Privacy notice

Information under Art. 13 GDPR on the processing of personal data in the review bidding of the bakule symposium, part of the BaKuLe project (Bamberger Kulturen der Lehre gemeinsam gestalten, “shaping Bamberg cultures of teaching together”) at the University of Bamberg.

Controller

The BaKuLe project management is responsible for the service: Prof. Dr. Stefan Hörmann (Vice President for Teaching and Students) and Prof. Dr. Dominik Herrmann (co-director). The service is run by the project coordination team: Prof. Dr. Julia Franz, Prof. Dr. Konstantin Lindner, Lorenz Mrohs (lead coordinator) and Prof. Dr. Dominik Herrmann. Technically it is operated by the Chair of Privacy and Security in Information Systems (Prof. Dr. Dominik Herrmann).

Data protection officer

Purposes and legal basis

The service distributes the anonymised submissions for the bakule symposium among the reviewers. Reviewers state how much they would like to review a submission (bids). The project coordination team computes the assignment from this and enters it into pretalx. To sign in we use links sent to your email address; there is no password.

The legal basis for processing personal data is Art. 6(1)(e) GDPR in conjunction with Art. 4(1) BayDSG (performance of a task carried out in the public interest).

Which data we process

• Reviewers: your email address (the project coordination team takes it from the reviewer list), your bids per submission with the time of the last change, optionally a maximum number of reviews and a note to the organisers, the time of your last sign-in, and the computed assignment.
• Sign-in and session: of the single-use sign-in link we store only a hash, together with your address. A link is valid for 30 minutes and works exactly once. After that a session lasts 14 days; we store a hash of the session, your address, and its creation and expiry time. The session is kept with a cookie (see below). For reviewers we also store when the entry was created.
• Submissions: code, title, abstract, references, format and topic from pretalx. Names and contact details of authors are neither imported nor stored (double-blind).
• Admins: your actions in the admin area are logged with address and time (traceability, IT security). Admins can download the assignment as a CSV file (code, title, reviewer address, bid) to their own device; that file then exists outside the service.
• Abuse protection: to protect against mass requests we count sign-in attempts per IP address and per email address. We store only hashes derived with a key that changes daily. The values are pseudonymised: without the server’s secret key the address cannot be derived from them. They are deleted by the cleanup after about 48 hours.

Server log files

On every access to this service the web server in front of it automatically stores the following data in log files:

• IP address of the requesting computer
• Date and time of the access
• Requested URL and resources
• HTTP status code
• Amount of data transferred
• Browser type and version (user agent)
• Referring page (referrer)

This data is processed to ensure IT security and operational stability. The single-use token in sign-in links (/login/…) is replaced by a placeholder in the log. The data is not combined with other data sources. Log files are deleted after 7 days at the latest; in case of security incidents they may be kept longer. The service itself stores no IP addresses and writes neither sign-in links nor mail contents to its log.

Cookies and tracking

We set exactly one cookie (bidding_session), which is technically necessary: it keeps you signed in (14 days), protects the forms against cross-site requests (CSRF protection) and remembers the chosen language and short messages after a form. It is marked HttpOnly, Secure and SameSite=Lax. No consent is required for this (§ 25(2) no. 2 TDDDG). We use no analytics or tracking tools and load no external resources (fonts, scripts, images).

Email

Sign-in links and reminders to reviewers are sent through the mail server of the University of Bamberg. A reminder states the number of positive bids you have given so far and the deadline. No mail is sent to addresses that are not registered; the web page answers identically in both cases.

Recipients

Your bids, maximum load and note are visible to the admins, that is the project coordination team. Other reviewers cannot see them. The computed assignment (your email address and the codes of the submissions assigned to you) is entered into pretalx, where you are registered as a reviewer anyway. The symposium manages submissions and reviews with the hosted service pretalx.com. Its operator processes the data on our behalf under a data processing agreement (Art. 28 GDPR). We do not pass data on to anyone else.

Retention

After the review process has ended, we delete submissions, bids, notes, assignments and reviewer addresses from the service. Expired sign-in links and sessions are unusable at once and are deleted by the service’s regular cleanup. The database is backed up daily and backups are kept for 14 days; deleted data disappears there after that period at the latest. The project coordination team clears the log of admin actions (which includes reviewer addresses) at the end of the process. Uploaded files are stored briefly in the database for the preview only (without author columns) and deleted by the cleanup after 6 hours at the latest. Server log files: see above (7 days).

Hosting

This service runs on infrastructure of the Otto-Friedrich-Universität Bamberg. Personal data is not transferred to third countries.

Your rights

You have the following rights towards the University regarding your personal data:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Objection to processing (Art. 21 GDPR)
• Data portability (Art. 20 GDPR)

To exercise your rights, please contact the University’s data protection officer. We need your address so that you can sign in; without bids we cannot take your preferences into account in the assignment.

Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority about the processing of your personal data:

As of: November 2026