Privacy Policy – Curation Tool

Version: 1.2
Prepared: 10 November 2026
Effective date: Date of publication on the Curation Tool platform

1. Controller and Contact

The Curation Tool platform is operated privately by Nicolas Mathieu Lamoure, Frankfurter Straße 81, 63500 Seligenstadt (Germany). Privacy enquiries: info@curation-tool.com. The respective research project may have a different controller. Its responsibilities must be clarified for each project.

2. Account and operational data

2.1. Categories of personal data

The Curation Tool processes personal data to the extent necessary to provide, administer, and secure the platform and its collaborative research functions.

Depending on the features used, the following categories of personal data may be processed:

• Account information: First and last names, email addresses, account identifiers, display names or aliases, and optionally supplied native languages.
• Authentication information: Securely stored password hashes, account activation status, session information, and authentication-related records.
• Project administration: User roles, Project memberships, Curation assignments, invitations, invitation status, and related administrative information.
• Research-related information: Annotation and judgement values, submitted responses, review flags, adjudications, revisions, timestamps, and research-related audit records.
• Technical information: IP addresses where recorded, session identifiers, authentication events, error messages, technical logs, and information required to maintain the security and operation of the platform.
• Communication information: Email addresses and information necessary to deliver operational notifications and respond to support requests.

The processing of research data collected within individual Curations is additionally governed by the applicable project-specific privacy information.

Required and Optional Information

Providing a first name, last name, valid email address, alias, and authentication credentials is necessary to create and maintain a user account. The alias serves as an account identifier and may also be used to sign in. Without this required information, registration and authenticated use of the platform are not possible. Users may change their alias, subject to availability.

Providing information about native languages is optional. Users may use the platform without supplying this information and may change or remove it at any time.

Information about Project memberships and Curation assignments is necessary only for participation in the respective collaborative activities. Technical session information required for authentication and security is processed automatically when the relevant platform functions are used.

2.2. Purposes and Legal Bases for Processing

The following purposes and legal bases apply to the operation of the platform.

2.2.1. Account Registration and Management

We process users' names, email addresses, required aliases, account identifiers, and securely stored password hashes to create and maintain user accounts, identify and authenticate users, and provide access to the platform.

The legal basis is Article 6(1)(b) GDPR (performance of a contract).

2.2.2. Project Administration and Collaboration

We process user roles, Project memberships, Curation assignments, and related administrative information to enable collaboration, manage access permissions, and provide the platform's core functionality.

The legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary to provide the agreed platform functions.

2.2.3. Project Invitations

We process the information necessary to invite individuals to participate in research Projects, identify invitation recipients, and manage acceptance or rejection.

Where invitation-related processing is not necessary for the performance of an existing user agreement, the legal basis is Article 6(1)(f) GDPR (legitimate interests).

Our legitimate interest is to facilitate scientific collaboration and the administration of research Projects.

Following acceptance, processing necessary to provide agreed Project participation functions may be based on Article 6(1)(b) GDPR.

2.2.4. Optional Native Language Information

Users may voluntarily provide information about their native language(s).

This information helps Project Supervisors identify suitable Curators, take linguistic competencies into account, and coordinate language-specific annotation tasks.

The legal basis is Article 6(1)(f) GDPR.

Our legitimate interest is the effective organization of collaborative linguistic research.

Providing native language information is optional. Users may modify or remove it at any time.

2.2.5. Platform Security and Technical Operation

We process necessary session information, authentication records, technical logs, and security-related information to maintain platform functionality, prevent unauthorized access, detect misuse, and investigate technical incidents.

Processing necessary to provide authenticated access is based on Article 6(1)(b) GDPR.

Additional security monitoring and incident investigation are based on Article 6(1)(f) GDPR, reflecting our legitimate interest in operating a secure and reliable service.

2.2.6. Service Communications and Support

We process email addresses and the information necessary to send account activation messages, password resets, Project invitations, security notifications, legal-document notifications, and other operational communications.

We also process information voluntarily provided in support requests to investigate and respond to those requests.

