1 Introduction

In accordance with Articles 12, 13 and 14 of the EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter the “GDPR”), this information notice explains how the University of Luxembourg (hereafter university) through the Melusina Press Scholarly Publishing and Communication platform (hereafter Melusina; or, the website) collect, process and protect Personal Data in relation with your use of the platform and related services (hereafter: the “Notice”).

In principle, Melusina can be visited and publications can be read without additional processing of personal data. An exception to this is the IP-address, which we store for all visitors for a period of 3 months for security reasons. However, for the use of more sophisticated services such as the contribution to or the provision of publications and the annotations tools among others, registration is required and personal data will be processed during and after the registration process.

In order to protect your personal data we have taken technical and organizational steps, which will likewise be described in this notice.

2 Who are we?

The University of Luxembourg is a public higher education and research establishment, operating under the supervision of the Ministry for higher education. The Melusina Press Scholarly Publishing and Communication platform is a service for the publication and interaction with online research publications from the Faculty of Language and Literature, Humanities, Arts and Education of the University of Luxembourg.

The University of Luxembourg, acting as promoter of the service, is controller, with regard to the processing of personal data.

The University of Luxembourg has its official address at:

MAISON DU SAVOIR
2, avenue de l’Université
L-4365 Esch-sur-Alzette
Phone number: (+352) 46 66 44 1
Internet address: https://wwwen.uni.lu/university

The University has appointed a DPO: reachable during working hours at dpo@uni.lu. Further information is provided on https://wwwen.uni.lu/university/data_protection.

3 What personal data do we proceed?

Any natural person providing personal data during the visit of the Melusina website, the registration procedure or the use of tools provided by the website is a data subject.

3.1 Registering as a User

You have the opportunity to register on our website by providing personal information. This information include your:

surname
forename
e-mail address
an image that you can use as an avatar associated with your account (optional)

The personal data you enter will be collected and stored for the purposes stated in point 5. In addition, it will be used in order to provide provenance information for publications, comments, and other resources you create or link to while using the platform.

This use of your personal data aim to support consistent and transparent scientific discourse for which knowledge of the source of a contribution is a crucial element.

By registering on our website, the IP-address assigned by your Internet Service Provider (ISP), the date and time of registration are also stored. The storage of this data takes place against the background that only so the misuse of our services can be prevented. In this respect, the storage of this data is required for our protection.

Your registration also serves us to offer you content or services, which, due to the nature of the matter, can only be offered to registered users. As a registered user you are free to change the personal data you gave during registration at any time or to have them deleted completely from our database if not mentioned otherwise.

3.2 Annotating, Highlighting, Commenting (Registered User)

Any registered user regardless of his/her user role can highlight or annotate phrases in publications as well as comment on the publication as a whole or on its resources (images, video etc.). You can create annotations and highlights for yourself, within a readers group (a group of connected user accounts) or for public communication. Depending on the situation or the choice you make annotations and highlights are therefor visible only to you, to you and other members of the group or to everyone who reads the publication that you have annotated.

In addition to the content of the comment, annotation or highlights (hereafter just 'annotations'), the website will also include information on when the comment was created, the credentials you have entered at registration (forename and surname) and, if applicable, the name of the reading group in which you made the annotation. If this information will be visible to a broader public or only to you depends on the visibility, you have chosen when creating the annotation, highlight or commenting tools (hereafter 'annotation tools').

Our annotation tools store your IP-address while you annotate. Since we do not check comments on our site before activation, we need this data in order to be able to act in case of violations such as insults against the author.

The annotations and related data (i.e. IP-address, group membership) are stored and remain on our website until the commented content has been completely deleted or the comments must be deleted for legal reasons (e.g., offensive comments).

3.3 Editing, Marketing, Publishing (Registered User)

We provide a service that should not only help to engage with publications but also to support parts of the publishing process (review, changes, editing, etc.). There are different stakeholders involved in the publishing process, which is why users may have different user roles. A user role is associated with different rights to perform certain actions on publishing projects in Melusina. Different user roles (user, marketeer, editor, project creator) are granted by the administrator of the website.

