**1\. Introduction**

It is important to clarify that for the purpose of this deliverable to be
self-contained, the Consortium has decided to highlight (using blue font), the
sections added to the D5.9 IPR and Data Management Plan submitted 6 months
ago, to which this document intends to be an update (v2).

The additions are concentrated in 3 aspects fundamentally:

  1. _Treatment of publications_ as one of the dissemination efforts intended in the project (section 2.3.3). 

  

  2. _Data Management in practice (sections 3.4.1 and 3.4.2 as part of section 3.4 Data_ _Security)_ , describing the tools used, both from the point of view of: 

    1. RDAs data sharing, storage and handling (research) 

  

    2. Internal project document management (project management) 

  
  

  

  3. _Update of Annexes,_ they have been updated and are presented in this second version of the Deliverable: updated NDA (Non-Disclosure Agreement) and update DLA (Database License Agreement). 

  

  

Minor changes in references to previous IPR & DMP Deliverables timeline (D5.9)
and subsequent (D5.11) have been updated as well through the text.

That said, the purpose of this document continues to be what was stated in
D5.9, and presented as follows.

#  1.1. Object of this document (Summary)

The purpose of this document is to provide the plan for managing the data
generated and collected during the project; The Data Management Plan (DMP),
and to prepare a first version of the Intellectual Property Rights (IPR) plan
and make a brief introduction about the Plan of the use and dissemination of
foreground.

The target groups of this report are the consortium of the OaSIS project, the
participating Regional Development and/or Innovation Agencies and Small Medium
Enterprises (SMEs), and anyone outside the project who wants to use the
methodology and technology to be developed in it.

On the one hand, this document describes the way Intellectual Property Rights
are handled in OaSIS project. It summarises the general IPR agreement, which
is a part of the Consortium Agreement of the project; and addresses the main
issues of IPR management: the ownership, the protection of foreground,
dissemination, the access rights, and the confidentiality.

On the other hand, the Data Management Plan (DMP) describes the data
management life cycle for all datasets to be collected, processed, and/or
generated by OaSIS research project. It covers:

  * the handling of research data during and after the project 

  

  * what data will be collected, processed or generated. 

  

  * what methodology and standards will be applied. 

  

  * whether data will be shared/made open and how 

  

  * how data will be curated and preserved 

  

Following the EU’s guidelines, this document may be updated - if appropriate -
during the project lifetime (in the form of deliverables).

#  2\. IPR Management, Use and Dissemination Plan

##  2.1. Publishable Executive Summary

This document describes the way Intellectual Property Rights are handled in
the OaSIS project. It summarises the general IPR agreement, which is a part of
the

Consortium Agreement of the project. Besides, this document introduces the IPR
Management Group and addresses the main issues of IPR management. These issues
are the ownership, the protection of foreground, dissemination, the access
rights, and confidentiality.

This deliverable is also the initial version of the plan for disseminating the
activities and the generated knowledge and products of the OASIS project. This
plan will be completed along the life of the project and will not become final
until the end of it. We expect future versions to be lighter and complement
this deliverable concisely. The plan is designed not only as a vehicle to
communicate the activities of the project and for the general awareness of
opportunities but also as a “knowledge sharing” initiative, as a platform to
favour the establishment of new links between Regional Agencies, and to
provide direct or indirect services to SMEs (i.e. better segmentation) and in
to a lesser extent to favour new links between Regional Agencies and other
stakeholders (e.g. the industry and academic stakeholders).

##  2.2. Introduction

###  2.2.1. Purpose and target group

The purpose and scope of the report are to prepare a first version of the IPR
plan and make a brief introduction about the Plan of the use and dissemination
of foreground. The target groups of this report are the consortium of the
OASIS project, the participating Agencies and SMEs, and anyone outside the
project who wants to use the methodology and technology to be developed in it.

###  2.2.2. Contributions of partners

Linknovate has prepared the Deliverable 5.9 IPR & DMP following OpenAire
guidelines  1  ,2  and other H2020 project examples. All the partners of the
consortium have participated in the edition and review of it.

###  2.2.3.  2  Baseline

This document outlines the first version of the IPR plan within the OASIS
project. It touches various IPR-issues that will have to be dealt with the
course of the project.

In the process of designing the dissemination actions, it is necessary to bear
in mind the three main possible kinds of dissemination regarding the level of
involvement of the targeted audiences to fully understand the scope and the
activities of the plan: Dissemination for Awareness, Understanding, and
Action. This will be contemplated in detail in the following Deliverables
regarding the Dissemination Plan.

###  2.2.4. Relations to other activities

The Plan for IPR management will be updated taking into account the value-
added methodologies and technologies developed during the project.

##  2.3. Consortium Agreement

The Consortium Agreement (CA) was signed by all the project partners and has
come into force on the date of its signature by the Parties and shall continue
in full force and effect until complete fulfilment of all obligations
undertaken by the Parties under the EC-GA and the Consortium Agreement. The
OASIS CA describes the initial agreement between partners about Intellectual
Property Rights Management.

The present document summarises the main topics covered by the CA on IPR
management strategy and introduces as well the IPR Management Group, which is
responsible for monitoring the IPR issues, in this case the 3 consortium
partners: - LKN: Linknovate Science S.L.