Depending on the specific purpose, the legal basis is Article 6(1)(b) GDPR where communication is necessary to provide the agreed service, Article 6(1)(c) GDPR where a specific legal obligation applies, or Article 6(1)(f) GDPR where processing is necessary for our legitimate interest in handling user requests, maintaining the service, and addressing operational problems.

These operational communications are distinct from marketing communications.

2.3. Legitimate Interests Assessments (Article 6(1)(f) GDPR)

Where the Curation Tool processes personal data on the basis of Article 6(1)(f) GDPR, the processing must serve a legitimate interest, be necessary to achieve that interest, and not be overridden by the interests, fundamental rights, or freedoms of the individuals concerned.

The following assessments explain the legitimate interests pursued, the necessity of the processing, the potential impact on users, and the safeguards considered when balancing the respective interests.

2.3.1. Optional Native Language Information

Processing activities

The Curation Tool allows users to provide their native language(s) as optional profile information. The alias is a required account identifier and is addressed under Section 2.2.1 instead.

Legitimate Interest

The Curation Tool facilitates collaborative linguistic research and the organization of annotation Projects.

Information about users' native languages enables Project Supervisors to consider linguistic competencies when selecting and assigning Curators to language-specific annotation tasks.

The legitimate interest pursued is the efficient organization and coordination of collaborative research activities.

Necessity

Information about native languages is relevant to the allocation of language-specific annotation tasks. A user's name or email address alone does not provide equivalent information about their linguistic competencies.

Nevertheless, providing native language information is entirely optional. Users may use the platform without specifying their native languages.

Users may subsequently modify or remove their native language information.

The platform relies on information provided by users themselves rather than automatically determining their native languages or ethnic backgrounds.

Balancing of Interests

The following interests and risks have been considered:

• Users have an interest in controlling the disclosure and use of their personal and linguistic information.
• Information about native languages may, in some circumstances, permit inferences about a person's background or origin.
• Users may be concerned that linguistic information could influence their selection for research tasks.
• Users can reasonably expect voluntarily supplied linguistic information to be used for the organization of language-related research activities.

The processing is limited by the optional nature of native language information, its stated research-related purpose, and users' ability to modify or remove the information.

Access to profile information is governed by the platform's user roles and access permissions.

Native-language information is not, by itself, treated as a determination of ethnic origin. The processing described here does not authorize the deliberate collection or inference of special categories of personal data under Article 9 GDPR.

Conclusion

Given the legitimate research-related purpose, the optional nature of native language information, the applicable access restrictions, and users' ability to remove this information, the operator considers the processing proportionate.

The legitimate interests pursued are not considered to be overridden by users' interests or fundamental rights and freedoms.

The legal basis is Article 6(1)(f) GDPR.

2.3.2. Project Invitations and Research Collaboration

Processing activities

The Curation Tool processes information necessary to manage invitations to research Projects, including the identities of inviting and invited users, their relevant account identifiers, Project associations, invitation status, and related administrative information.

Legitimate Interest

The Curation Tool enables researchers to establish and coordinate collaborative annotation Projects.

For this purpose, Project Supervisors must be able to invite other users to participate in Projects and manage their acceptance or rejection of invitations.

The legitimate interest pursued is the effective organization of scientific collaboration and the administration of access to research Projects.

Necessity

A functioning invitation system requires the platform to identify the intended recipient, associate the invitation with a particular Project, and record whether the invitation has been accepted or declined.

Without this information, the platform could not reliably manage Project participation or distinguish between authorized and unauthorized participants.

The processing is therefore limited to information required for identifying recipients, delivering invitations, managing responses, and administering the resulting Project membership.

Information unrelated to these purposes is not necessary for invitation management.

Balancing of Interests

The following interests and risks have been considered:

• Individuals have an interest in deciding whether they wish to participate in a research Project.
• Invitations may be unwanted or irrelevant to the recipient.
• Project associations may disclose information about a person's professional activities or research interests.
• Users can reasonably expect Project invitations to be part of a collaborative research platform.

The Curation Tool provides mechanisms for users to accept or decline Project invitations.