For each user account we store information about the user role the user holds. We furthermore collect and store information about each action you perform on a publication project (upload of a new version, addition of a new multi-media resource, etc.). Information that is collected include:

the type of action that was carried out
the date and time the action was carried out
the user who carried out the action

This information is stored in our database and shown publicly on the publication's main website. We keep and publish this information in order to ensure integrity and accountability of scholarly publications published by Manifold and thereby adhere to academic standards.

In case, you do not want that information of a specific action is visible publicly you may send an e-mail to the operator and request to hide it on the website.

3.4 Following (Registered User)

As a registered user, you have the possibility to track and to be notified about changes in publications of your interest. For this to happen you need to click the following button shown on the website of a peculiar publication.

We will store which publications you follow, in order to know in which event we have to send notifications. Notifications are sent by e-mail or to the notification area of your account, depending on the notification choices you have made in the user settings area. For e-mail notification, we use the e-mail address that you provided during registration.

3.5 Contact Form

When contacting us (for example via contact form or e-mail), personal data is collected. In addition to the data in the message itself, the following personal data is processed:

forename
surname
e-mail address

These data are stored and used solely for the purpose of answering your request or for establishing contact and the associated technical administration. Your data will be deleted after final processing of your request, this is the case if it can be inferred from the circumstances that the matter in question is finally clarified and provided that no statutory storage requirements are in conflict.

3.6 Sharing (optional)

3.6.1 Twitter

We offer so-called share-buttons for Twitter to facilitate easy citation and quotation of publications offered by Melusina. Twitter is a social media platform that allows to create small messages that can be read by other Twitter users and the broader public. It is a communication platform. Other Twitter users may respond to your message or repost it in their Twitter accounts.

The use of Twitter as an optional service is in the interest of the site's main purpose to support the publishing process of multimodal research communications. You are free to disseminate or not on Twitter.

Twitters operating company is Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (“Twitter”)

Each time you visit any of the pages on this site operated by us and which includes a share-button, you will be able to connect to Twitter and to share information about the page you have visited or the fragment of the publication you are engaging with. No information is sent to the Twitter service before you click on the share-button. When you click on it, a new browser window will open and you will leave the website of Melusina. The window downloads a page from the Twitter service. Each time you use a share-button Twitter will know which Melusina subpage you visited when you clicked on it, which fragment of the publication you wanted to share as well as the time of sharing.

If you are logged in into your own Twitter at the same time, Twitter recognizes, by using the share-button which specific subpage of our website you visit. This information is collected by Twitter and associated with your Twitter account.

Authors of Melusina publications may decide to curate a Twitter account as part of their publishing activity and to include messages from this Twitter feed into the publication’s activity feed in Melusina. These messages are clickable and on click refer you to the message on the Twitter website. If you decide to follow these links, Twitter will know on which subpage of Melusina you followed the link.

Twitter's privacy policy, available at https://twitter.com/en/privacy, identifies the collection, processing, and use of personally identifiable information by Twitter.

3.7 Embedded Components

3.7.1 YouTube

We have included YouTube components on this site. These components may appear in a publication or on its own resource site. YouTube is an internet video portal that allows video publishers to freely watch video clips and other users for free viewing, rating and commenting. YouTube allows the publication of all types of videos, so that both complete film and television broadcasts, but also music videos, trailers or user-made videos via the Internet portal are available.

YouTube's operating company is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA.

Each time you visit any of the pages on this site operated by us and which includes a YouTube component (YouTube video), the component will automatically cause the browser to download the video file on your IT-System so that it can be shown in the browser. More information about YouTube can be found at https://www.youtube.com/yt/about/en/. As part of this technical process, YouTube and Google are aware of the specific subpage of our site that you visited as well as the browsers metadata (type of browser, version, etc.).

If you are logged in into YouTube at the same time, YouTube recognizes, by visiting a subpage that contains a YouTube video, which specific subpage of our website you are on. This information is collected by YouTube and Google and associated with your YouTube account.

