Privacy Policy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Email

kontakt@bibliocertus.de

VAT ID

DE 364 785 216 (Section 27a of the German VAT Act)

This is a sole proprietorship; there is no entry in the commercial register. The owner represents the business personally.

A data protection officer is not required by law and none has been appointed. For all data protection matters, please contact the address above directly.

2. Competent supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority.

3. General information, legal bases and definitions

We process personal data only to the extent necessary and on the basis of the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

The legal bases referred to in this policy mean:

• Art. 6(1)(a) GDPR — consent
• Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures
• Art. 6(1)(c) GDPR — compliance with a legal obligation
• Art. 6(1)(f) GDPR — legitimate interests, following a balancing of interests
• Section 25 TDDDG — storage of and access to information on terminal equipment (cookies)

Personal data means any information relating to an identified or identifiable natural person. Data subjects within the meaning of this policy are, in particular, visitors to the website, applicants for the pilot phase and registered users (teaching and examining staff).

4. Rights of data subjects

You have the following rights against us with regard to personal data concerning you:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected
• Complaint to a supervisory authority (Art. 77 GDPR; see section 2)

An informal message to kontakt@bibliocertus.de is sufficient to exercise these rights.

Note on the right to object: Where we process data on the basis of legitimate interests, you may object to that processing at any time on grounds relating to your particular situation.

5. Provision of the website and server log files

When you access the website, the web server in use (Caddy) automatically stores information transmitted by your browser in server log files. These are:

• IP address of the requesting device
• date and time of access
• path requested / name of the file retrieved
• HTTP status code
• volume of data transferred
• user agent (browser and device identifier)
• referrer (previously visited page), where transmitted

This processing is necessary for technical delivery, to ensure stability and security, and to defend against attacks.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation)

Retention period

log files are rotated regularly and deleted after 90 days at the latest

IT security (fail2ban)

To protect against automated attacks and unauthorised access attempts, we use the fail2ban service. It evaluates the server log files and temporarily blocks conspicuous IP addresses.

Data processed

IP address, access patterns

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in IT security)

6. Hosting

The website and the associated services are hosted by an external service provider (processor):

Processing takes place exclusively in data centres in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. Hetzner also provides the email mailbox and the server backups. Privacy information: Hetzner privacy policy (opens in a new tab)

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in secure, high-performance provision)

7. Cookies

BiblioCertus uses strictly necessary cookies only. No cookies are used for analytics, tracking or marketing purposes. No consent (and therefore no cookie banner) is required.

In detail:

Legal basis for storage/access

Section 25(2) no. 2 TDDDG (strictly necessary for the service expressly requested)

Legal basis for processing

Art. 6(1)(f) GDPR (functionality and security)

8. Contacting us and applying for the pilot phase

8.1 Contact by email

If you contact us by email (kontakt@bibliocertus.de), we process the details you provide in order to handle your enquiry.

Legal basis

Art. 6(1)(b) GDPR (pre-contractual/contractual) or Art. 6(1)(f) GDPR (handling of enquiries)

Retention period

until your enquiry has been conclusively dealt with, unless statutory retention obligations apply

8.2 Sign-up form for the free pilot phase (bibliocertus.de)

Teaching staff can apply for the free pilot phase using the form on bibliocertus.de. The details you enter are processed:

first name, surname, email address, institution, role, department and your description of the intended use case.

How the data is processed technically (transparency)

• The form does not store any data in a database. Your entries are processed in memory only, for the duration of the transmission.
• Two emails are sent: a notification to the controller (kontakt@bibliocertus.de) and a confirmation to the email address you provided. Your application therefore exists as an email in the controller’s mailbox (hosted by Hetzner).
• To protect against automated abuse (spam) we use technical measures without any personal reference: invisible “honeypot” fields, a timing check and a short-lived rate limit. Only an anonymised IP address (e.g. 203.0.113.0/24) is written to the server’s error log; names and email addresses are not logged. The rate limit stores only short-lived timestamps with no personal reference (deleted after 10 minutes).

Legal bases and retention

Application data

Art. 6(1)(a) GDPR (your consent via the mandatory checkbox) and Art. 6(1)(b) GDPR (performance of pre-contractual participation in the pilot)

Spam protection

Art. 6(1)(f) GDPR (legitimate interest in preventing automated submissions)

Retention period

for the duration of the pilot phase, no longer than 12 months from receipt, then deleted. If the pilot phase ends earlier, deletion takes place on its conclusion at the latest.

