#  1\. Introduction

##  1.1. Object of this document (Summary)

The purpose of this document is to provide the plan for managing the data
generated and collected during the project; The Data Management Plan (DMP),
and to prepare a first version of the Intellectual Property Rights (IPR) plan
and make a brief introduction about the Plan of the use and dissemination of
foreground.

The target groups of this report are the consortium of the OaSIS project, the
participating Regional Development and/or Innovation Agencies and Small Medium
Enterprises (SMEs), and anyone outside the project who wants to use the
methodology and technology to be developed in it.

On the one hand, this document describes the way Intellectual Property Rights
are handled in OaSIS project. It summarizes the general IPR agreement, which
is a part of the Consortium Agreement of the project; and addresses the main
issues of IPR management: the ownership, the protection of foreground,
dissemination, the access rights, and the confidentiality.

On the other hand, the Data Management Plan (DMP) describes the data
management life cycle for all datasets to be collected, processed and/or
generated by OaSIS research project. It covers:

  * the handling of research data during and after the project 

  

  * what data will be collected, processed or generated. 

  

  * what methodology and standards will be applied. 

  

  * whether data will be shared/made open and how 

  

  * how data will be curated and preserved 

  

Following the EU’s guidelines, this document may be updated - if appropriate -
during the project lifetime (in the form of deliverables).

#  2\. IPR Management, Use and Dissemination Plan

##  2.1. Publishable Executive Summary

This document describes the way Intellectual Property Rights are handled in
OASIS project. It summarizes the general IPR agreement, which is a part of the
Consortium Agreement of the project. Besides, this document introduces the IPR
Management Group and addresses the main issues of IPR management. These issues
are the ownership, the protection of foreground, dissemination, the access
rights, and the confidentiality.

This deliverable is also the initial version of the plan for disseminating the
activities and the generated knowledge and products of the OASIS project. This
plan will be completed along the life of the project and will not become final
until the end of it. We expect future versions to be lighter and complement
this deliverable concisely. The plan is designed not only as a vehicle to
communicate the activities of the project and for the general awareness of
opportunities but also as a “knowledge sharing” initiative, as a platform to
favour the establishment of new links between Regional Agencies, and to
provide direct or indirect services to SMEs (i.e. better segmentation) and in
to a lesser extent to favour new links between Regional Agencies and other
stakeholders (e.g. the industry and academic stakeholders).

##  2.2. Introduction

###  2.2.1. Purpose and target group

The purpose and scope of the report is to prepare a first version of the IPR
plan and make a brief introduction about the Plan of the use and dissemination
of foreground. The target groups of this report are the consortium of the
OASIS project, the participating Agencies and SMEs, and anyone outside the
project who wants to use the methodology and technology to be developed in it.

###  2.2.2. Contributions of partners

Linknovate has prepared the Deliverable 5.9 IPR & DMP following OpenAire
guidelines  1  ,  2  and other H2020 project examples. All the partners of the
consortium have participated in the edition and review of it.

###  2.2.3. Baseline

This document outlines the first version of the IPR plan within the OASIS
project. It touches various IPR-issues that will have to be dealt with the
course of the project.

In the process of designing the dissemination actions, it is necessary to bear
in mind the three main possible kinds of dissemination regarding the level of
involvement of the targeted audiences to fully understand the scope and the
activities of the plan: Dissemination for Awareness, Understanding, and
Action. This will be contemplated in detail in the following Deliverables
regarding the Dissemination Plan.

###  2.2.4. Relations to other activities

The Plan for IPR management will be updated taking into account the value-
added methodologies and technologies developed during the project.

##  2.3. Consortium Agreement

The Consortium Agreement (CA) was signed by all the project partners and has
come into force on the date of its signature by the Parties and shall continue
in full force and effect until complete fulfilment of all obligations
undertaken by the Parties under the EC-GA and the Consortium Agreement. The
OASIS CA describes the initial agreement between partners about Intellectual
Property Rights Management.

The present document summarizes the main topics covered by the CA on IPR
management strategy and introduces as well, the IPR Management Group, which is
responsible for monitoring the IPR issues, in this case the 3 consortium
partners: - LKN: Linknovate Science S.L.