  * EURADA: European Association of Regional Development Agencies 

  

  * PK: Cracow University of Technology 

  

By IPR, we mean “Intellectual Property Rights”, i.e. the rights of the
Background  3  and the rights of the Foreground  4  generated by the OASIS
partners and funded by the European Commission grant under the EC H2020 Grant
Agreement 777443.

The main concerns are naturally linked to the technology transfers mandatory
to achieve project results. Developments from partners that will be included
in a commercial product will need a license grant of some form between the
granting partner (the institution that developed the foreground) and the
receiving partner (the institution building the product incorporating this
foreground).

The fundamental rule governing the ownership of Results is expressed in the
Article 26.2 of the Grant Agreement and repeated in Article 8.1 of the
Consortium Agreement. The general principle is that Results are owned by the
partner that generates them.

###  2.3.1. Notion of Joint Ownership

Complementary to the abovementioned rule concerning ownership of the project
results is the principle of joint ownership laid down in the Article 26.2 of
the Grant Agreement.

Where several Beneficiaries have jointly carried out work generating
Foreground and where their respective contribution cannot be established
(“Joint Foreground”), they own the Foreground jointly.

The joint owners must agree (in writing) on the allocation and terms of the
exercise of their joint ownership (‘joint ownership agreement’), to ensure
compliance with their obligations under this Agreement.

Unless otherwise agreed in the joint ownership agreement, each joint owner may
grant non-exclusive licences to third parties to exploit jointly-owned results
(without any right to sub-license), if the other joint owners are given: (a)
at least 45 days advance notice and (b) fair and reasonable compensation.

Once the results have been generated, joint owners may agree (in writing) to
apply another regime than joint ownership (such as, for instance, transfer to
a single owner with access rights for the others).

Beneficiaries undertake that Joint Foreground joint ownership agreement shall
be done in good faith, under reasonable and non-discriminatory conditions.

In case of joint ownership of Foreground each of the joint owners shall be
entitled to use the joint Foreground as it sees fit, and to grant non-
exclusive licenses to third parties, without any right to sub-license, without
obtaining any consent from, paying compensation to, or otherwise accounting to
any other joint owner, unless otherwise agreed between the joint owners
(following art 8.2 of the Grant Agreement).

###  2.3.2. Protection of Foreground

Where Foreground is capable of industrial or commercial application (even if
it requires further research and development, and/or private investment), it
should be protected in an adequate and effective manner in conformity with the
relevant legal provisions, having due regard to the legitimate interests of
all participants, particularly the commercial interests of the other
beneficiaries.

Furthermore, the beneficiaries are obliged to protect the results of the
project adequately for an appropriate period and with appropriate territorial
coverage if:

  1. the results can reasonably be expected to be commercially or industrially exploited and 

  

  2. protecting them is possible, reasonable and justified (given the circumstances). 

  

  

Where a beneficiary, which is not the owner of the Foreground invokes its
legitimate interest, it must, in any given instance, show that it would suffer
disproportionately great harm.

Beneficiaries should, individually and preferably collectively, reflect on the
best strategy to protect in view of the use of the foreground both in further
research and in the development of commercial products, processes, or
services.

Applications for protection of results (including patent applications) filed
by or on behalf of a beneficiary must - unless the Agency  5  requests or
agrees otherwise or unless it is impossible - include the following:

“ _The project leading to this application has received funding from the
European Union’s Horizon 2020 research and innovation programme under grant
agreement No 777443”._

Furthermore, all patent applications relating to Foreground filed shall be
reported in the plan for the use and dissemination of Foreground, including
sufficient details/references to enable the Agency or the Commission to trace
the patent (application). Any such filing arising after the final report must
be notified to the Commission including the same details/references.

In the event the Agency assumes ownership, it shall take on the obligations
regarding the granting of access rights.

_**Transfer of Foreground** _

Each Party may transfer ownership of its own Foreground following the
procedures of the Grant Agreement (GA) Article 30.1.

It may identify specific third parties it intends to transfer the Foreground.
The other Parties hereby waive their right to object to a transfer to listed
third parties according to the GA Article 30.1.

The transferring Party that intends to transfer ownership of results shall,
however, give at least 45 days advance notice (or less if agreed in writing)
to the other Parties that still have (or still may request) access rights to
the results. This notification must include sufficient information on the new
owner to enable any beneficiary concerned to assess the effects on its access
rights. The Parties recognise that in the framework of a merger or an
acquisition of an important part of its assets, a Party may be subject to
confidentiality obligations, which prevent it from giving the full 45 days
prior notice foreseen in GA Article 30.1.

###  2.3.3. Dissemination

Dissemination activities including but not restricted to publications and
presentations shall be governed by Article 29 of the Grant Agreement.

The Parties shall ensure dissemination of their own Foreground as established
in the Grant Agreement provided that such dissemination does not adversely
affect the protection or use of Foreground and subject to the Parties’
Legitimate Interests.

Publication, Publication of another Party’s Foreground or Background and
Cooperation, as well as Use of names, logos and trademarks will be updated in
this IPR Plan deliverable in the next version ( _D5.11 in month 18_ ), as it
is influenced by the inputs and agreements reached for the _Communication and
Dissemination Plan v1 (D5.1 in month 6)_ .