You may withdraw your consent at any time with effect for the future (email to kontakt@bibliocertus.de).

8.3 Contacting us by post

Postal items sent to the address given in the legal notice are received and allocated by a contracted mail service provider:

This is based on a postal power of attorney and a data processing agreement pursuant to Art. 28 GDPR. Sender details and item data are processed solely for the purpose of receiving, allocating and forwarding post to the controller. Processing takes place exclusively in Germany.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in orderly and reliable handling of post); for contract-related post additionally Art. 6(1)(b) GDPR

Retention period

item data is processed for the duration of the service relationship and is then returned as instructed or deleted in a data protection compliant manner, unless statutory retention obligations apply

Data protection contact

Akwiso Datenschutz & Audit, Dieter Grohmann, Beethovenstraße 23, 87435 Kempten, dg@akwiso.de

9. User accounts (teaching and examining staff)

A user account is required in order to use the application. In this context we process:

• email address and name
• password (stored exclusively as a cryptographic hash, never in plain text)
• two-factor authentication (2FA) settings
• assignment to the respective university or institution

Purpose

provision, protection and administration of the user account

Legal basis

Art. 6(1)(b) GDPR (user relationship) and Art. 6(1)(f) GDPR (account security)

Retention period

until the account is deleted

Password security check

When you set or change a password, we check whether the chosen password has appeared in known data breaches. A “k-anonymity” method is used for this: only the first five characters of a hash of your password are transmitted to the “Have I Been Pwned” service (api.pwnedpasswords.com) — never the password itself and no personal data. No personal reference arises in the process.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in account security)

Login via DFN-AAI (university single sign-on)

If your university is a member of the authentication and authorisation infrastructure of the German National Research and Education Network (DFN-AAI), you can log in with your usual university credentials. You select your university and are redirected to its login service. Your password never reaches us — it is verified exclusively by your university. After a successful login, your university’s login service transmits selected attributes to our service.

Our service is registered in the DFN-AAI under the identifier https://sso.bibliocertus.de/shibboleth.

Roles under data protection law

Under the rules of the DFN-AAI, the operator of the login service (your university) and the operator of the service (we) are independent controllers. We are therefore the controller for the login process and for the attributes received in that process; this section provides the corresponding information. Which attributes your university releases, and on what basis it does so, is your university’s responsibility — its own privacy policy provides that information. This allocation of roles does not affect the reference checking itself: that is carried out on behalf of your university (see section 12).

Attributes requested

We request the following attributes. Your university decides which of them are actually transmitted; none of them are mandatory at the level of the login procedure. Many login services ask for your consent before the first transmission.

• Entitlement (eduPersonEntitlement) — controls access. Your university sets the agreed value only for those persons covered by the licence.
• Persistent identifier (pairwise-id, subject-id, eduPersonUniqueId or eduPersonPrincipalName) — allows us to recognise you at your next login and to assign your verification jobs. The preferred forms are service-specific and do not identify you by name.
• Institutional affiliation (schacHomeOrganization) — assigns you to your institution and thus to the correct licence.
• Status (eduPersonAffiliation, eduPersonScopedAffiliation) — for example staff or faculty.
• Work email address (mail) — for notifications about your verification jobs and for security-related messages.
• Name (displayName, givenName, sn) — for forms of address and display within the application.

What we store from this

• the persistent identifier and the identifier of your university’s login service,
• name and work email address; if no address is transmitted, we generate a technical, non-deliverable substitute address solely to ensure uniqueness,
• the assignment to university and licence,
• the attributes most recently transmitted, so that you can see in your profile what your university has passed on about you to this service. Only the most recent state is stored — we do not keep a history of it.

Purposes

authentication, verification of access entitlement within the scope of the university licence, assignment of your verification jobs, and providing you with information about the attributes received

Legal basis

Art. 6(1)(b) GDPR (performance of the user relationship) and Art. 6(1)(f) GDPR (legitimate interest in account security and in enforcing the agreed licence scope)

Retention period

until the account is deleted. Your university may decide that accounts are deleted after an extended period of inactivity; in that case you will be reminded by email beforehand.

10. Core function: checking bibliographic references

The application checks whether the sources listed in a bibliography can be verified.

Important note on uploaded content: Only bibliographies or bibliographic references may be uploaded — no personal data of students (in particular no names, student ID numbers or other personal details). The application is intended for processing details of published works (title, authorship, year, DOI and similar); as a rule, this work metadata is not personal data.

