OpenVerse Wiki:Privacy policy: Difference between revisions

Revision as of 09:28, 2 October 2026

Last updated: 2 October 2026

This Privacy Policy describes how the OpenVerse Wiki (https://wiki.open-verse.eu), operated by Martel GmbH ("we", "us", or "our"), collects and processes personal data. We are committed to protecting your privacy and handling your personal data in accordance with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

As a public MediaWiki platform designed for collaborative open science and repository sharing, **we collect and process personal data when you browse the wiki, create an account or log in (including via Single Sign-On from the OpenVerse Observatory), edit content, or interact with the platform.**

1. Data Controller and Representatives

Data Controller (Switzerland)

The entity responsible for processing your personal data on this platform is:

Martel GmbH
Überlandstrasse 111, 8600 Dübendorf, Switzerland
Email: [email protected]

Designated EU Representative (EEA)

Because Martel GmbH is established outside the European Economic Area (EEA), we have designated the following entity as our representative in the European Union under Article 27 of the GDPR:

Martel Innovate B.V.
Keizersgracht 482, 1017 EG Amsterdam, Netherlands

2. Categories of Data Collected and Processed

A. User Account & Registration Data (including Single Sign-On)

When you register an account or log in to the OpenVerse Wiki—either directly or via Single Sign-On (SSO) from the OpenVerse Observatory (operated by Trust-IT Services)—we collect personal data necessary to establish and manage your user account.

Data Collected: Username, email address, password hash (for direct accounts), SSO authentication tokens/identifiers, account preferences, and registration timestamps.
Purpose & Legal Basis: Under Swiss revFADP (Art. 31(2)(a)) and GDPR (Art. 6(1)(b)), processing account data is necessary for the performance of a contract / service provision to authenticate your identity, provide account access, manage user permissions, and enable collaborative editing.

B. User Contributions, Edits, and Published Content

When you create, edit, or comment on wiki pages, upload files, or participate in discussions on the OpenVerse Wiki, your contributions are recorded by the platform.

Data Collected: Wiki text edits, uploaded files, revision histories, talk page posts, edit summaries, and associated timestamps.
Public Attribution: In accordance with standard MediaWiki functionality and open repository standards, your contributions and edits are publicly displayed and permanently linked to your username in the revision history of the relevant wiki pages.
Purpose & Legal Basis: Processing is necessary for service provision (Art. 6(1)(b) GDPR) and justified by our legitimate interests (Art. 6(1)(f) GDPR / FADP Art. 31(1)) in operating an open, transparent, and attribution-grounded repository for research and innovation.

C. Strictly Necessary Session & Authentication Cookies

This website uses strictly necessary cookies native to the MediaWiki platform.

Purpose: These cookies maintain your logged-in state (e.g., wikiUserID, wikiUserName, wikiToken), manage session security, save language preferences, and enable secure editing.
No Consent Required: Under Swiss FADP and EU ePrivacy rules, functional session cookies that are technically essential to deliver a requested service do not require user consent.

D. Essential Cybersecurity & Technical Connection Logs

When you access or log in to the wiki, our server infrastructure automatically logs standard technical connection data.

Data Logged: IP address, date and time of request, requested URL, HTTP status code, volume of data transferred, referrer URL, and browser User-Agent string.
Purpose & Legal Basis: Under Swiss revFADP (Art. 31(1)-(2)) and GDPR (Art. 6(1)(f)), logging technical connection data is justified by our overriding legitimate interests to defend against cyber-attacks, prevent spam/vandalism, and ensure system resilience.

E. Web Analytics (Matomo – Opt-In Only)

To understand how visitors use our wiki and improve platform navigation, we use an opt-in, self-hosted Matomo analytics instance.

Explicit Opt-In: Analytics scripts are loaded and cookies (_pk_id, _pk_ses) are set only if you give explicit consent via our cookie banner.
Privacy Controls: Matomo runs on Martel's EU cloud servers, IP addresses are anonymised at source, and no analytics data is shared with third parties.

3. Cloud Infrastructure, Processors & SSO Transfers

We partner with trusted service providers under formal Data Processing Agreements (DPAs):

OpenVerse Observatory SSO (Trust-IT Services): When you log in via OpenVerse Observatory SSO, authentication credentials are exchanged between Trust-IT Services (Italy) and Martel GmbH (Switzerland) solely to authenticate your account.
AWS Sovereign Cloud (Germany / European Union): All wiki databases, user account records, page histories, and server security logs are stored on physical AWS servers within the European Union (EU).
Cloudflare (United States / Global): Web traffic is routed through Cloudflare to protect against malicious traffic and DDoS attacks, protected under EU/Swiss Standard Contractual Clauses (SCCs).