  * EURADA: European Association of Regional Development Agencies 

  

  * PK: Cracow University of Technology 

  

By IPR, we mean “Intellectual Property Rights”, i.e. the rights of the
Background  3  and the rights of the Foreground  4  generated by the OASIS
partners and funded by the European Commission grant under the EC H2020 Grant
Agreement 777443.

The main concerns are naturally linked to the technology transfers mandatory
in order to achieve project results. Developments from partners that will be
included in a commercial product will need a license grant of some form
between the granting partner (the institution that developed the foreground)
and the receiving partner (the institution building the product incorporating
this foreground).

The fundamental rule governing the ownership of Results is expressed in the
Article

26.2 of the Grant Agreement and repeated in Article 8.1 of the Consortium
Agreement. The general principle is that Results are owned by the partner that
generates them.

###  2.3.1. Notion of Joint Ownership

Complementary to the abovementioned rule concerning ownership of the project
results is the principle of joint ownership laid down in the Article 26.2 of
the Grant Agreement.

3

" _Background_ " is information and knowledge (including inventions,
databases, etc.) held by the participants prior to their accession to the
grant agreement, as well as any intellectual property rights which are needed
for to implement the action or exploit the results. Background is not limited
to input owned, but potentially extends to anything the beneficiaries lawfully
hold (e.g. through a licence with the right to sub-licence). It also extends
to input held by other parts of the beneficiary’s organisation.

4

“ _Foreground_ ” means the results, including information, materials and
knowledge, generated in a given project, whether or not they can be protected.
It includes intellectual property rights (IPRs such as rights resulting from
copyright protection, related rights, design rights, patent rights, and
others), similar forms of protections (e.g. sui generis right for databases)
and unprotected know-how (e.g. confidential material). Thus, foreground
includes the tangible (e.g. prototypes, source code and processed earth
observation images) and intangible (IPR) results of a project. Results
generated outside a project (i.e. before, after or in parallel with a project)
do not constitute foreground.

Where several Beneficiaries have jointly carried out work generating
Foreground and where their respective contribution cannot be established
(“Joint Foreground”), they own the Foreground jointly.

The joint owners must agree (in writing) on the allocation and terms of
exercise of their joint ownership (‘joint ownership agreement’), to ensure
compliance with their obligations under this Agreement.

Unless otherwise agreed in the joint ownership agreement, each joint owner may
grant non-exclusive licences to third parties to exploit jointly-owned results
(without any right to sub-license), if the other joint owners are given: (a)
at least 45 days advance notice and (b) fair and reasonable compensation.

Once the results have been generated, joint owners may agree (in writing) to
apply another regime than joint ownership (such as, for instance, transfer to
a single owner with access rights for the others).

Beneficiaries undertake that Joint Foreground joint ownership agreement shall
be done in good faith, under reasonable and non-discriminatory conditions.

In case of joint ownership of Foreground each of the joint owners shall be
entitled to use the joint Foreground as it sees fit, and to grant non-
exclusive licenses to third parties, without any right to sub-license, without
obtaining any consent from, paying compensation to, or otherwise accounting to
any other joint owner, unless otherwise agreed between the joint owners
(following art 8.2 of the Grant Agreement).

###  2.3.2. Protection of Foreground

Where Foreground is capable of industrial or commercial application (even if
it requires further research and development, and/or private investment), it
should be protected in an adequate and effective manner in conformity with the
relevant legal provisions, having due regard to the legitimate interests of
all participants, particularly the commercial interests of the other
beneficiaries.

Furthermore the beneficiaries are obliged to protect adequately the results of
project for an appropriate period and with appropriate territorial coverage
if:

  1. the results can reasonably be expected to be commercially or industrially exploited and 

  

  2. protecting them is possible, reasonable and justified (given the circumstances). 

  

  

Where a beneficiary, which is not the owner of the Foreground invokes its
legitimate interest, it must, in any given instance, show that it would suffer
disproportionately great harm.

Beneficiaries should, individually and preferably collectively, reflect on the
best strategy to protect in view of the use of the foreground both in further
research and in the development of commercial products, processes or services.

