Privacy Notice — gadvox.de (Interest Registration)
As of 30 September 2026. This is a translation; the German version is legally binding. It applies while the GADVOX dataset has not yet been released and the platform only offers the registration of interest. Participants of the GADVOX study: please see the separate participant privacy information.
1. Controller
Technische Universität Berlin, Straße des 17. Juni 135, 10623 Berlin, Germany, represented by its President. The platform is operated by the Quality and Usability Lab, Faculty IV, TU Berlin, Ernst-Reuter-Platz 7, 10587 Berlin.
Contact: admin@gadvox.de or the contact form. Data protection enquiries: privacy@gadvox.de.
2. Data protection officer
Dr. Karsten Kinast, KINAST Rechtsanwaltsgesellschaft mbH, Nordstraße 17a, 50733 Köln, Germany, dsb-tuberlin@kinast.eu. More information: https://www.tu.berlin/datenschutz
3. Visiting the website
Data: IP address, date and time, requested address, HTTP method and status code, amount of data transferred, referring page, and browser identifier (user agent). To protect the platform against misuse (e.g. mass registrations), the IP address is also held briefly in a rate-limiting counter.
Purpose: delivering the website, ensuring stability and security, detecting and investigating attacks.
Legal basis: Art. 6(1)(e), (3) GDPR in conjunction with § 3 Berlin Data Protection Act (BlnDSG).
Retention: server logs 14 days; rate-limiting counters a few minutes to at most one hour. Logs relating to a security incident are kept until the incident has been resolved.
The platform uses no analytics, tracking, or advertising services, no social media plug-ins, no external fonts, and no content delivery networks.
4. Cookies
We set only strictly necessary cookies:
| Cookie | Content | Duration |
|---|---|---|
| Security token (CSRF) | random token that protects forms against cross-site request forgery | until you close the browser |
| Language setting | chosen language (de/en), only if you switch the language | 12 months |
| Session cookie (administrators only) | random session identifier for logged-in administrators | 8 hours of inactivity; deleted on logout |
Legal basis: § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); for the subsequent processing Art. 6(1)(e), (3) GDPR in conjunction with § 3 BlnDSG. No consent banner is needed.
5. Registering your interest
The GADVOX dataset is not yet available because an approval process is ongoing. You can register to be informed when it is released. Registering is not an application for data access and creates no obligations.
Data: name, email address, your confirmation that you are interested in GADVOX for non-commercial scientific research, your confirmation that you have taken note of this notice, and the times of registration, email confirmation, and notification.
Purpose: assessing how much interest the research community has in the dataset, and informing you once when the dataset is released. You confirm your email address via a link (double opt-in), so that nobody can register other people's addresses.
Legal basis: Art. 6(1)(e), (3) GDPR in conjunction with § 3 BlnDSG and TU Berlin's research tasks under the Berlin Higher Education Act (provision of research data). Registering is voluntary.
Retention:
- unconfirmed registrations: deleted after 7 days;
- if you unsubscribe (link in every email): deleted immediately;
- otherwise: deleted 6 months after the release notification, at the latest on 31 August 2031 (end of the dataset's provision); if it is decided not to release the dataset, we delete the registrations after informing you of this.
6. Emails sent by the platform
The platform keeps a log of the emails it sends (recipient address, template, subject, text, time, delivery status, message identifier) so that we can prove they were sent. Personal links are removed from the stored text after sending. Emails are sent via STRATO AG as our processor (Section 10).
Legal basis: as for the matter the email belongs to. Retention: emails relating to an interest registration are deleted together with it; other emails after 12 months.
7. Contact form
Data: name, email address, category of your enquiry, your message, time of submission, and IP address (for abuse protection). Purpose: answering your enquiry. Your message is forwarded by email to admin@gadvox.de and kept in the application only as long as necessary for delivery, at most 30 days. The email correspondence is deleted once your enquiry is resolved.
Legal basis: Art. 6(1)(e), (3) GDPR in conjunction with § 3 BlnDSG. If you took part in the study, please do not send information about your health; your participation code is sufficient.
8. Participant withdrawal form
Data: participation code, optionally an email address and a message, time of the request, processing status. Purpose: implementing withdrawal of consent and erasure. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(3), 17, and 19 GDPR.
Retention: the email address and message are deleted 30 days after we have confirmed the deletion. The participation code is kept as a deletion record until the end of the dataset's provision (31 August 2031) plus three years, so that the data are never included again and the deletion can be proven.
9. Administrator accounts and audit log
For administrators, the platform stores name, email address, password hash, second-factor secret and recovery codes (hashed), and an audit log of every administrative action with time and IP address. Legal basis: Art. 6(1)(e), (3) GDPR in conjunction with § 3 BlnDSG and Art. 32 GDPR; for TU Berlin staff also Art. 88 GDPR in conjunction with § 18 BlnDSG. Retention: audit log 10 years; accounts until deactivation plus 10 years.
10. Recipients and processors
- Within TU Berlin: the GADVOX team at the Quality and Usability Lab and the technical administrators of the platform.
- STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin: sending emails and hosting the gadvox.de mailboxes, under a data processing agreement (Art. 28 GDPR).
- Authorities: only where we are legally obliged.
The platform is hosted on a server of TU Berlin in Germany. We do not transfer your data to countries outside the EU/EEA. No automated decision-making takes place.
11. Retention periods at a glance
| Data | Retention |
|---|---|
| Server logs | 14 days |
| Rate-limiting counters | at most 1 hour |
| Unconfirmed interest registrations | 7 days |
| Confirmed interest registrations | until you unsubscribe, otherwise 6 months after the release notification, at the latest 31 August 2031 |
| Emails relating to a registration | as the registration |
| Other emails | 12 months |
| Contact form in the application | at most 30 days |
| Withdrawal form: email and message | 30 days after confirmation of deletion |
| Withdrawal form: participation code | until 31 August 2034 |
| Administrator audit log | 10 years |
| Backups | encrypted, on TU Berlin infrastructure, overwritten in a rolling cycle of at most 30 days |
12. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and to object on grounds relating to your particular situation (Art. 21 GDPR). You can delete your interest registration yourself at any time via the link in every email. Otherwise, please contact privacy@gadvox.de.
You also have the right to lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, or the authority at your place of residence or work.
13. Changes
Once the dataset is released and the platform manages access to the data, an extended privacy policy will apply, which we will publish here. Earlier versions are available on request.