4. Data Retention and Erasure

Account Data: Account profile data is retained as long as your account remains active. You can delete your account at any time.
Wiki Edits & Public Contributions: To maintain the historical integrity, attribution, and open-license lineage of collaborative wiki content, public page edits, upload histories, and revision records are permanently retained in the wiki's public version history associated with your username.
Security Logs: Standard technical connection logs are automatically purged within 14 to 30 days, unless required for active cyber-threat investigation.
Session Cookies: Purged from your device when you log out or close your browser session.

5. Your Statutory Rights

Under the Swiss revFADP and GDPR, you have statutory rights regarding your personal data:

Right of Access (Art. 25 FADP / Art. 15 GDPR): Request confirmation and a copy of your personal data.
Right to Rectification (Art. 32 FADP / Art. 16 GDPR): Request correction of inaccurate personal details.
Right to Erasure (Art. 32 FADP / Art. 17 GDPR): Request deletion of personal data, subject to legal obligations and public wiki edit attribution requirements.
Right to Restriction & Object (Art. 32 FADP / Art. 18 & 21 GDPR): Restrict or object to processing based on legitimate interests.
Right to Data Portability (Art. 28 FADP / Art. 20 GDPR): Request your personal data in a structured format.

To exercise these rights, contact us directly at [email protected].

Supervisory Authority Complaints

In Switzerland: Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern (www.edoeb.admin.ch).
In the EU/EEA: Your local national Data Protection Authority (DPA).