Applications for protection of results (including patent applications) filed
by or on behalf of a beneficiary must - unless the Agency  3  requests or
agrees otherwise or unless it is impossible - include the following:

“ _The project leading to this application has received funding from the
European Union’s Horizon 2020 research and innovation programme under grant
agreement No 777443”._

Furthermore, all patent applications relating to Foreground filed shall be
reported in the plan for the use and dissemination of Foreground, including
sufficient details/references to enable the Agency or the Commission to trace
the patent (application). Any such filing arising after the final report must
be notified to the Commission including the same details/references.

In the event the Agency assumes ownership, it shall take on the obligations
regarding the granting of access rights.

_**Transfer of Foreground** _

Each Party may transfer ownership of its own Foreground following the
procedures of the Grant Agreement (GA) Article 30.1.

It may identify specific third parties it intends to transfer Foreground. The
other Parties hereby waive their right to object to a transfer to listed third
parties according to the GA Article 30.1.

The transferring Party that intends to transfer ownership of results, shall,
however, give at least 45 days advance notice (or less if agreed in writing)
to the other Parties that still have (or still may request) access rights to
the results. This notification must include sufficient information on the new
owner to enable any beneficiary concerned to assess the effects on its access
rights. . The Parties recognize that in the framework of a merger or an
acquisition of an important part of its assets, a Party may be subject to
confidentiality obligations, which prevent it from giving the full 45 days
prior notice foreseen in GA Article 30.1.

###  2.3.3. Dissemination

Dissemination activities including but not restricted to publications and
presentations shall be governed by Article 29 of the Grant Agreement.

The Parties shall ensure dissemination of their own Foreground as established
in the Grant Agreement provided that such dissemination does not adversely
affect the protection or use of Foreground and subject to the Parties’
Legitimate Interests.

Publication, Publication of another Party’s Foreground or Background and

Cooperation, as well as Use of names, logos and trademarks will be updated in
this IPR Plan deliverable in the next version ( _D5.10 in month 9_ ), as it is
influenced by the inputs and agreements reached for the _Communication and
Dissemination Plan v1 (D5.1 in month 6)_ .

##  Software Access Rights

Parties’ Access Rights to Software do not include any right to receive Source
Code  6  or Object Code  7  ; ported to a certain hardware platform or any
right to receive Source Code, Object Code or respective Software Documentation
8  in any particular form or detail, but only as available from the Party
granting the Access Rights.

The intended introduction of Intellectual Property (including, but not limited
to

Software) under Controlled License Terms in the Project requires the approval
of the PMB (Project Management Board) to implement such introduction into the
Consortium Plan.

Parties agree that Access Rights to Software, which is Background or
Foreground only include: access to the Object Code and, where normal use of
such an Object Code requires an Application Programming Interface (API)  9  .
Access to the Object Code and such an API; and, if a Party can show that the
execution of its tasks under the Project or the Use of its own Foreground is
technically or legally impossible without Access to the Source Code, Access to
the Source Code is to the extent necessary.

The Source Code shall be deemed as Confidential Information and the use of the
Source code shall be strictly limited to the necessary extent.

For the avoidance of doubt, any grant of Access Rights not covered by the CA
shall be at the absolute discretion of the owning Party and subject to such
terms and conditions as may be agreed between the owning and receiving
Parties.

###  2.3.4. Access Rights for Use

_Access rights concerns both Background and Results of the Project
(Foreground)._

This section will be updated in following versions of this deliverable _(D5.11
in month 18 and D5.12 in month 24)_ as it will be influence by agreements and
inputs in _Exploitation and Sustainability Plan v3 (D5.7 in month 18). Two
cases are foreseen for granting access to the Parties – for the purpose of
implementation of Party’s task in the Project and for exploiting the Party’s
own results._

_General rules regarding Access rights to the project results are established
by Article 31 of the Grant Agreement and the principles governing Access
rights to the Background are laid down in the Article 24 of this Agreement._

6

Source Code: means software in human readable form normally used to make
modifications to it including, but not limited to, comments and procedural
code such as job control language and scripts to control compilation and
installation.

7

Object Code: means software information, being technical information used or,
useful in, or relating to the design, development, use or maintenance of any
version of a software programme.

8

Software Documentation: means software information, being technical
information used or, useful in, or relating to the design, development, use or
maintenance of any version of a software programme.

9

Application Programming Interface: means the application programming interface
materials and related documentation containing all data and information to
allow skilled Software developers to create Software interfaces that interface
or interact with other specified Software.

