Privacy information

Last updated: 20 September 2026

1. Controller

The controller responsible for the processing of personal data on this website is:

Peter T. Rühr
Mainzer Str. 16
50678 Cologne
Germany
Email: pruehr@uni-bonn.de

2. Website hosting

This website is hosted using GitHub Pages, a service provided by GitHub. When a GitHub Pages site is visited, GitHub logs the visitor's IP address for security purposes and may process additional technical request data. The purpose is the secure and reliable delivery of the website. The legal basis for processing by the meeting organiser is Art. 6(1)(f) GDPR (legitimate interest in providing a secure and functional website).

More information: GitHub General Privacy Statement.

3. Registration

When you register, we process the information entered in the registration form, including your name, email address, institution, country, organisational choices and any optional information you provide. These data are used to organise participation in the DZG Morphology Meeting 2027, communicate with participants, plan the conference dinner and administer the meeting.

The legal basis is Art. 6(1)(b) GDPR where processing is necessary to take steps at your request or administer your participation, and Art. 6(1)(f) GDPR for legitimate organisational interests where applicable.

Dietary, accessibility or participation information may reveal health information or other special-category data. Providing these fields is optional. If you enter information in either of these fields, an additional consent checkbox appears in the registration form and must be selected before the form can be submitted. Processing of these data is based on your explicit consent under Art. 9(2)(a) GDPR. You may withdraw this consent at any time by contacting the controller; withdrawal does not affect processing that was lawful before withdrawal.

The separate checkbox confirming that you have read this privacy information is required for every registration. It records acknowledgement that this notice was presented and is not used as the legal basis for processing ordinary registration data.

4. Abstract submission

For abstract submissions we process the submitting email address, title, author names, affiliations, presenting and corresponding author, career status of the presenting author, requested presentation type, abstract text, keywords and optional comments. The data are used to receive, review, schedule and communicate about scientific contributions.

The legal basis is Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR (legitimate interest in scientific meeting organisation and communication).

5. Database and form processing — Supabase

Registration and abstract records are stored and processed using Supabase. The project's primary database region is Central EU (Frankfurt). The public website does not have direct access to the participant tables; submissions are validated by server-side Edge Functions before storage. Supabase acts as a processor for these data under its data-processing terms and may use authorised subprocessors.

More information: Supabase Privacy Policy.

6. Bot protection — Cloudflare Turnstile

The registration and abstract forms use Cloudflare Turnstile to distinguish legitimate visitors from automated submissions. Turnstile processes technical signals such as IP address, TLS/browser characteristics, user-agent information, site key and origin for security purposes. Cloudflare states that Turnstile does not access, store or transmit the contents of the form fields.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the forms and meeting infrastructure against spam and automated abuse). Turnstile is used in its standard token mode; pre-clearance is not enabled.

More information: Cloudflare Turnstile Privacy Addendum.

7. Transactional email — Resend and organiser mailbox

Confirmation emails and organiser notifications are sent using Resend (Plus Five Five, Inc.). For this purpose, the recipient email address and the content required for the relevant transactional message are transmitted to Resend. The meeting does not use these messages for marketing.

Organiser notifications are currently delivered to a Google-hosted Gmail mailbox. The notification emails are intentionally limited to information needed to alert and administer the submission; dietary and accessibility details are kept in the protected database rather than included in organiser notification emails.

The legal basis is Art. 6(1)(b) and Art. 6(1)(f) GDPR. More information: Resend Privacy Policy and Google Privacy Policy.

8. International data transfers

Some service providers or their subprocessors are established outside the European Economic Area or may process data there. Where required, transfers are covered by the safeguards made available by the respective provider, such as Standard Contractual Clauses and/or an applicable adequacy mechanism. The primary Supabase project database is located in Frankfurt, Germany.

9. Cookies and local storage

This website does not use analytics, advertising, social-media tracking or non-essential cookies or comparable browser storage. Cloudflare Turnstile is used for strictly security-related form protection and is configured without pre-clearance. Because no non-essential storage technology is currently used, the website does not display a cookie-consent banner. If analytics, embedded services or other non-essential storage technologies are added later, this privacy notice and any consent requirements will be reviewed before deployment.

10. Retention

Registration records are retained for meeting administration and follow-up and are scheduled for deletion or anonymisation no later than 31 August 2027, unless a longer period is required for the establishment, exercise or defence of legal claims or another statutory obligation.

Dietary and accessibility information is retained only as long as needed to provide the requested arrangements and is scheduled for deletion no later than 31 March 2027.

Abstract-submission records are scheduled for deletion or anonymisation no later than 31 December 2027. If accepted abstracts are later published as part of a scientific programme or abstract collection, that publication will be handled separately and participants will be informed where necessary.

Technical logs and provider-side records may be retained for different periods according to the security and retention policies of the respective service provider.

11. Your rights

Subject to the conditions of the GDPR, you have the right to request access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw that consent at any time for the future.

To exercise these rights, contact pruehr@uni-bonn.de.

12. Right to lodge a complaint

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent authority in North Rhine-Westphalia is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Email: poststelle@ldi.nrw.de
www.ldi.nrw.de

13. Required and optional information

Fields marked with an asterisk are required to process the relevant registration or submission. Optional fields can be left blank. No automated decision-making with legal or similarly significant effects is carried out through this website.