For verification, the details of the work are matched against bibliographic catalogues and specialist databases. Recipients of this work data (which is not personal data) include:

• German National Library (DNB), K10plus, German Digital Library, DataCite, lobid (hbz), SSOAR (GESIS), dblp, OpenAIRE, DOAB — established in Germany/the EU
• Europe PMC (EMBL-EBI) — established in the United Kingdom (adequacy decision of the European Commission)
• CrossRef and OpenAlex — established in the USA. Only work metadata is transmitted; no personal data is transferred to third countries.

AI-assisted preparation and assessment

References that cannot be parsed unambiguously by machine are prepared by a language model before matching; the results are likewise assessed by machine. There are two paths for this:

• Default — local model. Processing is carried out by an AI model operated on our server in Germany. No data is transmitted to external AI services. This is the default for every university.
• Optional per university — Mistral interface. A university may instead choose the Mistral AI interface for this preparation step. This option is switched off by default.

If the Mistral interface is activated by a university, the recipient is:

Processing takes place via the EU endpoint api.eu.mistral.ai and therefore within the EU or the EEA. Only the raw text of the reference concerned is transmitted (a maximum of 1,000 characters) — no personal data, no user details and no file names.

The basis for this is the Mistral AI Data Processing Addendum, which forms part of the terms of use as a data processing agreement pursuant to Art. 28 GDPR. Under it, Mistral processes the data as a processor acting on our instructions. For two purposes Mistral would act as its own controller — training its own models and automated abuse monitoring. Both are excluded for our organisation: use for training purposes is switched off and zero data retention is enabled.

Mistral may engage sub-processors and lists them in its Trust Center; they are contractually bound to an equivalent level of protection. Where data is processed outside the EU in this context, this takes place only on the basis of an adequacy decision of the European Commission or the EU standard contractual clauses. After the end of the contractual relationship, the data is deleted or returned.

If the interface is unavailable, processing automatically reverts to the local model. As at the date of this policy, no university has activated the interface.

A log entry is created for every request to a language model, for billing and traceability. By default it contains no reference text and it is deleted together with the associated verification job.

Optional web search

On explicit request (“check with web search”), an additional web search is carried out for a source. For this purpose the search query (details of the work) is transmitted to the Linkup service:

A data processing agreement pursuant to Art. 28 GDPR is in place with Linkup, including a zero data retention agreement; the query is processed in memory only and is not stored permanently. Use of the data for training purposes is switched off in our account. Privacy information: Linkup privacy information (opens in a new tab)

Legal basis

Art. 6(1)(b) GDPR (provision of the checking service) and Art. 6(1)(f) GDPR (functionality)

Retention period

uploaded bibliographies and verification results are deleted automatically after 30 days. Log data kept for traceability (audit log) is stored for up to 12 months.

11. Email notifications

On request, we will inform you by email when a check has been completed and about security-relevant events (for example a password reset). Messages are sent via the hosting provider’s mail server (Hetzner, see section 6).

Legal basis

Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR

12. Processing on behalf of universities

Where BiblioCertus is used by a university under a licence agreement, the provider acts in that respect as a processor pursuant to Art. 28 GDPR; the controller in that case is the respective university. The data processing agreement concluded with the university and the university’s own privacy information apply to that processing. This policy concerns the processing operations for which the controller named above is itself responsible.

13. Social media

There is currently no company presence (company page) on social networks. Posts about BiblioCertus are published via the owner’s personal LinkedIn profile. If you visit a LinkedIn profile or interact there, LinkedIn Ireland Unlimited Company processes personal data as its own controller and in accordance with its own terms: LinkedIn privacy policy (opens in a new tab)

14. Data security (technical and organisational measures)

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR, in particular:

• end-to-end transport encryption (TLS/HTTPS), HSTS
• strict content security policy, clickjacking protection (X-Frame-Options), nosniff, restrictive permissions policy
• protection against automated attacks (fail2ban)
• passwords stored exclusively as hashes; optional two-factor authentication
• AI processing on our own server by default; an external interface only if a university expressly chooses it, and exclusively within the EU (see section 10)
• regular backups stored at the hosting provider (Hetzner, Germany)

15. Currency and amendment of this privacy policy

This privacy policy is currently valid (see date below). Further development of the website or changes in legal requirements may make it necessary to amend it. The current version can be accessed on this page at any time.