##  Software Access Rights

Parties’ Access Rights to Software do not include any right to receive Source
Code  6  or Object Code  7  ; ported to a certain hardware platform or any
right to receive Source Code, Object Code or respective Software Documentation
8  in any particular form or detail, but only as available from the Party
granting the Access Rights.

The intended introduction of Intellectual Property (including, but not limited
to Software) under Controlled License Terms in the Project requires the
approval of the PMB (Project Management Board) to implement such introduction
into the Consortium Plan.

Parties agree that Access Rights to Software, which is Background or
Foreground only include: access to the Object Code and, where normal use of
such an Object Code requires an Application Programming Interface (API)  9  .
Access to the Object Code and such an API; and, if a Party can show that the
execution of its tasks under the Project or the Use of its own Foreground is
technically or legally impossible without Access to the Source Code, Access to
the Source Code is to the extent necessary.

The Source Code shall be deemed as Confidential Information and the use of the
Source code shall be strictly limited to the necessary extent.

For the avoidance of doubt, any grant of Access Rights not covered by the CA
shall be at the absolute discretion of the owning Party and subject to such
terms and conditions as may be agreed between the owning and receiving
Parties.

6

Source Code: means software in human readable form normally used to make
modifications to it including, but not limited to, comments and procedural
code such as job control language and scripts to control compilation and
installation.

7

Object Code: means software information, being technical information used or,
useful in, or relating to the design, development, use or maintenance of any
version of a software programme.

8

Software Documentation: means software information, being technical
information used or, useful in, or relating to the design, development, use or
maintenance of any version of a software programme. 9

Application Programming Interface: means the application programming interface
materials and related documentation containing all data and information to
allow skilled Software developers to create Software interfaces that interface
or interact with other specified Software.

###  2.3.4. Access Rights for Use

_Access rights concern both Background and Results of the Project
(Foreground)._ This section will be updated in following versions of this
deliverable _(D5.11 in month 18 and D5.12 in month 24)_ as it will be
influenced by agreements and inputs in _Exploitation and Sustainability Plan
v3 (D5.7 in month 18). Two cases are foreseen for granting access to the
Parties – for the purpose of implementation of the Party’s task in the Project
and for exploiting the Party’s own results._

_General rules regarding Access rights to the project results are established
by Article 31 of the Grant Agreement and the principles governing Access
rights to the Background are laid down in the Article 24 of this Agreement._

Confidentiality (Non-Disclosure)

All information in whatever form or mode of transmission, which is disclosed
by a Party (the “Disclosing Party”) to any other Party (the “Recipient”) in
connection with the Project during its implementation and which has been
explicitly marked as “confidential”, or when disclosed orally, has been
identified as confidential at the time of disclosure and has been confirmed
and designated in writing within 15 days at the latest as confidential
information by the Disclosing Party, is “Confidential Information”.

In relation to Confidential Information, each Party undertakes not to use such
Confidential Information for any purpose other than in accordance with the
terms of the OASIS Grant Agreement and CA during a period of five years from
the date of disclosure by the disclosing Party, and to treat it and use
reasonable endeavours in order to ensure it is kept confidential and not
disclose the same to any third party without the prior written consent of the
owner in each case during the aforesaid period of five years.

The above shall not apply for disclosure or use of Confidential Information,
if and as far as the Recipient can show that:

  * The Confidential Information becomes publicly available by means other than a breach of the Recipient’s confidentiality obligations; 

  

  * The Disclosing Party subsequently informs the Recipient that the Confidential Information is no longer confidential. 

  

**2.4. Exploitable Background/Foreground and its Use**

OaSIS uses a number of existing available backgrounds of the parties to the
project, which was listed in the CA. In Table 1 it is showed the updated list.

According to the Article 24 of the Grant Agreement, the partners must identify
and agree (in writing) on the background for the action (‘agreement on
background’).

In this section, the intellectual property developed within the scope of the
project will be detailed, work-package by work-package. A list of foreseen
exploitable foreground will be found in Table 2. As the project evolves, more
exploitable products are expected to come up. Each information or knowledge
identified as a Background for the project shall be agreed upon all partners
and expressed in writing in the Attachment 1 to the Consortium Agreement
entitled: _Attachment 1: Background included._

Therefore, this list will be updated regularly by the Project Coordination or
when requested by any partner of the consortium.  
  
<table>  
<tr>  
<th>

Partner nº

</th>  
<th>

Participating Legal Name

</th> </tr>  
<tr>  
<td>

1

</td>  
<td>

</td>  
<td>

Cracow University of Technology – The Coordinator

</td> </tr>  
<tr>  
<td>

None

</td>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

2

</td>  
<td>

</td>  
<td>

Linknovate Science SL

</td> </tr>  
<tr>  
<td>

•

</td>  
<td>

Exte

</td>  
<td>

nsive use of machine learning and natural language processing to identify the

</td> </tr>  
<tr>  
<td>

</td>  
<td>

orga

</td>  
<td>

nisations in the document that match the user's query and to aggregate the

</td> </tr>  
<tr>  
<td>

</td>  
<td>

resul

</td>  
<td>

ts in a unique ‘entity profile’ (record linkage).