Accepting an invitation is not a general consent to unrelated processing of personal data. Declining an invitation does not require the individual to participate in the Project.

Access to invitation and membership information is governed by the platform's Project permissions and administrative access controls.

Conclusion

Processing the limited information required to manage Project invitations serves a legitimate and reasonably foreseeable purpose.

Given the research collaboration context, the ability to decline invitations, and the limited information necessary for invitation management, the operator considers that the legitimate interest is not overridden by the rights and freedoms of the individuals concerned.

The legal basis for invitation-related processing that is not necessary for performance of an existing user agreement is Article 6(1)(f) GDPR.

Processing necessary to provide agreed Project-management functions to registered users may instead fall under Article 6(1)(b) GDPR.

2.3.3. Technical Security, Access Logs, and Prevention of Misuse

Processing activities

The Curation Tool processes technical information necessary for the security and reliable operation of the platform.

Depending on the relevant component, this may include IP addresses, timestamps, authentication events, session-related information, error messages, and records of relevant administrative operations.

Legitimate Interest

As the operator of an online research platform, the controller has a legitimate interest in protecting user accounts, research data, and the technical infrastructure against unauthorized access, misuse, and security incidents.

The processing serves the following purposes:

• Detecting and investigating unauthorized access attempts.
• Identifying technical failures and security vulnerabilities.
• Preventing misuse of user accounts and platform functions.
• Maintaining the integrity and availability of research data.
• Investigating incidents affecting the confidentiality, integrity, or availability of the service.

These purposes support the security of the platform and the protection of its users.

Necessity

Certain technical information is required to identify and investigate security incidents.

For example, timestamps and relevant connection information may help identify repeated unauthorized authentication attempts. Error logs may help determine whether an operational failure or security incident has occurred.

The operator cannot reliably investigate such events using entirely anonymous or exclusively aggregated information in every case.

Nevertheless, the processing must remain proportionate to its purposes.

Data that is not relevant to the operation or security of the service is not collected merely because it is technically available.

Technical logs are not intended to serve as a general monitoring system for users' scientific activities or personal behavior.

Balancing of Interests

The following interests and risks have been considered:

• Users have a legitimate expectation that the platform protects their accounts and research data.
• Technical logs may contain personal data, including IP addresses and information about the timing of individual activities.
• Extensive logging or unnecessarily long storage periods could permit reconstruction of users' activities.
• Unauthorized access to logs could expose information about users or their interactions with the platform.

These risks are addressed through purpose limitation, restricted administrative access, and defined retention arrangements.

The server's system journal is configured with a 30-day retention limit and a maximum storage allocation of 1 GB.

System logs managed through rsyslog are configured for daily rotation, with up to 30 rotated versions and a maximum age of 30 days, subject to the technical operation of log rotation.

These settings do not necessarily determine the retention of every application-specific record, security event stored in the database, or external service log. Such data is subject to its applicable retention arrangements.

The operator limits the collection and retention of technical information to what is necessary for operating and securing the platform.

Conclusion

The protection of user accounts, research data, and technical infrastructure constitutes a legitimate interest.

Given the security-related purposes, the necessity of certain technical records, and the measures limiting the scope and duration of processing, the operator considers that these interests are not generally overridden by the rights and freedoms of the individuals concerned.

The legal basis for security monitoring beyond the processing necessary to provide authenticated access is Article 6(1)(f) GDPR.

Processing strictly necessary to provide authenticated access to registered users may additionally fall under Article 6(1)(b) GDPR.

2.4. Project and Curation Operations

Depending on a user's role, the Curation Tool processes Project memberships, datasets, stimuli, annotation and judgement values, response and activity timestamps, review flags, adjudications, revisions, research-related audit events, and exports.

Research contributions may remain attributable to an internal Curator identifier or to a named contributor visible to authorized Project Supervisors.

Such attribution may constitute personal data processing even when the linguistic content of the annotation is not itself personal data.

The controller responsible for a particular research Project determines the purposes, legal basis, and applicable retention arrangements for the research data collected within that Project.