YouTube and Google will always receive information through the YouTube component that is requested by our website and presented to you in the browser, if you are simultaneously logged into YouTube at the time of access to our website; this happens regardless of whether you click on a YouTube video or not. If you do not want to provide this information to YouTube and Google, you can prevent it from logging out of your YouTube account before you visit our website.

YouTube's privacy policy, available at https://www.google.com/intl/en/policies/privacy/, identifies the collection, processing, and use of personally identifiable information by YouTube and Google.

4 How do we collect personal data?

Information you give us

Your personal data will be collected on the Website offered by the University of Luxembourg and hosted by Digital Ocean during your registration on the platform.

Information provided by your internet connection

Your IP-address will be temporally stored in our server logs for security reasons for 3 months

Information provided by your interaction with the website

Data on certain actions such as annotating publications (see sec 3.2), uploading publications, following publications will be collected on our website.

5 What is the purpose of processing?

The purpose of the processing of personal data is:

the publication of multimodal, scholarly online publications
the support of the publication process with related tasks such as peer review and editing
the support of scholarly communication on publications

6 On which legal basis do we proceed your data?

The legal basis for the processing is laid down in:

Article 6(1) (a) of the GDPR: the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

The University through Melusina will process your personal data based on your consent informed through the Notice as the processing of your personal data is necessary for the purposes described in article 5 of the Notice.

Your use of the service is on a voluntary basis and you can withdraw your consent at any time by sending an email to melusina.press@uni.lu.

Article 6(1) (f) of the GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party

The University has a legitimate interest to process bibliographic information and information about the provenance of scholarly content (monographs, articles, annotations) such as your role as an author, the date of publication among others. This metadata will not be deleted in the case of deletion of your account. This is necessary in order to adhere to norms of academic discourse and to assure scientific accountability and integrity of scholarly content on the website.

Article 9 (2) a of the GDPR: the Data Subject has given explicit consent to the Processing of those Personal Data for one or more specified purposes, authorized by Union and Luxemburgish law:

This ground must be used only exceptionally and on a case by case basis. The University does not intend to process special categories of personal data on Melusina platform and strongly recommend you to pay attention to which information you mention in your annotations. The University considers you gave your explicit consent to the processing of special categories of data in the annotations if you mention special categories of personal data such as political opinion for example.

7 Technical Environment

7.1 SSL-Encryption

This website uses SSL-encryption in order to provide secure processing of data and transmission of confidential content such login data or contact messages. You make sure that the connection with the website is SSL-encrypted by looking at address-bar of your browser. Encrypted connections begin with 'https://' instead of 'http://'. If SSL-encryption is activated, processed data cannot be read by third-parties.

7.2 Server

The website is hosted in Frankfurt, Germany. The company that provides the hosting technology is Digital Ocean LLC, 101 Avenue of the Americas, 10th Floor, New York, NY, 10013, United States. This means that data that is processed while using the website is also processed on the servers of Digital Ocean. The physical location of the server is Frankfurt, Germany. The data processing agreement between Digital Ocean and the University of Luxemburg is accessible under:

https://www.digitalocean.com/legal/data-processing-agreement/

7.3 Software

Melusina is driven by the Manifold software. The software is an open source project initiated and maintained by the University of Minnesota Press, the Graduate Center at the City University of New York, and Cast Iron Coding. It was initially funded by the Andrew W. Mellon Foundation. The Manifold software provides frequent updates of feature and bug fixes at an undefined time rate. For critical security updates, Melusina will update its installation of the Manifold software at the most immediate moment possible. Features and bug fix updates of the Melusina installation of Manifold will normally take place within one month. An exception to this update policy makes the case where non-backwards compatible changes are introduced. In this case, the time for an update will depend on the effort changes in the Melusina configuration will require in order to maintain the integrity of the website after the update.

7.4 Backup

In order to prevent the loss of your personal data Melusina creates a weekly backup of the website and associated data. Each backup is stored on the servers of Digital Ocean (see section above) for a period of 3 months regardless of the deletion policies of other data categories. The collection and storage of this data is crucial in order to protect our services and to stay operational in the unlikely case of technological issues of the website.

