Privacy notice
This notice explains which personal data we process when you take part, why, on which legal basis, how long we keep it and what your rights are under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").
1. Controller and contact
The controller is {{controller_name}}.
Address: {{controller_address}}
For any privacy question, to exercise your rights or to object, write to {{controller_email}}.
No data protection officer has been designated because none is required for this processing (Article 37 GDPR). Please use the address above.
2. What we process and where it comes from
Signing in with a Google account
You sign in with your Google account through a sign-in server (Keycloak) at {{identity_host}}. When you sign in, Google gives us: your Google account identifier, your email address, whether that address is verified, and your first and last name. The sign-in server stores these in your user account there. Of these, the labeling application stores only the technical identifier of your sign-in account and your email address (and the address only if it is verified).
Data you enter or that arises while you take part
- Your answers (labels): the answer to the question, a lemma you type, the irregular-form flag, the revision number of the answer and when it was saved.
- The time you took to answer each item (in milliseconds), and which items were shown to you, when and how many times.
- Your acceptance of this notice and of the terms of participation: document version, time of acceptance, interface language, application version and your confirmation that you are at least 16 years old.
- A random participant identifier (pseudonym) assigned to your profile. All your answers are linked to that identifier, not to your name or email address.
- The status of your profile (active, set aside, blocked or erased) and, if we change it, the reason.
Data that arises automatically at the network edge
The reverse proxy in front of the application records, for every request, the IP address, the time, the page address requested and browser details (user agent). An attack-protection system on the same infrastructure uses those records to detect and block malicious traffic. The labeling application itself keeps no access logs and does not see your IP address.
We use no cookies for tracking, analytics or advertising. What is stored in your browser is described in the cookie and storage notice.
3. Purposes and legal bases
- Running your profile and recording your answers to build the language dataset: your consent (Article 6(1)(a) GDPR), given when you start. You can withdraw it at any time by erasing your profile (section 7).
- Assessing how reliable answers are, detecting abuse, rate limiting and blocking accounts: legitimate interest (Article 6(1)(f)) in keeping a public research dataset accurate and protected from fake or automated entries. In weighing this interest we took into account that these assessments have no effect outside this site and that the data does not leave the controller.
- Security logs at the network edge: legitimate interest (Article 6(1)(f)) in protecting the service from attacks.
- Keeping records of consent: the legal obligation to be able to demonstrate consent (Article 7(1) together with Article 6(1)(c)).
4. Recipients and processors
- Google (Google Ireland Limited and Google LLC) as the sign-in provider. Google is an independent controller for your Google account; its privacy policy is at policies.google.com/privacy.
- The hosting provider that runs the application, its database, the sign-in server and the reverse proxy: {{hosting_summary}}.
- The public, when we publish the dataset: published files contain the item texts and the answers, linked at most to a random participant identifier, never to a name or email address.
We use no analytics or advertising services and have no other processors.
5. Transfers outside the EU and EEA
The sign-in request goes to Google, which may process it in the United States as well. Google LLC is certified under the EU-U.S. Data Privacy Framework, so such a transfer relies on the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR). The application's own data stays with the hosting provider named in section 4.
6. How long we keep data
- Your profile in the application (sign-in account identifier, email address): until you erase your profile.
- Your user account on the sign-in server (first and last name, email address): until you erase your profile; after an erasure request we delete it within 30 days.
- Answers: indefinitely, as part of the dataset, under the random participant identifier. Erasing your profile permanently severs that identifier from your identity.
- Time taken per answer and the list of items shown: until you erase your profile.
- Consent records: under the random identifier, for as long as we keep the answers given under that consent.
- Database backups: {{backup_retention}}. Data erased from the application disappears from backups after that period.
- Reverse proxy records at the network edge: {{edge_log_retention}}.
7. Your rights
- Access and portability: on the "My data" page you can download everything linked to your profile yourself, in a machine-readable format (JSON).
- Rectification: you can change your answers in the application; for anything else, write to us.
- Erasure: on the "My data" page you can erase your profile yourself. The application immediately deletes your sign-in account identifier, email address, answer times and the list of items shown to you. We delete your user account on the sign-in server (with your first and last name) within 30 days of the request; until then, signing in again shows a notice instead of creating a new profile. Your answers and consent records stay in the dataset under a random identifier that can no longer be linked to you.
- Restriction and objection: write to the address in section 1.
- Withdrawing consent: at any time, by erasing your profile. Withdrawal does not affect the lawfulness of processing before it.
- Complaint to a supervisory authority: the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, azop.hr. You may also complain to the supervisory authority of the member state where you live or work.
We answer requests without undue delay and at the latest within one month.
8. Automated decision-making
We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR). The application may assess how reliable answers are (for example by comparing them with items whose answer is known), give them more or less weight in the dataset accordingly, and temporarily disregard a profile's answers or limit its participation. These assessments have no effect outside this site. If you disagree with a decision about your profile, write to the address in section 1 and a person will review it.
9. Children
The service is for people aged 16 and over and is not directed at children. When you start we ask you to confirm that you are at least 16; we do not collect your date of birth. Profiles of younger people are erased as soon as we learn of them.
10. Changes to this notice
The notice carries a version number and a date at the top. When we publish a new version, we will ask you to accept it again before your next answer. Records of earlier accepted versions are kept.