These matters must be explained in the applicable project-specific privacy notice.

The legal basis for research-related processing must be established by the responsible research controller. It cannot automatically be inferred from the legal bases used for ordinary platform account administration.

2.5. Research Methods and Recordings

A Curation may employ different research methods, including text-based annotation, image-based tasks, audio or video stimuli, audio or video recording, and response-time measurement.

The categories of personal data processed depend on the research methods actually configured and used.

The Curation Tool provides project-specific privacy notices explaining the relevant methods and permitting Project Supervisors to provide additional information about the research purpose, responsible controller, contact details, legal basis, and retention arrangements.

Where a research procedure requires consent or another specific legal condition, that requirement must be satisfied independently of the user's general registration or acknowledgement of this Privacy Policy.

A general acknowledgement of this Privacy Policy does not constitute consent to participation in a particular research study.

The platform does not authorize the intentional collection of special categories of personal data under Article 9 GDPR as part of its standard use.

A Project intending to process such data must obtain explicit prior written authorization from the platform operator and independently establish an appropriate legal basis under Article 6 GDPR, an applicable condition under Article 9 GDPR, and the required safeguards.

Authorization from the platform operator does not itself constitute a legal basis for processing.

Unexpected personal or sensitive information, including information supplied in free-text responses or media, must be handled in accordance with applicable data protection law.

2.6. Retention of Operational Information

Account and operational information is retained only for as long as necessary for the respective purposes, subject to the applicable retention arrangements and legal requirements.

The following distinctions apply:

• Account and profile information is generally retained while the account remains active, subject to the account deletion procedures and any applicable exceptions.
• Scientific research contributions may remain within the relevant Project when a user leaves that Project or deletes their platform account, provided that continued processing has an appropriate legal basis.
• Regular automated PostgreSQL database backups are subject to a 14-day retention policy.
• The server's system journal is configured for a maximum retention period of 30 days and a storage limit of 1 GB.
• System logs managed through rsyslog are subject to daily rotation, with 30 retained rotations and a maximum-age setting of 30 days.
• Application-specific records, communication records, and research data may be subject to different retention arrangements depending on their respective purposes.

Further details concerning deletion, recovery periods, backups, and external data storage are provided in Section 6 of this Privacy Policy.

2.7. Review of Legitimate Interests

The legitimate interests assessments described above reflect the purposes and safeguards applicable to the identified processing activities.

They will be reviewed when material changes occur to the purposes of processing, categories of personal data, recipients, access permissions, retention arrangements, or technical functions.

A change in circumstances may require the operator to reconsider whether Article 6(1)(f) GDPR remains an appropriate legal basis.

Individuals whose personal data is processed on the basis of Article 6(1)(f) GDPR have the right to object to that processing in accordance with Article 21 GDPR.

Further information about this and other data protection rights is provided in Section 7 of this Privacy Policy.

2.8. Automated Decision-Making

The Curation Tool does not engage in solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects individuals within the meaning of Article 22 GDPR.

Decisions concerning Project participation, Curation assignments, and the scientific evaluation of annotations are made by authorized users rather than by automated decision-making systems.

3. Research Data and Curations

Project staff create datasets, annotations, judgements, reviews, exports and logs. Some annotations are linked to the Curator who produced them. Scientific contributions do not automatically disappear when a Curator leaves a project, but any continued personal-data processing requires an appropriate lawful basis and applicable safeguards. The responsible research institution/person and any specific information are determined separately for each project.

4. Browser Storage and Optional Collection Methods

Essential session and security cookies are used. Some display preferences and temporary responses to public Example Curations remain in the browser. Depending on the project, audio/video recordings and timing information can be collected; those methods require project-specific information, and separate consent where legally required.

5. Hosting, Service Providers and External Storage

5.1. Hosting and Technical Infrastructure

The Curation Tool is operated on a virtual private server (VPS) provided by netcup GmbH, Germany.

The server is located in a data centre in Nuremberg, Germany, and hosts the web application, its PostgreSQL database, and the associated application infrastructure.

netcup provides the technical infrastructure necessary to operate the service. In connection with these services, netcup may process personal data to the extent necessary for hosting, infrastructure maintenance, security, and technical support.