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:Privacy Policy}}
-''Last updated: 31 August 2026''
+''Last updated: 2 October 2026''
-This Privacy Policy describes how the '''OpenVerse Wiki''' (https://wiki.open-verse.eu), operated by '''Martel GmbH''' ("we", "us", or "our"), processes personal data. We are committed to protecting your privacy and handling your data in accordance with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
+This Privacy Policy describes how the '''OpenVerse Wiki''' (https://wiki.open-verse.eu), operated by '''Martel GmbH''' ("we", "us", or "our"), collects and processes personal data. We are committed to protecting your privacy and handling your personal data in accordance with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
-As a public MediaWiki platform designed for collaborative open science and repository sharing, **we process your personal data only for essential technical operations and, if you give your explicit consent, for self-hosted website statistics.**
+As a public MediaWiki platform designed for collaborative open science and repository sharing, **we collect and process personal data when you browse the wiki, create an account or log in (including via Single Sign-On from the OpenVerse Observatory), edit content, or interact with the platform.**
 ----
@@ Line 20: / Line 20: @@
 ----
-== 2. Categories of Data Processed ==
+== 2. Categories of Data Collected and Processed ==
-=== A. Strictly Necessary Session Cookies ===
+=== A. User Account & Registration Data (including Single Sign-On) ===
-This website uses strictly necessary session cookies native to the MediaWiki platform.
+When you register an account or log in to the OpenVerse Wiki—either directly or via Single Sign-On (SSO) from the OpenVerse Observatory (operated by Trust-IT Services)—we collect personal data necessary to establish and manage your user account.
-* '''Purpose:''' These cookies are technically indispensable to manage your current page request, coordinate standard MediaWiki platform features (such as user log-ins, language preferences, or maintaining secure edit state), and guarantee stable navigation.
+* '''Data Collected:''' Username, email address, password hash (for direct accounts), SSO authentication tokens/identifiers, account preferences, and registration timestamps.
-* '''No Consent Required:''' Under Swiss FADP and EU ePrivacy rules, functional cookies that are technically essential to deliver a requested service do not require user consent. They do not track or profile you across other websites.
+* '''Purpose & Legal Basis:''' Under Swiss revFADP (Art. 31(2)(a)) and GDPR (Art. 6(1)(b)), processing account data is necessary for the '''performance of a contract / service provision''' to authenticate your identity, provide account access, manage user permissions, and enable collaborative editing.
-=== B. Web Analytics (Matomo – Opt-In Only) ===
+=== B. User Contributions, Edits, and Published Content ===
-To understand how visitors use our wiki and to improve our repository, this website uses '''Matomo''', an open-source web analytics platform.
+When you create, edit, or comment on wiki pages, upload files, or participate in discussions on the OpenVerse Wiki, your contributions are recorded by the platform.
-* '''Explicit Opt-In:''' Analytics are enabled '''only if you give your explicit, active consent''' via our cookie banner. If you ignore or decline the banner, no analytics scripts are loaded, and no analytics cookies are set.
+* '''Data Collected:''' Wiki text edits, uploaded files, revision histories, talk page posts, edit summaries, and associated timestamps.
-* '''Our Safe Matomo Setup:'''
+* '''Public Attribution:''' In accordance with standard MediaWiki functionality and open repository standards, '''your contributions and edits are publicly displayed and permanently linked to your username''' in the revision history of the relevant wiki pages.
-** '''Self-Hosted:''' It runs on cloud infrastructure operated directly by Martel GmbH. No data is sent to external Matomo servers.
+* '''Purpose & Legal Basis:''' Processing is necessary for '''service provision''' (Art. 6(1)(b) GDPR) and justified by our '''legitimate interests''' (Art. 6(1)(f) GDPR / FADP Art. 31(1)) in operating an open, transparent, and attribution-grounded repository for research and innovation.
-** '''Anonymised at Source:''' We configure Matomo to automatically mask visitors' IP addresses (by truncating the last bytes), ensuring that your raw IP address is never stored or associated with your wiki usage.
-** '''No Third-Party Sharing:''' Your statistics are first-party only and are never transmitted to, shared with, or sold to any third party.
-* '''Cookies Set:''' If you consent, Matomo sets performance cookies (such as <code>_pk_id</code> and <code>_pk_ses</code>) in your browser.
-=== C. Essential Cybersecurity & Technical Logs ===
+=== C. Strictly Necessary Session & Authentication Cookies ===
-When you access this wiki, our secure hosting infrastructure automatically logs standard technical connection data. This is done solely to guarantee the stability, functionality, and cyber-resilience of the platform.
+This website uses strictly necessary cookies native to the MediaWiki platform.
+* '''Purpose:''' These cookies maintain your logged-in state (e.g., <code>wikiUserID</code>, <code>wikiUserName</code>, <code>wikiToken</code>), manage session security, save language preferences, and enable secure editing.
+* '''No Consent Required:''' Under Swiss FADP and EU ePrivacy rules, functional session cookies that are technically essential to deliver a requested service do not require user consent.
+=== D. Essential Cybersecurity & Technical Connection Logs ===
+When you access or log in to the wiki, our server infrastructure automatically logs standard technical connection data.
 * '''Data Logged:''' IP address, date and time of request, requested URL, HTTP status code, volume of data transferred, referrer URL, and browser User-Agent string.
-* '''Purpose & Legal Basis:''' Under Swiss revFADP (Art. 31(1)-(2)) and GDPR (Art. 6(1)(f)), processing this technical connection data is justified by our '''overriding legitimate interests''' to block cyber-threats (such as DDoS attacks or malicious bots) and maintain system security.
+* '''Purpose & Legal Basis:''' Under Swiss revFADP (Art. 31(1)-(2)) and GDPR (Art. 6(1)(f)), logging technical connection data is justified by our '''overriding legitimate interests''' to defend against cyber-attacks, prevent spam/vandalism, and ensure system resilience.
+=== E. Web Analytics (Matomo – Opt-In Only) ===
+To understand how visitors use our wiki and improve platform navigation, we use an opt-in, self-hosted '''Matomo''' analytics instance.
+* '''Explicit Opt-In:''' Analytics scripts are loaded and cookies (<code>_pk_id</code>, <code>_pk_ses</code>) are set '''only if you give explicit consent''' via our cookie banner.
