Privacy Policy

The controller responsible for the processing of personal data on this website (opening.science and all associated subdomains) within the meaning of the Swiss Federal Act on Data Protection (FADP / nDSG) and, where applicable, of Regulation (EU) 2016/679 (GDPR) is:

Open Science Stiftung (Open Science Foundation)
Obere Bönigstrasse 100
3800 Matten bei Interlaken
Switzerland

Contact for data-protection matters: office@opening.science

The Foundation has not appointed a Data Protection Officer. The criteria for a mandatory appointment under Article 37 GDPR are not met: we do not carry out large-scale processing of special categories of personal data, nor regular and systematic monitoring of data subjects on a large scale. Under Swiss law, appointing a data protection advisor (Article 10 FADP) is optional for private controllers, and the Foundation has chosen not to do so at this stage. The address above handles all data-protection inquiries.

EU representative under Article 27 GDPR

The Foundation is established in Switzerland and processes personal data of data subjects in the European Union only on an occasional basis, without large-scale processing of special categories of data and without systematic monitoring. On this basis, the exception of Article 27(2)(a) GDPR applies and no EU representative has been appointed. Should circumstances change, this section will be updated accordingly.

This Privacy Policy explains which personal data we collect when you visit our website, on what legal basis we process it, how long we retain it, with whom we share it, and what rights you have. It applies to all users of opening.science, regardless of location.

We process personal data in accordance with the principles of lawfulness, good faith, proportionality, purpose limitation, data minimisation, accuracy, integrity, confidentiality, and transparency. We do not sell personal data, and we use it only for the purposes described in this Policy.

4.1 Server log files

When you access this website, our hosting provider automatically processes the following technical data:

• IP address (in some cases shortened/anonymised)
• Date and time of the request
• Content of the request (specific page accessed)
• Access status / HTTP status code
• Volume of data transmitted
• Referrer URL
• Browser type, browser version, and operating system

Purpose: ensuring the technical operation, security, and stability of the website; detecting and preventing abuse and attacks; troubleshooting.

Legal basis: FADP Art. 6 and 31(2)(c) — overriding legitimate interest in the secure operation of the website; GDPR Art. 6(1)(f) — legitimate interest in providing a functional and secure online presence.

Retention: server log files are typically retained for a maximum of 30 days, unless retention for a longer period is necessary for the investigation of a security incident.

4.2 Contact via email

When you contact us at any published address, we process the personal data you voluntarily provide (typically name, email address, and the content of your message).

Purpose: answering your inquiry, conducting any resulting correspondence, and where applicable preparing or performing a contract.

Legal basis: FADP Art. 6 and 31(2)(a) and (c); GDPR Art. 6(1)(b) (where the inquiry concerns a contractual or pre-contractual matter), Art. 6(1)(a) (consent), and/or Art. 6(1)(f) (legitimate interest in responding to inquiries).

Retention: as long as necessary to handle the inquiry and any follow-up, and thereafter for the duration of applicable statutory retention obligations (typically up to ten years under Swiss law for business correspondence).

4.3 Newsletter

The Foundation operates a newsletter. Subscription is voluntary and uses double opt-in: after you submit your address we send you a confirmation email, and you are added to the list only once you confirm. The data you provide, your email address, is processed solely in order to send you the newsletter.

Service: we use Keila, open-source newsletter software, which we run ourselves on servers rented from Hetzner Online GmbH, Germany; the subscriber list is kept there. The confirmation email and the newsletter issues themselves are delivered through Resend, Inc., United States, an email delivery service acting as our processor: Resend receives your email address and the content of each message for delivery and keeps delivery logs for a limited period for diagnostics. Your address is not passed to any other party.

Unsubscribe: at any time, using the link in every newsletter or by writing to office@opening.science.

Legal basis: your consent. Switzerland: FADP Art. 6(6) and (7). EU: GDPR Art. 6(1)(a).

Retention: until you withdraw your consent. A record of your confirmation is kept as evidence of consent for as long as necessary to demonstrate compliance.

4.4 Analytics

This website uses Matomo, open-source analytics software. Matomo is loaded only after you accept optional cookies in the cookie banner. If you do not accept, or if you reject, no analytics script is loaded and no analytics data is collected.

Purpose: understanding how this website is used so that we can improve it, and compiling aggregate usage statistics.

Data categories: IP address, masked at collection (the last two bytes are removed before anything is stored); pages viewed and their titles; the referring page; device, browser, and screen information; approximate location at country level, derived from the masked address; and interactions on this site such as clicks on contact links, newsletter sign-ups, downloads, and outbound links.

Service: Matomo, open-source analytics software, which we run ourselves on servers rented from Hetzner Online GmbH, Germany. No analytics data leaves our own infrastructure, and no other party receives it.

Retention: raw visit data 13 months; aggregated statistics, which contain no personal data, are kept for as long as the website exists; server backups 30 days.

Legal basis: your consent. Switzerland: FADP Art. 6(6) and (7). EU: GDPR Art. 6(1)(a).

Withdrawing consent: you may withdraw your consent at any time via the "Cookie settings" control in the footer of this website, choosing Reject. Withdrawal stops any further collection. It does not affect the lawfulness of processing carried out before you withdrew.

4.5 Embedded third-party content

This website embeds no third-party content. Fonts, images, videos, and scripts are served from our own domain. There are no third-party iframes, video players, widgets, web fonts, comment systems, social media buttons, or advertising.