The platform operator has entered into a data processing agreement with netcup in accordance with Article 28 GDPR.

The authoritative DNS records for curation-tool.com are currently administered through ALL-INKL.COM – Neue Medien Münnich, Germany. This is a domain and DNS management function; the platform application, database, and active email mailboxes are not hosted at ALL-INKL.

5.2. Email Services

The Curation Tool uses netcup GmbH, Germany, as its email service provider. Email services are provided through the operator's netcup webhosting package, separately from the virtual private server that hosts the application and database.

The platform uses noreply@curation-tool.com to send automated operational communications, including account activation messages, password resets, Project invitations, security notifications, and legal-document notifications. The address info@curation-tool.com is used for support, privacy enquiries, and other administrative correspondence, including messages handled through the platform's Admin Inbox.

Incoming and outgoing mail for these addresses is handled through netcup's mail infrastructure. Email-related processing may include sender and recipient addresses, message contents, transmission metadata, and technical information necessary for delivery, spam protection, security, and troubleshooting.

The previous email hosting service at ALL-INKL has been discontinued for these mailboxes. The continued use of ALL-INKL for DNS management, as described in Section 5.1, is separate from email hosting.

The platform does not use these operational communications for advertising or marketing purposes.

5.3. Recipients and Access to Personal Data

Personal data is accessible only to the extent required for operating the platform, administering Projects, and performing authorized research activities.

Depending on the relevant processing activity, recipients may include:

• Platform administrators: For user administration, technical maintenance, security, and authorized administrative functions.
• Project Supervisors: For managing Project membership, assigning Curators, administering Curations, and accessing research data within their Projects.
• Curators and other authorized Project members: To the extent required for their assigned tasks and the access permissions granted within the platform.
• Hosting and email service providers: To the extent necessary to provide the relevant infrastructure and communication services.
• External cloud storage providers: Where a Project Supervisor elects to connect an external storage service for research files.

Access permissions are governed by the platform's role-based authorization system.

Personal data is not disclosed to unrelated third parties for advertising purposes.

Disclosures required by applicable law may be made where a valid legal obligation exists.

5.4. External Cloud Storage

The Curation Tool allows Project Supervisors to connect external cloud storage services to facilitate the management and use of research datasets and media files.

Depending on the integrations available and configured, supported services may include Google Drive, Microsoft OneDrive, Dropbox, and institutional cloud storage services such as next.hessenbox.

The use of external cloud storage is optional.

Where a Project Supervisor connects such a service, relevant files and associated information may be exchanged with the selected provider to the extent necessary for the requested functionality.

External cloud storage remains subject to the terms, technical arrangements, and privacy practices of the respective provider.

Project Supervisors are responsible for ensuring that their selected storage arrangements are appropriate for the research data concerned and for providing any necessary project-specific information to participants.

Deletion of a Curation or a platform account does not automatically delete files stored in an external cloud account controlled by a user or research Project.

The respective cloud account holder remains responsible for managing and deleting those files in accordance with the applicable retention requirements.

5.5. International Data Transfers

The Curation Tool's primary application and database infrastructure is hosted in Germany. Its email services are provided through a netcup webhosting package provisioned in Germany.

The platform's primary hosting arrangements do not require the application database to be stored outside the European Economic Area (EEA). Emails sent to external recipients may, however, be processed by the recipients' own email providers, depending on the recipient and their chosen service.

However, international data transfers may arise where Project Supervisors choose external cloud services whose infrastructure, support arrangements, or subprocessors involve countries outside the EEA.

The possibility and legal conditions of such transfers depend on the provider and configuration selected.

Where personal data is transferred to a country outside the EEA, the responsible controller must ensure that an applicable transfer mechanism under Chapter V GDPR is available, such as:

• An adequacy decision issued by the European Commission under Article 45 GDPR; or
• Appropriate safeguards under Article 46 GDPR, including applicable Standard Contractual Clauses, together with any additional measures required in the circumstances.

