytics (_ga and _ga_*) measure visits. They are only set if you accept them.
• Third-party content such as YouTube videos and posts from X (formerly Twitter) can set cookies of their own when they load. We only load them if you accept marketing cookies, or when you choose to play the video.

Our cookie policy lists each cookie and how long it is kept. You can change your choice at any time on that page, which is linked at the bottom of every page.

Who we share data with

We do not sell personal data. We share it only with service providers who process it on our behalf and under a data processing agreement:

• our website hosting provider, which stores the website and its server logs;
• Mailchimp (Intuit Inc.), which sends the newsletter;
• Google (Google Ireland Ltd and Google LLC), for Google Analytics;
• Microsoft (Microsoft Ireland Operations Ltd), for the access request form and for sending emails from the website;
• Mailgun (Sinch), which sends the website’s emails from its servers in the EU;
• Wordfence (Defiant Inc.), which protects the website against attacks and may process the IP addresses of visitors who try to log in;
• event registration platforms and venues, for the events you register for.

Mailchimp and Google may process data in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission recognises as giving an adequate level of protection, and the transfers are also covered by the Commission’s standard contractual clauses. Defiant is based in the United States. Transfers to it are covered by the European Commission’s standard contractual clauses.

How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. Newsletter data is deleted when you unsubscribe. Google Analytics data is deleted automatically after 14 months. Event registration lists are deleted after the event has been followed up, unless you agreed to hear about future events. Declined access requests and suggested updates are deleted 90 days after we have dealt with them.

Your rights

Under the General Data Protection Regulation you have the right to:

• access the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted;
• restrict or object to how we use it;
• receive it in a portable format;
• withdraw your consent at any time, without affecting what we did before you withdrew it.

To use any of these rights, write to info@renovate-europe.eu. We reply within one month.

If you think we have not handled your data properly, you can complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, or to the authority of the country where you live or work.

Changes to this policy

We may update this policy when our activities or the law change. The date at the top shows when it was last changed.