Privacy policy (Datenschutzerklärung)

Last updated: 7 October 2026

This policy explains which personal data MycoShare processes when you visit the website, contribute data or write a comment, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Universität Stuttgart
Institut für Baukonstruktion
Keplerstraße 7
70174 Stuttgart, Germany
Email: info@ibk2.uni-stuttgart.de
Represented by: Martin Ostermann

Data protection officer of the Universität Stuttgart: Klaus Scharpf, datenschutzbeauftragter@uni-stuttgart.de

2. In short

• No advertising, no tracking, no analytics, no social-media plug-ins.
• No external fonts, scripts or images are loaded: your browser only talks to this server.
• Only technically necessary cookies are used.
• If you contribute, we store the name you give (and, optionally, your email address). Names appear publicly; email addresses never do.

3. Visiting the website

Data processed: When you open a page, the web server receives the technical data your browser sends: the requested address, date and time, the response status, the amount of data and the browser type. For security reasons the log may also contain your IP address, in particular when errors or attacks are recorded.

Purpose and legal basis: Delivering the website and keeping it secure and stable. Legal basis is Art. 6 (1) (e) GDPR in conjunction with § 4 of the Landesdatenschutzgesetz Baden-Württemberg (performance of the university’s tasks in research and knowledge transfer).

Storage: The logs are kept only briefly and are overwritten automatically after a short time. They are not merged with other data and not used to identify visitors.

4. Cookies and local storage

These cookies are technically necessary and are set without consent (§ 25 (2) no. 2 TDDDG). They do not track you.

The Lab (start page) stores your display choices (selected columns, filters, view) in the local storage of your browser so that they are still there on your next visit. This information stays on your device and is never sent to us. You can delete it in your browser settings.

5. Contributions and comments

Anyone can propose new data or corrections and comment on experiments, without an account.

• What we store: your name (required), your email address (optional), the reason or source you give, the content of your contribution or comment, the assessment you choose (correct / not correct), the date and time, and the record of your licence agreement (see below). A proposal gets a private status link that only you receive.
• What is public: the content of accepted contributions and of comments, your name and the source or reason you gave (in comments and in the version history of an entry). Your email address is never published; only the editorial team can see it. Please use a pseudonym if you do not want your real name to appear, and do not put personal data of other people into the text fields.
• Purpose: reviewing and publishing contributions, documenting who contributed what (version history), contacting you with questions about your contribution, and protecting the platform from misuse.
• Legal basis: Art. 6 (1) (e) GDPR in conjunction with § 4 LDSG BW (operating a scientific database); for the optional email address Art. 6 (1) (a) GDPR (your consent, given by entering it).
• Obligation to provide data: Giving a name is required to contribute; without it we cannot accept the contribution. Everything else is voluntary.

Record of your licence agreement

Before you submit a contribution or comment you must agree that it is published under the licence CC BY 4.0. To be able to prove this agreement, we record the licence, the exact wording and its version, and the date and time, together with your contribution. We do not record your IP address for this purpose. Legal basis: Art. 6 (1) (e) GDPR in conjunction with § 4 LDSG BW.

6. Editor accounts

For members of the editorial team we store a user name, an email address if provided, and a password in encrypted (hashed) form, as well as the time of the last login. Legal basis: Art. 6 (1) (e) GDPR in conjunction with § 4 LDSG BW. Decisions on proposals (accept or reject) are recorded with the account that made them and the time.

7. Hosting and recipients

The website runs on a virtual server of netcup GmbH (Germany), which processes data on our behalf under a data processing agreement (Art. 28 GDPR). The data are stored on this server in Germany. Daily backups of the database are kept on the server for 14 days; the operator also keeps a copy of the backups on a protected computer of the institute.

We do not pass your data on to other third parties, and we do not transfer them to countries outside the EU/EEA. Contributions that you publish become part of the database and are visible to everyone.

Links to other websites (for example doi.org, publishers, creativecommons.org) lead away from MycoShare. Their operators are responsible for their own data processing; we have no influence on it.

8. Storage period

• Server logs: overwritten automatically after a short time.
• Contributions, comments, names and the licence record: as long as the content is published on MycoShare. After removal we delete the personal data unless we need them to assert or defend legal claims.
• Email addresses: until you ask us to delete them, at the latest when your contribution has been dealt with and no more questions are expected.
• Backups: 14 days on the server; deleted data leave the backups with the next rotation.

Please note: Content published under CC BY 4.0 may be copied and reused by others. We can remove it from MycoShare, but we cannot recall copies that others have made lawfully.

9. Your rights

Under the GDPR you have the right to:

• information about your data (Art. 15),
• rectification of incorrect data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6 (1) (e) on grounds relating to your particular situation (Art. 21),
• withdraw a consent at any time with effect for the future (Art. 7 (3)), for example for the email address.

To exercise your rights, write to info@ibk2.uni-stuttgart.de and name the contribution concerned, so that we can find it. We can only identify your data if you tell us the name you used and the contribution.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for the Universität Stuttgart is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW).

10. No automated decisions

There is no automated decision-making or profiling.

11. Security

The site is served only over an encrypted connection (HTTPS). Access to the server is restricted, the system is updated regularly, and passwords are stored only as hashes.

12. Changes

We will adapt this policy if the website or the legal situation changes. The current version is always available at this address.

See also the legal notice and the disclaimer.