</td> </tr>  
<tr>  
<td>

•

</td>  
<td>

Deli

</td>  
<td>

very of competitive intelligence insights in its current ‘commercial product’:

</td> </tr>  
<tr>  
<td>

</td>  
<td>

the “

</td>  
<td>

search engine” Linknovate.com. Data sources currently covered: Scientific

</td> </tr>  
<tr>  
<td>

</td>  
<td>

Publ

</td>  
<td>

ications, Conference Proceedings, Grants (EC Cordis, UK Gateway to

</td> </tr>  
<tr>  
<td>

</td>  
<td>

Rese

</td>  
<td>

arch (GtR), Narcis (Holland’s CRIS Systems), USA SBIR/STTR grant

</td> </tr>  
<tr>  
<td>

</td>  
<td>

prog

</td>  
<td>

ram and others), Patents and trademarks (USPTO and EPO), News

</td> </tr>  
<tr>  
<td>

</td>  
<td>

(spe

</td>  
<td>

cialized sources such as MIT Techreview, FastCompany, etc.), Web

</td> </tr>  
<tr>  
<td>

</td>  
<td>

(mo

</td>  
<td>

nitoring of corporate websites).

</td> </tr>  
<tr>  
<td>

•

</td>  
<td>

The

</td>  
<td>

use of different ranking retrieval algorithms, which exploit multiple features
of

</td> </tr>  
<tr>  
<td>

</td>  
<td>

docu

</td>  
<td>

ments for showing the most relevant results to a user query. These
capabilities

</td> </tr>  
<tr>  
<td>

</td>  
<td>

lay t

</td>  
<td>

he technology foundation for Trend identification, Expert search and Data

</td> </tr>  
<tr>  
<td>

</td>  
<td>

Visu

</td>  
<td>

alization based on R&D and R&I data.

</td> </tr>  
<tr>  
<td>

•

</td>  
<td>

This

</td>  
<td>

IP recognised by LKN as background IP is an essential part of LKN product:

</td> </tr>  
<tr>  
<td>

</td>  
<td>

Link

</td>  
<td>

novate.com

</td> </tr>  
<tr>  
<td>

This ba

</td>  
<td>

ckground is considered trade secret / undisclosed know-how and business

</td> </tr>  
<tr>  
<td>

informat

</td>  
<td>

ion by LKN; protected by Directive (EU) 2016/943 of the European

</td> </tr>  
<tr>  
<td>

Parliame

</td>  
<td>

nt and of the Council of 8 June 2016 on the protection of undisclosed know-

</td> </tr>  
<tr>  
<td>

how and

</td>  
<td>

business information (trade secrets) against their unlawful acquisition, use
and

</td> </tr>  
<tr>  
<td>

disclosur

</td>  
<td>

e.  6  
</td> </tr>  
<tr>  
<td>

3

</td>  
<td>

EURADA

</td> </tr>  
<tr>  
<td>

None

</td> </tr> </table>

Table 1. List of Background included in project OASIS.

So far, the Consortium has not yet identified any Foreground IP that should be
mentioned. It is expected that IP may be generated from the tasks and actions
in WP3 (Data Collection and Big Data Analysis) and the methodology editions,
improvements or generated over the life cycle of the project.  
  
<table>  
<tr>  
<th>

WP

</th>  
<th>

Exploitable foreground description

</th>  
<th>

Timetable

</th>  
<th>

Expected

IPR protection

</th>  
<th>

Owner &

other partners involved

</th> </tr>  
<tr>  
<td>

2,3, 4

</td>  
<td>

Methodology for benchmarking SME

</td>  
<td>

M3 to M24

</td>  
<td>

[Estimated]

Appropriate

</td>  
<td>

All partners [LKN,

</td> </tr> </table>  
<table>  
<tr>  
<th>

</th>  
<th>

segmentation support and segmentation measures.

Improvements in innovation methodologies

</th>  
<th>

</th>  
<th>

CC license

</th>  
<th>

EURADA, CTT]

</th> </tr>  
<tr>  
<td>

3

</td>  
<td>

Data analytics software tools

</td>  
<td>

M12 to M24 (2019)

</td>  
<td>

To be updated in following

IPR &DMP versions  7

</td>  
<td>

LKN

</td> </tr> </table>

Table 2. Exploitable Foreground list in project OASIS.

###  2.5. Conclusions

This deliverable shows the Intellectual Property management in the OaSIS
project and summarises the general agreement, which is settled in the
Consortium Agreement. This report will be updated taking into account the
value-added methodologies and technologies developed during the project.

The Plan for the use and dissemination of foreground appeared in this report
will be used as a brief summary and a preview for the “Deliverable 5.1.
Communications and Dissemination Plan” and the “Deliverable 5.2. Exploitation
and Sustainability Plan” that will be prepared in the month 6 within the “WP5:
Communication, Dissemination and Exploitation led by EURADA. This plan will be
completed in the deliverable D5.1 and also along the life of the project. The
dissemination action is based on these three pillars: Dissemination for
Awareness, Understanding, and Action.

