Privacy Policy

1. Overview

Protecting your personal data matters to us. This policy explains what data is processed when you visit rarelab.org, on what legal basis, and what rights you have. We process personal data only as described here and in accordance with the GDPR and German data protection law.

2. Controller

The controller responsible for data processing on this website is:

RARElab Science & Conservation gUG (haftungsbeschränkt)

Wangener Str. 2

82319 Starnberg

Germany

Email: admin@rarelab.org

3. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The hosting servers are located in Germany. Hetzner processes data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR.

4. Server log files

When you visit this website, the hosting provider's servers automatically record information that your browser transmits. This includes the browser type and version, the operating system, the referrer URL, the IP address of the requesting device, and the time of the request.

This data is not merged with other data sources. The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). Log data is stored only for as long as necessary for this purpose and is then deleted.

5. Cookies

This website does not set any cookies for visitors, and uses no tracking or analytics of any kind. A session cookie is set only for logged-in editors inside the website's administration area; it is strictly necessary for that function and is never set for visitors to the public site.

6. Fonts and assets

All fonts, stylesheets, scripts and images are stored and served directly from this website's own server. No fonts or other assets are loaded from Google or any other third party, so no data is transmitted to third parties when a page loads.

7. Publications page

The Publications page displays a list of academic publications. This list is retrieved by our server from the public API of the reference manager Zotero (Corporation for Digital Scholarship, USA) and cached on our own server. This retrieval happens server-side: your browser does not contact Zotero, and no personal data about you is transmitted to Zotero.

8. Newsletter

If you sign up for our newsletter, we collect your email address and pass it to our email service provider, CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany, which sends our emails on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. CleverReach stores subscriber data on servers in Germany and the European Union.

We use a double opt-in: after submitting the form, you receive a confirmation email and your subscription is only activated when you click the link in it. The confirmation timestamp and your IP address are stored alongside your subscription as the consent record (Art. 6(1)(a) and Art. 7 GDPR).

Each newsletter email contains an unsubscribe link. Unsubscribing removes you from the list and is the appropriate way to withdraw consent for newsletter processing at any time, with effect for the future. The lawfulness of any processing carried out before withdrawal is not affected. Subscriber records of people who unsubscribe, and of people who begin the double opt-in process without completing it, are automatically deleted within one week. Unsubscribed addresses are then held on a suppression list so that they are not re-added by accident.

CleverReach records whether emails are opened and which links are clicked. We operate the account in CleverReach's data-protection-compliance mode, which anonymises IP addresses and the open/click figures shown in reports — we see aggregate patterns, not individual reader behaviour. If you would prefer not to be measured at all, simply do not subscribe — we have no equivalent technology on the website itself.

9. Contact by email

If you contact us by email, the information you send — including your email address and the content of your message — is processed in order to handle your enquiry. The legal basis is our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) and, where the contact relates to a contract or pre-contractual steps, Art. 6(1)(b) GDPR. We delete this data once it is no longer required and no statutory retention obligation applies.

10. Social media links

Our website contains links to RARElab's profiles on Instagram, LinkedIn, Threads and Facebook. These are ordinary links: no data is transmitted to those providers when a page on this website loads. Data is only transmitted to a provider if you actively click its link, at which point that provider's own privacy policy applies.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21 GDPR). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. To exercise any of these rights, contact us at admin@rarelab.org.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Promenade 18

91522 Ansbach

Germany

13. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

14. Donations

Online donations are not yet active on this website. When donation processing goes live — via the Bank für Sozialwirtschaft donation tool — this policy will be updated to describe the data processed, the processor involved, and the relevant retention periods.