Confidentiality (Non-Disclosure)

All information in whatever form or mode of transmission, which is disclosed
by a Party (the “Disclosing Party”) to any other Party (the “Recipient”) in
connection with the Project during its implementation and which has been
explicitly marked as “confidential”, or when disclosed orally, has been
identified as confidential at the time of disclosure and has been confirmed
and designated in writing within 15 days at the latest as confidential
information by the Disclosing Party, is “Confidential Information”.

In relation to Confidential Information, each Party undertakes not to use such
Confidential Information for any purpose other than in accordance with the
terms of the OASIS Grant Agreement and CA during a period of five years from
the date of disclosure by the disclosing Party, and to treat it and use
reasonable endeavors in order to ensure it is kept confidential and not
disclose the same to any third party without the prior written consent of the
owner in each case during the aforesaid period of five years.

The above shall not apply for disclosure or use of Confidential Information,
if and in so far as the Recipient can show that:

  * The Confidential Information becomes publicly available by means other than a breach of the Recipient’s confidentiality obligations; 

  

  * The Disclosing Party subsequently informs the Recipient that the Confidential Information is no longer confidential. 

  

##  2.4. Exploitable Background/Foreground and its Use

OaSIS uses a number of existing available background of the parties to the
project, which was listed in the CA. In the Table 1 it is showed the updated
list.

According to the Article 24 of the Grant Agreement the partners must identify
and agree (in writing) on the background for the action (‘agreement on
background’).

In this section the intellectual property developed within the scope of the
project will be detailed, work-package by work-package. A list of foreseen
exploitable foreground will be found in Table 2. As the project evolves, more
exploitable products are expected to come up. Each information or knowledge
identified as a Background for the project shall be agreed upon all partners
and expressed in writing in the Attachment 1 to the Consortium Agreement
entitled: _Attachment 1: Background included._

Therefore, this list will be updated regularly by the Project Coordination or
when requested by any partner of the consortium.  
  
<table>  
<tr>  
<th>

Partner nº

</th>  
<th>

Participating Legal Name

</th> </tr>  
<tr>  
<td>

1

</td>  
<td>

Cracow University of Technology – The Coordinator

</td> </tr>  
<tr>  
<td>

None

</td> </tr>  
<tr>  
<td>

2 Linknovate Science SL

</td> </tr>  
<tr>  
<td>

• Extensive use of machine learning and natural language processing to
identify the organizations in the document that match the user's query and to
aggregate the

</td> </tr>  
<tr>  
<td>

results in a unique ‘entity profile’ (record linkage).

  * Delivery of competitive intelligence insights in its current ‘commercial product’: 

  

the “search engine” Linknovate.com. Data sources currently covered: Scientific

Publications, Conference Proceedings, Grants (EC Cordis, UK Gateway to
Research (GtR), Narcis (Holland’s CRIS Systems), USA SBIR/STTR grant program
and others), Patents and trademarks (USPTO and EPO), News

(specialized sources such as MIT Techreview, etc), Web (monitoring of
corporate websites).

  * The use of different ranking retrieval algorithms, which exploit multiple features of documents for showing the most relevant results to a user query. These capabilities lay the technology foundation for Trend identification, Expert search and Data Visualization based on R&D and R&I data. 

  

  * This IP recognized by LKN as background IP is an essential part of LKN product: Linknovate.com 

  

This background is considered trade secret / undisclosed know-how and business
information by LKN; protected by Directive (EU) 2016/943 of the European
Parliament and of the Council of 8 June 2016 on the protection of undisclosed
knowhow and business information (trade secrets) against their unlawful
acquisition, use and disclosure.  4

</td> </tr>  
<tr>  
<td>

3

</td>  
<td>

EURADA

</td> </tr>  
<tr>  
<td>

None

</td> </tr> </table>

Table 1. List of Background included in project OASIS.

So far the Consortium has not yet identified any Foreground IP that should be
mentioned. It is expected that IP may be generated from the tasks and actions
in WP3 (Data Collection and Big Data Analysis) and the methodology editions,
improvements or generated over the life cycle of the project.  
  