#  3\. Data Management Plan

The OaSIS project aims at providing a thorough, evidence-based analysis for
segmentation of innovative SMEs and the assessment of the effectiveness of the
multiple support mechanisms currently used in agencies across Europe.

Towards this end, the OaSIS project will use unique Big Data and Machine
Learning capabilities to develop a performance-based methodology for SME
segmentation which will allow the (Regional and National) Development Agencies
to target SMEs in their industrial fabric with the instruments that
statistically proved to produce the highest impact for similar types of
companies.

Following the EU’s guidelines regarding the DMP, this document will be updated
during the project lifetime (in the form of deliverables).

The following is the OaSIS Project Data Management Plan. It is structured as
recommended in the template for Data management Plans in _Guidelines on FAIR_
_Data Management in Horizon 2020_ .

##  3.1. Data Summary

This document is the OaSIS Project Data Management Plan (DMP). The DMP
describes the data management life cycle for all datasets to be collected,
processed, and/or generated by a research project. It covers:

  * the handling of research data during and after the project 

  

  * what data will be collected, processed or generated. 

  

  * what methodology and standards will be applied. 

  

  * whether data will be shared/made open and how 

  

  * how data will be curated and preserved 

  

To provide “data-driven” insights such as identification of “gazelle”
companies

(enterprises with a high growth potential), SMEs with high innovation
potential, SMEs with high internationalization potential, and capacity to
categorise them into clusters of interest, industries, and/or value chains;
the consortium shall document, analyse, and correlate the data collected and
shared by European Regional Development Agencies (the Agencies). The Agencies
sharing their data will be close collaborators of the project, and will have
Third Party status when the conditions set by the Consortium are met (see
details in Open Call for Agencies, publicly available in the project website
and the corresponding deliverable), and it is approved in the corresponding GA
Amendment by the EC.

The agencies will provide data in “.xml”, “.csv”, and other formats. The
consortium will consider the optimal manners to store and process this data,
at this first stage a relational database – SQL, for its analysis.

The insights generated will be of use of the project’s Agencies and its SMEs
clients.

This DMP covers two types of data subject to FAIR use:

  1. The data shared by the collaborating agencies (in .xml and/or .csv formats, and under CC-BY licenses, a type of Creative Commons “share-alike” license  8  ), and subject to the confidentiality agreements in place by OASIS partners. 

  

  2. The insights generated by the consortium (in the form of data visualisations, reports, and deliverables). 

  

  

##  3.2. FAIR Data

###  3.2.1. Making data findable, including provisions for metadata

The data produced and/or used in the project will be discoverable with
metadata. The consortium will automatically extract primary keywords from the
agencies’ data to optimise possibilities for re-use.

Naming conventions have not been defined yet. This will be one of the first
tasks to be performed when data collection from agencies’ begin.

End data products to be produced by OASIS, such as reports, white papers, etc.
will have version numbers, but several of the more basic datasets (SMEs data
visualisations for instance) will be dynamic in nature and some providers of
data may not define versions.

###  3.2.2. Making data openly accessible

The OASIS project covers two types of data subject to FAIR use:

  1. The data uploaded by the collaborating agencies (in .xml, .csv and other formats), and subject to confidentiality agreements: updated v2 of NDA and Database License Agreement attached in the Annexes of this document. 

  

  2. The insights generated by the consortium (e.g. in the form of data visualisations, reports, and deliverables). 

  

  

Regarding Agencies’ data, it will be closed/restricted. Only the respective
agency and the consortium will have access to this data, and only for project
purposes. The data shared by the Agencies will have creative commons license
CC-BY, which requires for attribution (give the author or licensor the credits
in the manner specified by these) but allows for copying, distributing,
displaying and performing the work and make derivative works and remixes based
on it.

As for OASIS data, or insights generated by the consortium based on agencies’
aggregated data, part of it will be open and part will have a commercial use
to further explore the sustainability of the technologies and services
developed under OASIS.

The Information Platform, contained under the Oasis Portal (
_https://oasisportal.eu_ ), will be the key tool to make the data and data
products accessible to a broad range of Stakeholders, including policymakers,
industry, and academia. Access will be possible for both verification and re-
use purposes and the Information Platform will contain view, search, and
visualisation services alongside standardised view- and download-features.

Software needed to access data that will be made publicly available is not
expected. If needed, and/or requested by our close collaborating Agencies, who
will work under Third party status (see Consortium Agreement and Deliverable
D1.2 Consortium Strategy) LKN (as technical lead partner) will consider
enabling a rest API service for data access; promoting and using CERIF (Common
European Research Information Format)  9  as metadata format when possible.

The Consortium will consider for the different types of data, associated
metadata, documentation, and code which will be made public to be deposited in
certified repositories, such as _OpenAire_ (the consortium will explore
appropriate arrangements with the repository), and in the project’s websites (
_www.projectoasis.eu_ and _https://oasisportal.eu_ ).

Registered access to the data (e.g. data insights, graphics, etc) accessible
via the project’s website will be required. The consortium will keep logs of
closed/restricted datasets (for the project partners), while log-in will be
asked for accessing open data. However, the data hosted in OpenAire will be
publically available (complying with the repository policy) and no logs will
be required.

