Privacy Statement

Last updated: 2026-05-19

This statement explains how personal data is processed when you use the BespokeOLAP Demo Runner web interface. It is provided in accordance with Article 13 of the EU General Data Protection Regulation (GDPR).

1. Data controller and contact

The controller responsible for the processing of personal data on this site is:

• Technische Universität Darmstadt
• represented by its President
• Karolinenplatz 5, 64289 Darmstadt, Germany
• Telephone: +49 6151 16-01
• Email: info@tu-darmstadt.de

The service is operated within the Data & AI Systems Group (Prof. Dr. Carsten Binnig) at the Department of Computer Science. For questions specifically about this service, please contact:

• Johannes Wehrstein, Data & AI Systems Group, TU Darmstadt
• Email: johannes.wehrstein@tu-darmstadt.de

The Data Protection Officer of TU Darmstadt can be reached at:

• Datenschutzbeauftragte/r der Technischen Universität Darmstadt
• Karolinenplatz 5, 64289 Darmstadt, Germany
• Email: datenschutz@tu-darmstadt.de

2. Personal data processed

When you access this service, the following personal data may be processed:

• Technical request data: your IP address, the date and time of the request, the requested URL, the HTTP status code, response size, referring URL (if transmitted by your browser), and standard request headers such as User-Agent. This data is processed so the server can respond to your request and may also appear in operational logs.
• Query telemetry: when you run a query, the service stores the timestamp, IP address, query identifier, placeholder values entered in the form or URL, selected query engine, scale factor, execution time, and any error message.
• Approximate geolocation: the service may derive country, region, city, and coarse latitude/longitude from your IP address using a locally stored GeoLite2-format IP database (DB-IP Lite). Your IP address is not sent to any third-party geolocation provider for this lookup.

No account, name, email address, or other directly identifying information is requested from you through the user interface. The service does not use third-party advertising, tracking, analytics, or request-time geolocation services. The application itself does not set cookies; browser-based HTTP basic authentication may be used to protect the telemetry dashboard.

3. Purposes of the processing

• To operate the service and respond to your query requests.
• To monitor performance, stability, and capacity of the demo infrastructure.
• To detect, investigate, and prevent abuse, attacks, and misuse of the service.
• To understand the approximate geographic distribution of demo usage in aggregated form.
• To produce aggregated usage statistics in support of academic research on database query engines.

4. Legal basis

Processing for operating, securing, rate-limiting, and monitoring the service is based on Article 6(1)(f) GDPR. The legitimate interests pursued are providing the demo service, protecting it against misuse, diagnosing errors, and maintaining technical integrity.

Processing for aggregated academic research statistics is based on Article 6(1)(e) GDPR in conjunction with the public research tasks of TU Darmstadt, in particular under Hessian higher education law, and Article 89(1) GDPR. Research outputs are prepared only in aggregated or anonymised form.

5. Recipients and third parties

Data may be processed by TU Darmstadt IT systems and hosting infrastructure used to operate this service. Personal data is not sold or rented. Data may be disclosed where legally required, for example in response to lawful requests by public authorities.

6. International transfers

No transfer of personal data to recipients outside the European Economic Area is intended for the operation of this service.

7. Retention

Personal data is retained only for as long as it is necessary for the purposes described above. In particular, query telemetry and operational logs are reviewed and removed when they are no longer needed for operating, securing, debugging, or evaluating the demo service. Irreversibly anonymised or aggregated statistics are no longer personal data and may be retained beyond this period.

8. Your rights

Under the GDPR you have the following rights vis-à-vis the controller:

• Right of access (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to erasure / "right to be forgotten" (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability, where applicable (Art. 20 GDPR).
• Right to object (Art. 21 GDPR): you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.

To exercise any of these rights, please contact the service contact or the Data Protection Officer at the addresses listed in section 1. Because the service does not store names, accounts, or email addresses for ordinary visitors, identifying your records may require you to provide the approximate time of your visit and the IP address from which you accessed the service.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The supervisory authority responsible for TU Darmstadt is:

• Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
• Postfach 3163, 65021 Wiesbaden, Germany
• Website: datenschutz.hessen.de

9. Obligation to provide data

The provision of personal data is neither legally nor contractually required. However, certain data (in particular your IP address) is technically necessary for the web server to deliver responses to your requests; without this data the service cannot be used. The collection of query telemetry is not necessary for the individual delivery of a query result. You may object to this processing as described in section 8.

10. Automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this site.

11. Changes to this statement

This statement may be updated to reflect changes in the service or in applicable law. The "Last updated" date at the top of this page indicates when the most recent change was made.