The use of an external cloud service does not itself establish that an international data transfer is lawful.

Where a research Project involves such transfers, the responsible research controller must identify the relevant recipients, transfer destinations, and applicable safeguards in the project-specific privacy information.

5.6. Changes to Service Providers

The platform operator may replace technical service providers where necessary for operational, security, or organizational reasons.

Changes affecting the recipients of personal data, processing locations, or international data transfers will be reflected in this Privacy Policy as required by applicable data protection law.

Where a change materially affects the processing of personal data, users will be informed as appropriate.

6. Retention and Erasure

The Curation Tool retains personal data only for as long as necessary for the purposes for which it is processed, subject to applicable legal obligations, research requirements, and the retention arrangements described below.

Different retention periods apply to account information, research contributions, deleted Curations, database backups, technical logs, and externally stored files.

6.1. User Accounts and Personal Information

Personal account information, including names, email addresses, aliases, native languages, authentication information, and account-related records, is generally retained for the duration of the user's account.

Users may modify or remove their optional native language information at any time.

When a user permanently deletes their account, the platform removes the account and associated personal profile information from the active application database without a general waiting period, subject to applicable legal obligations and the distinctions described below.

Account deletion does not necessarily require the deletion of scientific annotations previously contributed to research Projects.

Completed research contributions may remain available within the relevant Project, including for scientific evaluation, disagreement resolution, reliability calculations, and research documentation.

Where continued attribution to an identifiable individual is no longer necessary, identifying information should be removed or separated from the retained research contributions.

Pseudonymised research records may continue to constitute personal data and therefore remain subject to the GDPR.

The continued processing of identifiable research contributions requires an appropriate legal basis and applicable safeguards.

6.2. Deletion of Curations

The Curation Tool provides two distinct deletion procedures.

Regular Curation Deletion

When a Curation is deleted through the standard deletion function, it enters a recovery period of 30 days.

During this period, the deleted Curation may be restored by an appropriately authorised user.

After the recovery period expires, the Curation and its associated recovery data are subject to automatic permanent deletion.

Permanent Curation Deletion

The separate Permanently Delete Curation function bypasses the recovery period.

This operation removes the Curation from the active application database and the application's recovery history without the standard 30-day waiting period.

Permanent deletion from the active application does not necessarily result in the immediate removal of copies contained in existing database backups or independently controlled external storage.

Such copies are subject to the separate retention arrangements described below.

6.3. Database Backups and Recovery Copies

The Curation Tool uses automated database backups to protect against accidental data loss, corruption, and technical failures.

Regular Database Backups

Regular PostgreSQL database backups are subject to a retention period of 14 days.

The backup system automatically removes backup archives exceeding this period during successful backup operations.

The backup configuration and retention mechanism were verified in November 2026.

A database backup was successfully restored into a separate test database, confirming the technical recoverability of its contents.

Information deleted from the active database may therefore remain temporarily present in previously created backup archives until those archives expire under the applicable retention policy.

Legacy Migration and Recovery Backups

Additional backup archives created during earlier server migrations and recovery operations are subject to an automated 14-day retention and cleanup mechanism.

The corresponding retention service runs independently of the regular database backup procedure.

Application Update and Rollback Snapshots

The application's deployment system retains up to five recent code rollback snapshots to permit recovery from unsuccessful software updates.

These snapshots are intended for application code recovery and exclude the application's data directory.

Database backups created before deployments are governed by the regular database backup retention policy.

These arrangements do not automatically govern independently created server snapshots, downloaded database copies, or backups maintained by external infrastructure providers.

6.4. Technical Logs and Security Records

The Curation Tool maintains technical logs necessary for system administration, troubleshooting, security monitoring, and the investigation of technical incidents.

The following retention arrangements apply to the server infrastructure.

System Journal

The server's systemd journal is configured with:

• A maximum retention period of 30 days for archived journal files.
• A maximum storage allocation of 1 GB.
• Persistent storage for relevant system and service logs.

Log entries are removed through the system's journal rotation and maintenance mechanisms. The configured retention period does not guarantee deletion of every individual entry at an exact point in time.