###  3.2.3. Making data interoperable

The Consortium will have a focus on the interoperability of the data produced.
The consortium will allow for data exchange and re-use between researchers,
institutions, organisations, countries, etc. To make the data produced in the
project interoperable and consumable, the consortium will consider using CERIF
(the Common European Research Information Format) for the data that is not
restricted (data that is not shared by Regional Agencies but produced by the
Consortium).

###  3.2.4. Increase data re-use (through clarifying licenses)

In order to permit the widest re-use possible of the data, the openly accessed
datasets will be CC-BY licensed, requires for attribution (giving the author
or licensor the credits in the manner specified by these) but allows for
copying, distributing, displaying and performing the work and make derivative
works and remixes based on it.

Restricted datasets cannot be used by third-parties, as expressed in NDA and
the “Database license agreement”used for data sharing purposes with Agencies
and other organisations.

##  3.3. Allocation of Resources

Since the data gathered from Regional Agencies is heterogeneous and OASIS is a
data-intensive project, we estimate the costs for making the data FAIR between
3-5 person months. Costs associated with the data gathering, cleaning and
indexing, as well as open access capacities of research data have been
considered in the grant agreement.

The project partner in charge of the data management it is LKN, as technology
(WP3) and DMP lead. All partners are responsible for contributing to the DMP
and the _fair data_ use.

Data preservation is estimated for the project lifetime plus three years.
Longer-term data preservation will be considered with the mentioned data
repositories (e.g. openAIRE). Further decisions will be made by the Consortium
board updating this deliverable.

##  3.4. Data Security

Provisions for data security will differ with regards to the nature of the
data.

Information coming from open datasets will not receive any special treatment.
This information will be directly processed as it arrives to the platform, and
then indexed. Temporal copies of the original data will be kept in OASIS’
information processing nodes, but no extra security measures will be put in
place for this kind of information given its public nature.

##  Confidential Data/Restricted Data obtained from the Agencies

Information from restricted datasets will be uploaded via SFTP  10  , given it
provides secure file transfer and manipulation functionality over any reliable
data stream. Information will be stored in a dedicated GNU/Linux server with
state-of-the-art safety measures. In particular, SFTP will perform chroot for
every user agency to avoid access to the stored information for non-authorised
parties. Access policies to the server will be restricted to LKN employees,
who have signed appropriate NDAs. Weekly incremental backups are planned in a
secondary, equally secure repository.

Regarding data and cybersecurity, the following standard measures are in place
in order to reduce the risk:

  * End to end encryption of data in transition. 

  

  * Encryption of sensitive data at rest to minimise the exposition to nonauthorised access event. 

  

  * Periodic vulnerability testing of the secure servers. 

  

  * Standardised enforced data deletion policy of sensitive data when required by a user. 

  

  * Advance user-level data security measures with fine-grained access control. 

  

Regarding personal information: it is not part of the core and objectives of
the OaSIS project to deal with any personal data, but professional and
commercial data which can be used for a better segmentation of SMEs (such as
number of employees, sector, chain of value, turnover, growth over time,
participation in advanced services or events, and others). However in the case
that any agency shares with OASIS any information containing personal data we
plan to act according to the GDPR regulation, in effect after May 25, 2018,
and according to the procedures local Data Protection Agency (AGPD ).

For these matters, Jose López-Veiga is designated as our Data Protection
Delegate; he will coordinate the register under the AGPD our data processing
activities and will be in charge of the risk analysis over the personal data.

Diego Garea is appointed as of 1  st  October 2018 the new designated Data
Protection Delegate since José López is leaving his full-time role Linknovate
in the short term.

Moreover, an audit of the security measures will be performed with the results
of the risk analysis producing a concise report which will update this
deliverable (IPR & DMP) in the updated versions that follow this deliverable
D5.9. According to the GDPR and AGPD regulations, we will communicate
immediately any breach of the security controls over the personal data.

Furthermore, as stated in our agreements (NDA and Database License Agreements)
with the Agencies, who follow in the Annexes of this deliverable:

_A restricted access procedure shall be implemented for each of the Partner’s
employees and collaborators, in particular Parties shall:_

− _use the data solely in relation to the purpose of the Project;_

− _disclose the data solely to its employees or other associates, whatever the
legal basis of their cooperation is, who are directly involved in the Project
implementation and who have a reasonable need to know the content of the
database for the purposes of the duties assigned to as a result of or in
connection with the Project (“Recipient”);_

− _ensure that every Recipient who receives or obtains access to the database
shall be aware of its confidential nature and shall comply with the
restrictions on non-disclosure;_

− _notify the disclosing Agency as soon as practicable after it becomes aware
of any event of loss or unauthorised disclosure or use of any substantial part
of the database;_

###  3.4.1. OaSIS Research: Data sharing in practice

As estimated in D5.9 previous points, different alternatives where envisioned,
being SFTP the preferred choice. In D5.10 we update this information, having
considered cloud services and peer solutions. However, given the need for
privacy, security, and regulatory requirements on the location of the data we
decided to store the information in our own operated server and use SFTP, SSH
File Transfer Protocol (also Secure File Transfer Protocol, or SFTP).

