Data Protection

PolPaL operates in accordance with the EU General Data Protection Regulation and all other statutory data protection provisions.

The protection of your personal rights when handling your data is important to us. With the following information, we would like to inform you which data are processed during your visit to our website, on the basis of which legal basis the data processing takes place and what your data protection rights are.

PolPaL reserves the right to update this privacy policy from time to time. Therefore, we recommend that it be read at regular intervals.

Contact Data

The controller within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR) is:

For further information, see the details on our Imprint page.

Data Protection Officer

If you have any questions about data protection, please contact our data protection officer:

Usage Data

For the purposes of protecting our services against abuse and automated attacks, PolPaL's application processes pseudonymised IP addresses on the basis of Article 6 paragraph 1 letter f of the General Data Protection Regulation (GDPR). The legitimate interest pursued is the security and availability of the platform.

IP addresses are pseudonymised using a one-way cryptographic function (HMAC-SHA256) before being stored by the application. They are used solely for rate limiting (e.g. limiting repeated login or registration attempts from a single source) and security event monitoring. Raw IP addresses are never persisted by the application. No personal user profiles are created.

Access logs at the infrastructure level — including IP addresses, User Agent strings, and URLs — are processed by Clever Cloud as PolPaL's hosting provider. This is described in the Clever Cloud as Data Processor section below.

User Account Data

For registered users, we store the following information:

• first name
• last name
• email address
• username
• user ID
• password (securely hashed using bcrypt with salt, never stored in plain text)
• account role
• email verification status
• admin approval status
• timestamps for account creation and last update

Additionally, we log data-altering actions performed by the user (e.g. creating or editing records) in a changelog, linked to the user account. The legal basis for this processing is Article 6 paragraph 1 letter b GDPR (performance of the contract for use of the service). We do not log changes to user account data itself (e.g. password changes, email changes) in the changelog.

The stored email address may be used to contact the user regarding their account — for example, to send email verification links, password reset instructions, or notifications related to the administration of their account (e.g. approval by an administrator).

Registered users can request deletion of their account by contacting us. We will delete all associated data as soon as technically possible. Due to our backup infrastructure, it may take up to 7 days until user data is removed from all parts of our technical infrastructure.

Registration and use of PolPaL is permitted only for persons who are at least 18 years of age. By registering, you confirm that you meet this requirement.

Contact Options

You have the opportunity to contact us by electronic mail. The data you provide will only be used to answer your enquiry. Your data will only be passed on to third parties if this is necessary to process your request. The legal basis for the use of your data is Article 6 paragraph 1 letter f of the GDPR. We have a legitimate interest in being in contact with the users of the website and in answering any questions you may have or sending information.

Transactional Email Communications

Automated emails sent by PolPaL — such as verification links, password reset instructions, and account notifications — are delivered via the email infrastructure provided by IONOS SE. Their servers operate exclusively within the European Union. A Data Processing Agreement (DPA) has been concluded with this provider to ensure compliance with applicable data protection regulations. All transmissions between our application and the mail server are encrypted using TLS/SSL.

Duration of Data Storage

We only store your data for as long as is necessary for the provision of our services and there are no retention periods to prevent deletion.

Data Protection Rights of Users of this Website

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — you may request information about which personal data we hold about you and for what purpose.
• Right to rectification (Art. 16 GDPR) — you may have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17 GDPR) — you may request deletion of your data where its storage is no longer lawful or necessary.
• Right to restriction of processing (Art. 18 GDPR) — you may request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20 GDPR) — you may receive your data in a structured, commonly used format where processing is based on a contract or consent and carried out by automated means.
• Right to object (Art. 21 GDPR) — where we process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you have the right to object at any time. We will then cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, please contact our Data Controller (see contact details above).

You also have the right to lodge a complaint with a competent supervisory authority. The responsible authority for GESIS in Germany is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Nordrhein-Westfalen (LDI NRW). A list of all EU supervisory authorities is available at edpb.europa.eu.

Cookies are small text files placed on your device by your web browser when you visit a website. PolPaL uses a single strictly necessary cookie for authentication purposes only. We do not use cookies for tracking, analytics, or advertising, and we do not share any cookie data with third parties.

This cookie is strictly necessary for the operation of the website and does not require your consent. The legal basis for processing the data contained in this cookie is Article 6 paragraph 1 letter b GDPR (performance of the contract for use of the service).

Liability for Links

This website contains links to external third-party websites over whose content we have no control. We therefore accept no liability for the content of those pages. The respective provider or operator of each linked page is solely responsible for its content. Linked pages were checked for potential legal violations at the time of linking; no unlawful content was apparent at that time. Permanent monitoring of linked pages is not reasonable without concrete evidence of a legal violation. If we become aware of any legal violations, we will remove the relevant links without delay.

Liability for Own Content

The content on this website has been created with care. However, we cannot guarantee that the information provided is accurate, complete, or up to date. As a service provider, we are responsible for our own content on this website in accordance with general law. We are not obliged to monitor transmitted or stored third-party information or to investigate circumstances that point to illegal activity.