+* '''Privacy Controls:''' Matomo runs on Martel's EU cloud servers, IP addresses are anonymised at source, and no analytics data is shared with third parties.
 ----
-== 3. Cloud Providers and Data Processors ==
+== 3. Cloud Infrastructure, Processors & SSO Transfers ==
-We partner with reliable cloud and security providers to deliver this website securely. These entities process data strictly on our behalf under formal Data Processing Agreements (DPAs):
-# '''Hosting Infrastructure – AWS Sovereign Cloud (Germany / European Union):''' The wiki database, files, and server security logs are hosted on physical AWS servers located within the '''European Union (EU)''', ensuring robust data sovereignty and isolation.
-# '''Web Security & Delivery – Cloudflare (United States / Global):''' Website traffic is routed through Cloudflare to inspect technical connection metadata (including IP addresses) to detect and block malicious requests. Cloudflare acts under strict DPAs and EU/Swiss Standard Contractual Clauses (SCCs) to safeguard global web-routing metadata.
-----
-== 4. Cross-Border Data Transfers ==
+We partner with trusted service providers under formal Data Processing Agreements (DPAs):
-* '''Primary Storage:''' All wiki content, database records, and server logs remain stored on secure AWS servers in the '''European Union (EU)'''.
+# '''OpenVerse Observatory SSO (Trust-IT Services):''' When you log in via OpenVerse Observatory SSO, authentication credentials are exchanged between Trust-IT Services (Italy) and Martel GmbH (Switzerland) solely to authenticate your account.
-* '''Global Security Processing:''' Security metadata processed by Cloudflare may be routed through global data centers to optimize delivery. Any transfer of connection metadata to third countries (such as the United States) is covered under standard safeguards:
+# '''AWS Sovereign Cloud (Germany / European Union):''' All wiki databases, user account records, page histories, and server security logs are stored on physical AWS servers within the European Union (EU).
-** '''EU/Swiss Standard Contractual Clauses (SCCs)''' integrated into our agreements.
+# '''Cloudflare (United States / Global):''' Web traffic is routed through Cloudflare to protect against malicious traffic and DDoS attacks, protected under EU/Swiss Standard Contractual Clauses (SCCs).
-** The '''Swiss-U.S. Data Privacy Framework''' and the '''EU-U.S. Data Privacy Framework''' where certified.
-* '''Adequacy Status:''' Switzerland is formally recognized by the European Commission as providing an adequate level of data protection (Article 45 GDPR). Similarly, Switzerland recognizes the EU/EEA countries as guaranteeing adequate protection (Annex 1 of the Swiss Data Protection Ordinance - DPO).
 ----
-== 5. Data Retention and Consent Withdrawal ==
+== 4. Data Retention and Erasure ==
-* '''Withdrawing Consent:''' You can withdraw your consent for Matomo analytics at any time by clearing this website’s cookies and site data in your web browser settings. Upon your next page load, the cookie banner will reappear, allowing you to re-adjust your choice.
+* '''Account Data:''' Account profile data is retained as long as your account remains active. You can delete your account at any time.
-* '''Retention of Security Logs:''' Standard technical connection and security logs are automatically deleted and purged within '''14 to 30 days''', unless an active cyber-incident is detected and requires longer-term investigation.
+* '''Wiki Edits & Public Contributions:''' To maintain the historical integrity, attribution, and open-license lineage of collaborative wiki content, public page edits, upload histories, and revision records are '''permanently retained''' in the wiki's public version history associated with your username.
-* '''Session Cookies:''' Strictly necessary cookies are purged from your device as soon as you close your browser session.
+* '''Security Logs:''' Standard technical connection logs are automatically purged within '''14 to 30 days''', unless required for active cyber-threat investigation.
+* '''Session Cookies:''' Purged from your device when you log out or close your browser session.
 ----
-== 6. Your Statutory Rights ==
+== 5. Your Statutory Rights ==
-Under the Swiss revFADP and, where applicable, the GDPR, you have the following rights regarding your personal data:
-* '''Right of Access (Art. 25 FADP / Art. 15 GDPR):''' Request confirmation of data processing and receive a free copy of your personal data.
-* '''Right to Rectification (Art. 32 FADP / Art. 16 GDPR):''' Request correction of inaccurate or incomplete personal data.
-* '''Right to Erasure (Art. 32 FADP / Art. 17 GDPR):''' Obtain the deletion of your personal data, subject to legal or contractual retention obligations.
-* '''Right to Restriction of Processing (Art. 41 FADP / Art. 18 GDPR):''' Request that data processing be restricted.
-* '''Right to Object (Art. 32 FADP / Art. 21 GDPR):''' Object to processing activities based on our legitimate interests (such as cybersecurity logging).
-* '''Right to Data Portability (Art. 28 FADP / Art. 20 GDPR):''' Request your data in a structured, electronic format.
-* '''Right to Mark Data as Disputed (Art. 32(3) FADP - Switzerland):''' Request that contested data be formally marked as disputed in our systems.
-To exercise these rights, please contact us directly at '''info@martel-innovate.com'''.
+Under the Swiss revFADP and GDPR, you have statutory rights regarding your personal data:
+* '''Right of Access (Art. 25 FADP / Art. 15 GDPR):''' Request confirmation and a copy of your personal data.
+* '''Right to Rectification (Art. 32 FADP / Art. 16 GDPR):''' Request correction of inaccurate personal details.
+* '''Right to Erasure (Art. 32 FADP / Art. 17 GDPR):''' Request deletion of personal data, subject to legal obligations and public wiki edit attribution requirements.
+* '''Right to Restriction & Object (Art. 32 FADP / Art. 18 & 21 GDPR):''' Restrict or object to processing based on legitimate interests.
+* '''Right to Data Portability (Art. 28 FADP / Art. 20 GDPR):''' Request your personal data in a structured format.
-=== Right to Lodge a Complaint ===
+To exercise these rights, contact us directly at '''info@martel-innovate.com'''.
-If you believe our processing violates data protection laws, you may lodge a complaint with:
-* '''In Switzerland:''' The Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, Switzerland ([https://www.edoeb.admin.ch www.edoeb.admin.ch]).
-* '''In the EU/EEA:''' Your local national Data Protection Authority (DPA) in the country of your residence or work.
-Note: this privacy policy has been prepared with the assistance of a generative AI tool, with human instructions, drafting and review.
+=== Supervisory Authority Complaints ===
+* '''In Switzerland:''' Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern ([https://www.edoeb.admin.ch www.edoeb.admin.ch]).
+* '''In the EU/EEA:''' Your local national Data Protection Authority (DPA).