SFTP is a network protocol that provides file access, file transfer, and file
management over any reliable data stream. It was designed by the Internet
Engineering Task Force (IETF) as an extension of the Secure Shell protocol
(SSH) version 2.0 to provide secure file transfer capabilities. The IETF
Internet Draft states that, even though this protocol is described in the
context of the SSH-2 protocol, it could be used in a number of different
applications, such as secure file transfer over Transport Layer Security (TLS)
and transfer of management information in VPN applications.

Other alternatives were considered such cloud services (Dropbox, Google Drive,
etc.) or peer solutions (Syncthing), however, given the need for privacy,
security, accountability, and regulatory requirements on the location of the
data we decided to store the information in our self-operated server.

The Consortium opted for what is considered the safest route without
overcomplicating the user experience: SFTP (Secure File Transfer Protocol).
Oasis Consortium had to take into account that many of the managers / leaders
of the data analytics tasks in RDAs are not experts in IT and/or data
management. The procedure to share data needed to be as simplest as possible
to reduce the friction in the datasharing process, both in terms of support to
their staff and regarding the level of detail and learning curve inside the
RDA, without having to (necessarily) involve an ITbackground person.

###  _Set up_

SFTP was set up in mid 2018. Several clients were suggested to RDAs for their
use, depending on the OS (Operative System), such as FileZilla for MacOS, and
WinSCP for Windows.

A username and password were created for one representative of each of the
collaborating RDAs, which would be shared with them and members of the
consortium.

###  _Monitoring_

Logs of activity in the SFTP server are monitored so that non-authorized
activity can be identified and acted upon. This allows for one of the needed
functionalities in Oasis for secure protection of the shared and stored data
shared.

Members of the consortium (e.g. Cracow Technical University staff authorised
to research and participate in Project OaSIS, Eurada’s, and Linknovate’s
specific staff members) were authorised to enter the servers and their
activity is monitored as well.

These persons are:

  * Mikolaj Golunski (Cracow Technical University, CTU) 

  

  * Piotr Ciochon (Cracow Technical University, CTU) 

  

  * Jakub Kruszelnicki (Cracow Technical University, CTU) 

  

  * Irena Jakubiec (Cracow Technical University, CTU) 

  

  * Anna Irmisch (Eurada) 

  

  * Esteban Pelayo (Eurada) 

  

  * Manuel Noya (Linknovate) 

  

  * Jose López Veiga (Linknovate) 

  

  * Diego Garea Rey (Linknovate) 

  

  * Sabela Cereijo (Linknovate) 

  

  * Gustavo Viqueira (Linknovate) 

  

Figure 1. FileZilla client for secure access to SFTP was put in place for data
sharing in mid 2018.

The system is currently used by the Agencies who participated in the Oasis
Open Call and who are interested in becoming Third Parties or High Level
parties, with the capabilities to share their data with the Oasis Project
responsible persons.

####  3.4.2. OaSIS Project Management: Data sharing in practice

For internal project management, Cracow Technical University (coordinator)
suggested an easy to use tool where the consortium could share easily the
draft documents, and non-critical data (e.g. confidential data shared by RDAs)
and automatically sync between the partners. Linknovate selected Syncthing as
the tool to do so, for the following reasons:

  * Open-sourced tool 

  

  * Distributed peer to peer sync 

  

  * Readily available locally (in each member computer) and online via Syncthing website 

  

  * Automatic sync of documents uploaded to the project folders 

  

And the following characteristics:

  * _Private_ . Data is never stored anywhere else other than the clients’ computers. There is no central server that might be compromised, legally or illegally. 

  

  * _Encrypted_ . All communication is secured using TLS. The encryption used includes perfect forward secrecy to prevent any eavesdropper from ever gaining access to data. 

  

  * _Authenticated_ . Every node is identified by a strong cryptographic certificate. Only nodes explicitly allowed can connect to the user cluster. 

  

Figure 2. Syncthing open source project in GitHub.

__Syncthing Technology_ _

Syncthing is a BYO cloud model where the users provide the hardware that the
software runs on. The larger the number of mesh devices, the more efficiently
data can be transferred. It supports IPv6 and, for those on IPv4 networks, NAT
punching and relaying are offered. Devices connecting to each other require
explicit approval, which increases the security of the mesh. All data, whether
transferred directly between devices or via relays, is encrypted using TLS
(Transport Layer Security).

Conflicts are handled with the older file being renamed with a "sync-conflict"
suffix (along with time and date stamp), enabling the user to decide how to
manage two or more files of the same name that have been changed between
syncing. GUI Wrappers can use these files to present the user with a method of
resolving conflicts without having to resort to manual file handling.

Figure 3. Syncthing running on one of the member’s computers.

Efficient syncing is achieved via compression of metadata or all transfer
data, block re-use and lightweight scanning for changed files, once a full
hash has been computed and saved. Moving and renaming of files and folders are
handled efficiently, with Syncthing intelligently processing these operations
rather than re-downloading data from scratch.

__Technical Characteristics of the Syncthing System_ _

Syncthing is the only open source system supporting multiple operating systems
and with the following characteristics.