<table>  
<tr>  
<th>

WP

</th>  
<th>

Exploitable foreground description

</th>  
<th>

Timetable

</th>  
<th>

Expected

IPR protection

</th>  
<th>

Owner &

other partners involved

</th> </tr>  
<tr>  
<td>

2,3, 4

</td>  
<td>

Methodology for benchmarking SME

segmentation support and segmentation measures.

Improvements in innovation methodologies

</td>  
<td>

M3 to M24

</td>  
<td>

[Estimated]

Appropriate CC license

</td>  
<td>

All partners

[LKN,

EURADA, CTT]

</td> </tr>  
<tr>  
<td>

3

</td>  
<td>

Data analytics software tools

</td>  
<td>

M12 to M24 (2019)

</td>  
<td>

To be updated in following

IPR &DMP versions  5

</td>  
<td>

LKN

</td> </tr> </table>

Table 2. Exploitable Foreground list in project OASIS.

##  2.5. Conclusions

This deliverable shows the Intellectual Property management in the OaSIS
project and summarizes the general agreement, which is settled in the
Consortium Agreement. This report will be updated taking into account the
value-added methodologies and technologies developed during the project.

The Plan for the use and dissemination of foreground appeared in this report
will be used as a brief summary and a preview for the “Deliverable 5.1.
Communications and Dissemination Plan” and the “Deliverable 5.2. Exploitation
and Sustainability Plan” that will be prepared in the month 6 within the “WP5:
Communication, Dissemination and Exploitation led by EURADA. This plan will be
completed in the deliverable D5.1 and also along the life of the project. The
dissemination action is based on these three pillars: Dissemination for
Awareness, Understanding and Action.

#  3\. Data Management Plan

The OaSIS project aims at providing a thorough, evidence-based analysis for
segmentation of innovative SMEs and the assessment of the effectiveness of the
multiple support mechanisms currently used in agencies across Europe.

Towards this end, the OaSIS project will use unique Big Data and Machine
Learning capabilities to develop a performance-based methodology for SME
segmentation which will allow the (Regional and National) Development Agencies
to target SMEs in their industrial fabric with the instruments that
statistically proved to produce the highest impact for similar types of
companies.

Following the EU’s guidelines regarding the DMP, this document will be updated
during the project lifetime (in the form of deliverables).

The following is the OaSIS Project Data Management Plan. It is structured as
recommended in the template for Data management Plans in _Guidelines on FAIR_
_Data Management in Horizon 2020_ .

##  3.1. Data Summary

This document is the OaSIS Project Data Management Plan (DMP). The DMP
describes the data management life cycle for all datasets to be collected,
processed and/or generated by a research project. It covers:

  * the handling of research data during and after the project 

  

  * what data will be collected, processed or generated. 

  

  * what methodology and standards will be applied. 

  

  * whether data will be shared/made open and how 

  

  * how data will be curated and preserved 

  

To provide “data-driven” insights such as identification of “gazelle”
companies

(enterprises with a high growth potential), SMEs with high innovation
potential, SMEs with high internationalization potential, and capacity to
categorise them into clusters of interest, industries, and/or value chains;
the consortium shall document, analyse, and correlate the data collected and
shared by European Regional Development Agencies (the Agencies). The Agencies
sharing their data will be close collaborators of the project, and will have
Third Party status when the conditions set by the Consortium are met (see
details in Open Call for Agencies, publicly available in the project website
and in the corresponding deliverable), and it is approved in the corresponding
GA Ammendment by the EC.

The agencies will provide data in “.xml”, “.csv” and other formats. The
consortium will consider the optimal manners to store and process this data,
at this first stage a relational data base – SQL, for its analysis.

The insights generated will be of use of the project’s Agencies and its SMEs
clients.

This DMP covers two types of data subject to FAIR use:

  1. The data shared by the collaborating agencies (in .xml and/or .csv formats, and under CC-BY licenses, a type of Creative Commons “share-alike” license  6  ), and subject to the confidentiality agreements in place by OASIS partners. 

  

  2. The insights generated by the consortium (in form of data visualizations, reports, and deliverables). 

  

  

##  3.2. FAIR Data

###  3.2.1. Making data findable, including provisions for metadata

The data produced and/or used in the project will be discoverable with
metadata. The consortium will automatically extract primary keywords from the
agencies’ data in order to optimize possibilities for re-use.