7.5 Cookies

We use cookies when you login in into the website. Cookies are small files which are produced by your browser automatically after login and which are stored on your IT-System (Laptop, Tablet, Smartphone etc.). Cookies do not harm your IT-System. They do not include viruses, trojans or other harmful software. Cookies are used to store information on your IT-system. This, however, does not mean that we obtain immediate knowledge about your identity.

The reason why we use cookies is to be able to provide you with the services described in section 5. More precisely, it assures to relate your use of the service with your user account. This means, for instance, that annotations you make on certain publications are associated with your account while you are logged in and thereby can be hidden from other users in case you made them personal annotations.

We only store one information in one cookie, which holds a session id for the time you are logged in into the website (session cookie). A session id is a randomly generated sequence of characters that holds no personal information.

Most browsers accept cookies automatically. However, it is possible to configure your browser in a way that no cookies are stored on your IT-system or that you receive a warning before a cookie is stored. You can also completely deactivate cookies. Complete deactivation could mean that you are no longer able to use certain functionality of the website.

8 Who are the recipients of your personal data?

Your personal data will be accessible for staff members of the University of Luxembourg involved into the Melusina project in order to maintain, secure and realize its services.

Bibliographic information and information about the provenance of scholarly content (monographs, articles, annotations) such as your role as an author, the date of publication among others will be publicly accessible in order to ensure scientific accountability.

A limited and selected group of people from the Digital Ocean security staff has access to the hypervisors that provide the virtual servers for our hosting and to the NAS/SAN where backups are stored. This does not mean that they have direct access to our server, the software behind Melusina or the database in which we store your data.

9 Do we transfer your personal data outside of European Union?

No. Your personal data is processed in Luxembourg and Germany. Your personal data will not be transferred outside of the European Union.

An exception to this condition is the case in which you load a Melusina subpage that makes use of the YouTube video platform or when you decide to share information from Melusina via Twitter or other social-media sites. In this case, YouTube and Twitter will be aware of your current IP-address. Using Twitter is an optional service. Further information is provided in section 3.6.

10 How long do we store your personal data?

Your personal data is stored on the servers until you decide to delete your account. You can request account deletion by writing an e-mail to the operator of the website or by using its contact form.

Where legal retention periods demand the deletion of specific data types such as in the case of IP-addresses data will be deleted within that period regardless of the time of account deletion.

Bibliographic information and information about the provenance of scholarly content (monographs, articles, annotations) such as your role as an author, the date of publication among others are stored for a determinable period of time for academic expression. This is necessary in order to adhere to norms of academic discourse and to assure scientific accountability and integrity of scholarly content on the website.

11 What are your rights with regard to the processing of your personal data?

According to the GDPR, you benefit notably from the following rights: right to be informed, right to access your personal data, right to rectification, right to erasure, right to restrict the scope of the processing, right to withdraw consent, right to lodge a complaint. Further information is provided by the University on https://wwwen.uni.lu/university/dataprotection/yourrights.

In practice, how can you exercise your rights? You may contact the University or follow the procedure mentioned on https://wwwen.uni.lu/university/dataprotection/yourrights.

The Data Protection Officer of the University will handle your request with competent colleagues. You can also contact her directly by email on dpo@uni.lu for any questions related to the processing of your personal data.

12 How can you lodge a complaint?

If you consider that the processing of your personal data infringes the GDPR, you will have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with the CNPD.

You may contact the CNPD:

By post:

1, avenue du Rock’n’Roll
Service des reclamations
L-4361 Esch-sur-Alzette

By phone:

(+352) 26 10 60 -1

By Fax:

(+352) 26 10 60 – 29

By using the contact form:

https://www.melusinapress.lu/contact

13 Updating and changing the privacy policy

This privacy policy is currently valid and has the status June 2019.

Due to further development of our websites and changing legal or regulatory requirements, it may be necessary to change this privacy policy. The current privacy policy can be retrieved and printed by you at any time on the website under https://www.melusinapress.lu/privacy_notice.