System Logs Managed by rsyslog

System logs managed through rsyslog are configured with:

• Daily log rotation.
• Up to 30 retained rotations.
• A maximum-age setting of 30 days.
• Automatic removal of expired rotated logs through the log rotation mechanism.

Application-Specific Records

Application-specific audit records, administrative activity logs, email-related records, and other technical information may be subject to different retention arrangements depending on their purpose and the relevant application function.

Such records are not automatically governed by the system journal or rsyslog retention settings.

Their retention is determined by their operational, security, administrative, or research-related purpose, subject to applicable legal requirements and the principle of storage limitation.

6.5. Research Data and Scientific Retention

Research datasets, annotation values, judgement responses, review records, adjudications, and related scientific information may require retention beyond the duration of an individual user's account.

The applicable retention period or criteria are determined by the controller responsible for the respective research Project.

These arrangements must be explained in the relevant project-specific privacy notice.

Where personal data is retained for scientific research purposes, appropriate safeguards must be implemented in accordance with Article 89 GDPR.

Such safeguards may include access restrictions, data minimisation, pseudonymisation, or anonymisation, where appropriate.

Scientific research does not automatically justify indefinite retention of identifiable personal data.

6.6. External Cloud Storage and Exported Datasets

Project Supervisors may connect external cloud storage services for datasets, stimuli, media files, recordings, or other research materials.

Files stored in a connected cloud account remain under the control of the relevant account holder or responsible research organisation.

Deleting a Curation, Project, or user account from the Curation Tool does not automatically delete files stored in external cloud accounts.

The platform does not independently erase files from cloud storage accounts controlled by users or research Projects as part of its ordinary deletion procedures.

The respective account holder or research controller is responsible for managing and deleting those files in accordance with applicable legal obligations and research-specific retention arrangements.

The same distinction applies to datasets, annotation exports, reports, and other files independently downloaded from the platform.

Such copies are not automatically deleted when their corresponding records are removed from the Curation Tool.

6.7. Requests for Erasure of Personal Data

Individuals may request the erasure of their personal data under Article 17 GDPR, subject to the applicable statutory conditions.

Requests are assessed in relation to the relevant processing purpose, legal basis, and the circumstances of the individual case.

Where personal data is no longer necessary for the purpose for which it was collected or processed, and no other lawful ground for retention applies, it will be erased in accordance with applicable law.

Article 17(3)(d) GDPR provides a limited exception relating to scientific research where erasure would be likely to render impossible or seriously impair the achievement of the research objectives, subject to the conditions and safeguards of Article 89 GDPR.

This exception is not automatic.

Its applicability must be assessed in the individual circumstances of each request.

Where erasure is required, the controller will take appropriate steps to remove the relevant personal data from active processing systems and address any remaining copies in accordance with the applicable legal requirements and backup retention arrangements.

Requests concerning platform accounts may be directed to the platform operator using the contact details provided in Section 1.

Where a separate researcher or research institution acts as the controller for a particular Project, requests concerning that Project's research data may need to be addressed to or coordinated with the responsible research controller.

7. Data Subject Rights and Complaints

7.1. Rights under the GDPR

Individuals whose personal data is processed through the Curation Tool have the following rights under the General Data Protection Regulation (GDPR), subject to the applicable legal conditions:

• Right of access (Article 15 GDPR): The right to obtain confirmation of whether personal data concerning them is being processed and, where applicable, to receive information about that processing and a copy of their personal data.

• Right to rectification (Article 16 GDPR): The right to request correction of inaccurate personal data and completion of incomplete personal data.

• Right to erasure (Article 17 GDPR): The right to request deletion of personal data where the applicable legal conditions are met. This right may be subject to statutory exceptions, including the limited provisions concerning scientific research described in Section 6.

• Right to restriction of processing (Article 18 GDPR): The right to request that processing of personal data be restricted under certain circumstances.

• Right to data portability (Article 20 GDPR): Where processing is based on consent or a contract and is carried out by automated means, individuals may have the right to receive personal data they have provided in a structured, commonly used, machine-readable format and to transmit that data to another controller, subject to the applicable conditions.