Naming conventions have not been defined yet. This will be one of the first
tasks to be performed when data collection from agencies’ begin.

End data products to be produced by OASIS, such as reports, whitepapers, etc.
will have version numbers, but several of the more basic datasets (SMEs data
visualizations for instance) will be dynamic in nature and some providers of
data may not define versions.

###  3.2.2. Making data openly accessible

The OASIS project covers two types of data subject to FAIR use:

  1. The data uploaded by the collaborating agencies (in .xml, .csv and other formats, and under CC-BY licenses), and subject to confidentiality agreements: NDA and Database License Agreement attached in the Annexes of this document. 

  

  2. The insights generated by the consortium (e.g. in form of data visualizations, reports, and deliverables). 

  

  

Regarding Agencies’ data, it will be closed/restricted. Only the respective
agency and the consortium will have access to this data, and only for project
purposes. The data shared by the Agencies will have creative commons license
CC-BY, which requires for attribution (give the author or licensor the credits
in the manner specified by these) but allows for copying, distributing,
displaying and performing the work and make derivative works and remixes based
on it.

As for OASIS data, or insights generated by the consortium based on agencies’
aggregated data, part of it will be open and part will have a commercial use
to further explore the sustainability of the technologies and services
developed under OASIS.

The Information Platform, contained under the Oasis Portal (
_https://oasisportal.eu_ ), will be the key tool to make the data and data
products accessible to a broad range of Stakeholders, including policy makers,
industry and academia. Access will be possible for both verification and re-
use purposes and the Information Platform will contain view, search and
visualization services alongside standardized view- and download-features.

Software needed to access data that will be made publicly available is not
expected. If needed, and/or requested by our close collaborating Agencies, who
will work under Third party status (see Consortium Agreement and Deliverable
D1.2 Consortium Strategy) LKN (as technical lead partner) will consider
enabling a rest API service for data access; promoting and using CERIF (Common
European Research Information Format)  7  as metadata format when possible.

The Consortium will consider for the different types of data, associated
metadata, documentation, and code which will be made public to be deposited in
certified repositories, such as _OpenAire_ (the consortium will explore
appropriate arrangements with the repository), and in the project’s websites (
_www.projectoasis.eu_ and _https://oasisportal.eu_ ).

Registered access to the data (e.g. data insights, graphics, etc) accessible
via the project’s website will be required. The consortium will keep logs of
closed/restricted datasets (for the project partners), while log-in will be
asked for accessing open data. However, the data hosted in OpenAire will be
publically available (complying with the repository policy) and no logs will
be required.

###  3.2.3. Making data interoperable

The Consortium will have a focus on the interoperability of the data produced.
The consortium will allow for data exchange and re-use between researchers,
institutions, organizations, countries, etc. In order to make the data
produced in the project interoperable and consumable, the consortium will
consider using CERIF (the Common European Research Information Format) for the
data that is not restricted (data that is not shared by Regional Agencies, but
produced by the Consortium).

###  3.2.4. Increase data re-use (through clarifying licenses)

In order to permit the widest re-use possible of the data, the openly accessed
datasets will be CC-BY licensed, requires for attribution (giving the author
or licensor the credits in the manner specified by these) but allows for
copying, distributing, displaying and performing the work and make derivative
works and remixes based on it.

Restricted datasets cannot be used by third-parties, as expressed in NDA and
the “Database license agreement” use for data sharing purposes with Agencies
and other organisations.

##  3.3. Allocation of Resources

Since the data gathered from Regional Agencies is heterogeneous and OASIS is a
data intensive project, we estimate the costs for making the data FAIR between
3-5 person month. Costs associated with the data gathering, cleaning and
indexing, as well as open access capacities of research data have been
considered in the grant agreement.

The project partner in charge of the data management it is LKN, as technology
(WP3) and DMP lead. All partners are responsible to contribute to the DMP and
the _fair data_ use.

Data preservation is estimated for the project lifetime plus three years.
Longer term data preservation will be considered with the mentioned data
repositories (e.g. openAIRE). Further decisions will be made by the Consortium
board updating this deliverable.

##  3.4. Data Security

Provisions for data security will differ with regards to the nature of the
data.