_Operating system_

Windows, OS X, Linux, Android, BSD, Solaris

###  _License_

Indicates the licensing model under which the software is published. For open
source systems this may be the specific license (i.e. GPL, LGPL, MIT, etc.),
for closed source/proprietary/commercial software this may be the model
(subscription per user, perpetual per device, etc.).

In the case of Syncthing, the license is MPL v2: a free and open source
software license developed and maintained by the Mozilla Foundation. It is a
weak copyleft license, characterised as a middle ground between permissive
free software licenses and the GNU General Public License (GPL) that seeks to
balance the concerns of proprietary and open source developers.

###  _Portable_

Syncthing is portable: designed to run without needing to modify the
configuration of the computer it is run on. The name 'portable' comes from the
fact that these applications are intended to be able to be carried with the
user on a portable drive and run on any computer it was designed to run on,
even if the user does not have administrative privileges on the computer.

###  _Detect conflict_

Syncthing is able to detect conflict. Indicates whether the software will
detect if the requested operation may result in data loss.

###  _Renames/moves_

Syncthing provides this capability. When a file/directory in a given side of
the synchronisation is renamed/moved, the program repeats renaming/moving the
file/directory to the other side of the synchronisation. This feature saves
bandwidth when operating on remote systems but increases the analysis
duration.

###  _Prior file versions, revision control_

Syncthing has this capability. Indicates whether the software allows one to
revert to an earlier version of a particular file/directory.

_Online storage:_ available.

###  _Scheduling or service_

Syncthing provides this capability. Indicates whether the software will run
automatically either via a scheduler or by running as a system service. In
case Syncthing did not support it, a user would have to invoke the software
manually each time a synchronisation is needed.

Last stable version: 0.14.45 (June 2018).

Oasis consortium is currently making use of Syncthing for sharing and quickly
edit and sync files needed for day-to-day work on Oasis project.

####  3.4.3. OaSIS Personal Data Management: Data sharing in practice

First and foremost, it is important to highlight that OaSIS Project research
does NOT concern personal data, hence all workflow regarding personal data is
purely for communication purposes and to increase transparency and trust with
the collaborating RDAs.

Following this, we have provided documents to inform of this to RDAs.

__Documents shared to inform RDAs_ _

The following details are shared with collaborating agencies, as part of the
OaSIS transparency in data sharing and data processing workflow concerning
GDPR (personal data handling, outside of OaSIS research):

<<

_Data relevant for the Project_

The aim of the Project is to improve the efficiency and effectiveness of the
innovation support provided in European regions and strengthening the capacity
of regional development agencies and other support providers. This objective
is going to be achieved by developing a new methodology of SME segmentation.
Research is focusing on currently used approaches to the segmentation of
innovating SMEs that shall result in identifying correlations and similarities
within the groups of SMEs that showed the highest increase in performance
after receiving specific support. In order to achieve this goal an analysis of
historical data regarding support provided to SMEs by Regional Development
Agencies is going to be performed. The data that is going to be used for
benchmarking purposes concerns solely business information on the SMEs, their
characteristics, support instruments applied and its consequences for the
performance of a given SME. Such data is not a considered a personal data.

_If you wish to get involved in OaSIS research project_

We assure you that research activity in the OaSIS project concerns solely
historical business and economic data, which is not under the protection
granted by GDPR. We do not ask you for any personal data, in fact article 4.4
of the initial NDA agreement expressly states that _if the database contains
any sensitive or personal information the Agency shall extract such
information from the database prior to its delivery._

The OaSIS project received funding from the European Union’s Horizon 2020
research and innovation programme and its implementation is verified by
competent European Institutions. Consortium Partners are obliged to comply
with ethical and research integrity principles, applicable international, EU
and national law.

By contacting us, a person that represents Regional Development Agency may
reveal his/her personal data. We use contact details provided solely to get in
touch with the Agency in order to give information on the project, its scopes,
outcomes, profits, and conditions of participation. All Consortium Partners
comply with GDPR and respective national regulations regarding personal data
protection.

>>

The following document, reproduced here in full is also shared and made public
with participating agencies  11  :

####  3.5. Ethical Aspects

The OASIS Project consortium has not identified any specific ethical issues
related to the work plan, outcomes or dissemination, as the program does not
deal with any personal or medical data. We do note that individual partners
will have to adhere to any special ethical rules. In fact, this is a point
where the Consortium wants to update the Ethical Requirements for Data
treatment

The data management and compliance team are undertaking a significant review
of all policies and procedures on ethics and data use. We will continue to
work on the current data protection policy with the commitment to protect and
process data with adherence to current legislation and policies, in particular
General Data Protection Regulation that comes into force on 25 May 2018.

The project adheres to the commitment to holding any data in secure conditions
and will make every effort to safeguard against accidental loss or corruption
of data.

The Regional Development Agencies are obliged to extract the databases from
any sensitive or personal information prior to its disclosure.

Agencies will participate in the project based on informed consent, may
withdraw at any time, and can request information not be published. Informed
consent forms describe how data is stored and used and how confidentiality is
maintained in the long-term. Measures include data anonymisation, aggregating
individual-level data, and generalising the meaning of the detailed text.