Privacy Notice

The controller for the processing of personal data on arkid.org and in ArkID is Mycel UG (haftungsbeschränkt), Kollwitzstraße 76, 10435 Berlin, Germany, e-mail: info@arkid.org. More details are in the Imprint.

For all questions about data protection and to exercise your rights, contact us at the same address. You can write to us in German or English.

ArkID is the shared account for ResearchArk services and issues persistent identifiers for people, ideas, projects, organisations, outputs and funding opportunities. This notice applies to ArkID. Services you sign in to with ArkID process your data under their own responsibility and their own privacy notices.

We do not sell personal data, show no advertising and use no analytics or tracking tools.

• Account data: first and last name, e-mail address, whether it is confirmed, your ARKU, your password (only as an irreversible hash in the sign-in service), registration date and your acceptance of these documents with version and time.
• Profile data you provide: for example name prefixes and titles, a headline, a short biography, profile photo, website and links, affiliations with organisations and projects, and your ORCID iD, each with the visibility you choose.
• Records and content: ideas, projects, organisations, outputs, funding opportunities, preprints and files that you create or upload, and the links between them.
• Idea protection data: fingerprints (SHA-256) of protected content, a similarity vector computed from the text, review results, lineage details and prior-art reports.
• Digital credentials issued to you and their status.
• Sign-in and security data: sign-in sessions, whether you want to stay signed in, and a security log of important account events (e.g. failed sign-ins, password and e-mail changes, data export, account deletion) with time, IP address and browser identifier.
• Contact requests: name, e-mail address and message when you use the contact form.
• Server logs: IP address, time, requested address, status code and browser identifier for each request.

You decide which profile details and records are public. The resolver shows public details under your identifier; they can be retrieved through the interfaces and found by search engines. Your e-mail address is never public.

Published ideas name your ARKU as their creator, as do their lineage and prior-art reports. Unpublished ideas appear in public outputs only as an identifier with a time.

When you sign in to another ResearchArk service with ArkID, we pass your ARKU, your name, your e-mail address and whether it is confirmed to that service. From then on, the service processes these details under its own privacy notice.

If such a service issues a digital credential to you through ArkID, we store the credential and its status so that you can present it and others can verify it.

• Contabo GmbH, Munich (data centres in Germany): server hosting, as a processor.
• IONOS SE, Montabaur: sending our e-mails, as a processor.
• ORCID, Inc. (USA): only if you link your ORCID iD. You sign in directly at orcid.org; we receive your ORCID iD and the details you release.
• DataCite e. V., Hanover: only if you have a DOI registered for an output. DataCite receives and publishes the descriptive data of the output, including the creators named.
• Sigstore Rekor (public log of the OpenSSF / Linux Foundation): receives only checksums, counts and times of our batches, no personal data.
• Authorities and courts, where we are legally obliged.

We run the similarity check, the timestamp service and key management ourselves on our own servers.

We process your data in Germany. A transfer to countries outside the European Economic Area only happens if you link your ORCID iD: you then communicate directly with ORCID, Inc. in the USA, whose processing is governed by ORCID's privacy notice. Entries in the Rekor log contain no personal data.

Before registration, new ideas are automatically compared with protected ideas. From 70 % similarity, a person decides. From 85 %, the system refuses the registration automatically and names the similar identifiers. You can revise the idea, or ask at info@arkid.org for a person to review the decision, state your point of view and contest the decision (Art. 22(3) GDPR).

Statutory retention duties remain unaffected; in that case we restrict processing instead of deleting.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Much of this you can do yourself in your account: change details, choose visibility, download your data, remove links, end all sign-in sessions and delete your account. For anything else, write to info@arkid.org.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop processing the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

For an account we need your name, your e-mail address and a password; without them we cannot create an account. All other details are voluntary.

We use only technically necessary cookies and local storage, for example for sign-in and your display preferences. Details are in the Cookie Notice.

All connections are encrypted with TLS. Passwords are stored only as a hash, and signing keys are held in a separate key vault. Only staff who need access to personal data for their work have it.

We update this notice when the service or the law changes. We inform you about material changes by e-mail or at your next sign-in.