• Right to object (Article 21 GDPR): Where processing is based on Article 6(1)(f) GDPR, individuals have the right to object on grounds relating to their particular situation. Following an objection, the relevant processing will cease unless the controller demonstrates compelling legitimate grounds that override the individual's interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims.

• Right to withdraw consent (Article 7(3) GDPR): Where processing is based on consent, individuals may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

These rights are not necessarily unconditional and may be subject to limitations expressly provided for by applicable law.

7.2. Exercising Your Rights

Requests concerning personal data processed by the platform operator may be submitted using the contact details provided in Section 1 of this Privacy Policy.

Users may request access, rectification, erasure, restriction of processing, or data portability, or exercise their right to object.

To help identify the relevant records, users are encouraged to submit requests from the email address associated with their account, where possible.

Where there are reasonable doubts concerning the identity of the person submitting a request, the operator may request additional information necessary to verify their identity.

Requests will be handled without undue delay and generally within one month of receipt.

Where necessary, this period may be extended by up to two additional months, taking into account the complexity and number of requests. The individual will be informed of any extension and the reasons for it within one month of receipt of the request.

Requests are generally handled free of charge. Where requests are manifestly unfounded or excessive, particularly because of their repetitive character, the operator may charge a reasonable fee or refuse to act, as permitted by Article 12(5) GDPR.

If a request cannot be fulfilled, the operator will explain the reasons and inform the individual of the available complaint and judicial remedies.

7.3. Requests Concerning Research Projects

The Curation Tool supports research Projects that may be administered by researchers or research institutions acting as separate data controllers.

Where a request concerns personal data processed for a particular research Project, the responsible research controller may need to assess and fulfil the request.

The platform operator will handle requests concerning processing under the operator's own responsibility and, where appropriate and legally permitted, assist in identifying or contacting the controller responsible for the relevant research data.

Project-specific privacy notices provide additional information about the respective research controller and the handling of research-related personal data.

7.4. Right to Lodge a Complaint

Individuals who believe that the processing of their personal data infringes the GDPR have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR.

The supervisory authority responsible for the Curation Tool's private operator in Hesse, Germany, is:

The Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit – HBDI)

Postal address:
Postfach 3163
65021 Wiesbaden
Germany

Telephone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de
Online complaint form: https://datenschutz.hessen.de/service/beschwerde-uebermitteln

Individuals may also lodge a complaint with a supervisory authority in the EU Member State of their habitual residence, place of work, or the place of the alleged infringement.

Individuals are welcome to contact the platform operator first to seek clarification or resolve a concern. However, contacting the operator is not a prerequisite for lodging a complaint with a supervisory authority.

The right to lodge a complaint exists independently of other available administrative or judicial remedies.

8. Updates to This Privacy Policy

The Curation Tool may update this Privacy Policy to reflect changes in legal requirements, technical infrastructure, data processing activities, security arrangements, or platform functionality.

Each published version of this Privacy Policy is identified by its version number and publication date.

Notification of Changes

Users will be informed of material changes to this Privacy Policy through appropriate communication channels, including email notifications and, where applicable, notices displayed within the platform.

Where a change materially affects users' rights or the processing of their personal data, users will be informed sufficiently in advance, where required, to allow them to understand the changes and exercise their rights.

Minor editorial corrections that do not materially affect the processing of personal data may be published without individual notification.

Acknowledgement of Updated Policies

The platform may request users to acknowledge that they have received or reviewed an updated version of this Privacy Policy.

Such acknowledgement serves to document that the relevant information has been made available to the user.

Acknowledgement does not constitute general consent to the processing of personal data, acceptance of an otherwise unlawful processing activity, or a waiver of any rights under the GDPR.

Where a particular processing activity legally requires consent, that consent will be requested separately and must meet the applicable requirements of the GDPR.

Availability of the Privacy Policy

The current version of this Privacy Policy will remain accessible through the platform.

Users may contact the platform operator using the contact information provided in Section 1 if they have questions about any changes.