Information coming from open datasets will not receive any special treatment.
This information will be directly processed as it arrives to the platform and
then indexed. Temporal copies of the original data will be kept in OASIS’
information processing nodes, but no extra security measures will be put in
place for this kind of information given its public nature.

##  Confidential Data/Restricted Data obtained from the Agencies

Information from restricted datasets will be uploaded via SFTP  8  , given it
provides secure file transfer and manipulation functionality over any reliable
data stream. Information will be stored in a dedicated GNU/Linux server with
state-of-the-art safety measures. In particular, SFTP will perform chroot for
every user agency in order to avoid access to the stored information for non-
authorised parties. Access policies to the server will be restricted to LKN
employees, who have signed appropriate NDAs. Weekly incremental backups are
planned in a secondary, equally secure repository.

Regarding data and cyber security the following standard measures are in place
in order to reduce the risk:

  * End to end encryption of data in transition. 

  

  * Encryption of sensitive data at rest in order to minimize the exposition to non-authorised access event. 

  

  * Periodic vulnerability testing of the secure servers. 

  

  * Standardised enforced data deletion policy of sensitive data when required by a user. 

  

  * Advance user-level data security measures with fine-grained access control. 

  

Regarding personal information: it is not part of the core and objectives of
OASIS project to deal with any personal data, but professional and commercial
data which can be use for a better segmentation of SMEs (such as number of
employees, sector, chain of value, turnover, growth over time, participation
in advanced services or events, and others). However in the case that any
agency shares with OASIS any information containing personal data we plan to
act according to the GDPR regulation, in effect after May 25, 2018, and
according to the procedures local Data Protection Agency (AGPD ).

For these matters, Jose López-Veiga is designated as our Data Protection
Delegate, he will coordinate the register under the AGPD our data processing
activities and will be in charge of the risk analysis over the personal data.

Moreover, an audit of the security measures will be performed with the results
of the risk analysis producing a concise report which will update this
deliverable (IPR & DMP) in the updated versions that follow this deliverable
D5.9. According to the GDPR and AGPD regulations, we will communicate
immediately any breach of the security controls over the personal data.

Furthermore, as stated in our agreements (NDA and Database License Agreements)
with the Agencies, who follow in the Annexes of this deliverable:

_A restricted access procedure shall be implemented for each of the Partner’s
employees and collaborators, in particular Parties shall:_  
  
<table>  
<tr>  
<th>

−

</th>  
<th>

_use the data solely in relation to the purpose of Project;_

</th> </tr>  
<tr>  
<td>

−

</td>  
<td>

_disclose the data solely to its employees or other associates, whatever the
legal basis of their cooperation is, who are directly involved in the Project
implementation and who have a reasonable need to know the content of the
database for the purposes of the duties assigned to as a result of or in
connection with the Project (“Recipient”);_

</td> </tr>  
<tr>  
<td>

−

</td>  
<td>

_ensure that every Recipient who receives or obtains access to the database_

</td> </tr> </table>

_shall be aware of its confidential nature and shall comply with the
restrictions on non-disclosure;_

− _notify the disclosing Agency as soon as practicable after it becomes aware
of any event of loss or unauthorized disclosure or use of any substantial part
of the database;_

##  3.5. Ethical Aspects

The OASIS Project consortium has not identified any specific ethical issues
related to the work plan, outcomes or dissemination, as the program does not
deal with any personal or medical data. We do note that individual partners
will have to adhere to any special ethical rules. In fact this is a point were
the Consortium wants to update the Ethical Requirements for Data treatment

The data management and compliance team are undertaking a significant review
of all policies and procedures on ethics and data use. We will continue to
work on the current data protection policy with the commitment to protect and
process data with adherence to current legislation and policies, in particular
General Data Protection Regulation that comes into force on 25 May 2018.

The project adheres to the commitment to holding any data in secure conditions
and will make every effort to safeguard against accidental loss or corruption
of data.

The Regional Development Agencies are obliged to extract the databases from
any sensitive or personal information prior to its disclosure.

Agencies will participate in the project based on informed consent, may
withdraw at any time, and are able to request information not be published.
Informed consent forms describe how data is stored and used and how
confidentiality is maintained in the long-term. Measures include data
anonymization, aggregating individual-level data and generalizing the meaning
of detailed text.