Some pages link out to third-party sites, for example code repositories on GitHub, partner websites, and publication records. These are ordinary links. Nothing is sent to those providers unless you follow the link, at which point that site's own privacy policy applies. The Foundation publishes code on GitHub, but this website is not hosted there.

The only third party that receives technical data when you use this website is our hosting provider (section 6.1). Analytics data, collected only if you accept optional cookies, stays on our own servers (section 4.4).

We distinguish between:

• Strictly necessary cookies — required for basic functioning of the website (e.g. session, security, load balancing). These are set on the basis of GDPR Art. 6(1)(f) / FADP Art. 31(2)(c) and do not require consent.
• Optional cookies (e.g. analytics, marketing, embedded media) — set only on the basis of your explicit and revocable consent (GDPR Art. 6(1)(a) / FADP Art. 6(6)).

You can manage your consent at any time via the "Cookie settings" control in the footer of this website, which reopens the cookie banner, and you can configure your browser to block or delete cookies. Disabling strictly necessary cookies may impair functionality.

In use on this website: your consent choice, stored in your browser's local storage under cookie-consent (kept until you change it); and, only after acceptance, the Matomo cookies _pk_id (visitor identifier, 13 months), _pk_ses (session, 30 minutes), and _pk_ref (referring page, 6 months). If you withdraw consent after an earlier acceptance, Matomo sets an opt-out cookie so that it stays off. If your browser sends a Do Not Track or Global Privacy Control signal, analytics does not run at all.

6.1 Categories of recipients

We share personal data only with carefully selected recipients and only to the extent necessary for the purposes described:

• Netlify, Inc., our website hosting and content-delivery provider. Technical access data necessarily passes through their infrastructure (section 4.1).
• Hetzner Online GmbH, Germany, from whom we rent the servers on which we run our own newsletter software (section 4.3) and our own analytics software (section 4.4).
• Resend, Inc., United States, the email delivery service through which newsletter confirmations and issues are sent (section 4.3).
• Other IT service providers assisting with website maintenance, email, and security, each under appropriate contractual safeguards.
• Auditor, legal counsel, and tax advisors, where required to comply with statutory obligations.
• Public authorities and courts, where legally obliged to disclose data.

A data-processing agreement within the meaning of FADP Art. 9 and GDPR Art. 28 is in place with each of these processors. A current list of sub-processors can be requested at office@opening.science.

6.2 Transfers to third countries

Of the recipients named in section 6.1, Hetzner Online GmbH is established in Germany; Netlify, Inc. and Resend, Inc. are established in the United States. Analytics data is processed on the servers rented from Hetzner in Germany and is not transferred abroad; newsletter delivery through Resend involves a transfer of your email address to the United States on the basis described below.

Where personal data is transferred to a country outside Switzerland or the EU/EEA:

• Transfers occur only on the basis of an adequacy decision (e.g. the FDPIC's list of countries with adequate data protection; the EU adequacy decisions; the Swiss–US Data Privacy Framework, in force since 15 September 2024; the EU–US Data Privacy Framework, in force since 10 July 2023, where the recipient is certified), or
• on the basis of appropriate safeguards within the meaning of Article 16 FADP and Articles 46 et seq. GDPR (in particular EU Standard Contractual Clauses with the FDPIC's Swiss addendum), or
• on the basis of an applicable derogation (Article 17 FADP, Article 49 GDPR).

Information on the safeguards in place can be obtained at office@opening.science.

We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, in line with FADP Art. 8 and GDPR Art. 32. These measures include encrypted transport (TLS/HTTPS), access controls, logging, regular review of safeguards, and contractual obligations imposed on processors.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Retention periods relevant to specific processing operations are set out in section 4. Once the relevant period expires, data is deleted or irreversibly anonymised, save where retention is required by overriding legal obligations (e.g. accounting and bookkeeping records under Articles 957–958f of the Swiss Code of Obligations).

Subject to the conditions and limitations set out in applicable law, you have the following rights with respect to your personal data:

• Right to information / access (Article 25 FADP, Article 15 GDPR)
• Right to rectification (Article 32 (1) FADP, Article 16 GDPR)
• Right to erasure / "right to be forgotten" (Article 32 (2) FADP, Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 28 FADP, Article 20 GDPR)
• Right to object to processing based on legitimate interests (Article 30 FADP, Article 21 GDPR)
• Right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal (Article 6 (6) FADP, Article 7 (3) GDPR)
• Right not to be subject to solely automated decisions producing legal or similarly significant effects (Article 21 FADP, Article 22 GDPR). The Foundation does not currently engage in such automated decision-making.

To exercise any of these rights, please write to office@opening.science. We may need to verify your identity before responding. We will reply within the timeframes set by applicable law (typically within 30 days under FADP and within one month under GDPR, extendable where justified).

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a competent data-protection supervisory authority. In particular:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern — www.edoeb.admin.ch
• European Union / EEA: the supervisory authority of your habitual residence, place of work, or place of the alleged infringement

This website is not directed at children. We do not knowingly collect personal data from persons under the age of 16 (under FADP and most EU laws). If you believe we have inadvertently collected such data, please contact office@opening.science so we can delete it.

The Foundation does not use automated decision-making (including profiling within the meaning of Article 22 GDPR) that produces legal or similarly significant effects on data subjects on this website.

We may amend this Privacy Policy from time to time to reflect changes in our processing activities or in the legal framework. The current version is always accessible at this URL with its effective date.

For any question regarding this Policy or the processing of your personal data, please contact:

Open Science Stiftung — Data Protection Obere Bönigstrasse 100, 3800 Matten bei Interlaken, Switzerland Email: office@opening.science