Privacy Policy
How we handle your data
1. Controller
The controller responsible for data processing on this website is:
Dr. Tobias Vlćek
Email: tobias.vlcek@uni-hamburg.de
This policy covers the hosting of this website, the AI chat assistant (“Oshu”) embedded on it, the privacy-friendly web analytics (Umami) used to measure site usage, and content that pages load from other providers. To exercise your rights or for any questions about data processing, please contact us using the details above.
2. AI chat assistant (Oshu)
Note on the course chatbot: Conversations with the chatbot are stored without names and analysed to improve teaching and for scientific research; individual excerpts may be quoted without any reference to a person. Please do not enter personal data.
On this website we use an embeddable AI chat assistant operated on our behalf by BeyondSimulations GmbH, Am Eich 9d, 22113 Oststeinbek, Germany (“Oshu”) as our processor. A data processing agreement under Art. 28 GDPR is in place with Oshu.
Purpose: the assistant answers visitor questions based on content we have provided. In addition, we evaluate the conversations to improve teaching and for scientific research; individual excerpts may be quoted in research results without any reference to a person.
Data processed: when you use the chat, the messages you enter, the generated responses, and a conversation identifier are processed. The chat needs no login: conversations are stored under this identifier, without your name. Technical data such as your IP address is processed only transiently for security and abuse prevention and is not stored permanently with the conversation. Please do not enter personal data into the chat, in particular no special categories of personal data (Art. 9 GDPR).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering enquiries efficiently, in improving teaching and in scientific research). If the chat forms part of a contractual service, Art. 6(1)(b) GDPR.
3. Hosting and inference of the chat assistant
Data is processed on servers of Hetzner Online GmbH in Falkenstein, Germany. Responses are generated via the EU API of Mistral AI SAS in Paris, France. There is no transfer to a third country, and the content is not used to train AI models.
5. Retention
Conversation logs are automatically deleted after at most 12 months. Excerpts quoted in research results contain no reference to a person and remain part of those results.
6. Web analytics (Umami)
To understand how this website is used and to improve its content, we use Umami, a privacy-friendly web analytics tool. Umami is self-hosted on our own infrastructure (umi.byndsim.com) on servers of Hetzner Online GmbH in Germany; usage data is not shared with third parties and there is no transfer to a third country.
No cookies, no tracking across sites: Umami does not set cookies and does not store any information on your device. It does not create a persistent identifier and does not track you across other websites.
Data processed: Umami collects aggregated, anonymized usage statistics such as the pages viewed, the referring website, and general information about your browser, operating system, device type, and country. Your IP address is used only transiently to derive this information and is not stored.
Learning games: on pages with interactive learning games, Umami additionally records anonymous game events: that a game was started, the score reached and its distance from the optimal solution in percent when you press Optimize, and whether you opened the explanation. These events contain no identifiers and none of your inputs on the game board.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving our website). Because Umami does not store or access information on your device, no consent under § 25(1) TDDDG is required.
7. Website hosting and file delivery
This website is served by GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. Where pages or slides embed images from our own image host (images.beyondsimulations.com) or load scripts from cdnjs.cloudflare.com, these files are delivered through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
Data processed: when you open a page, GitHub processes technically necessary connection data in server logs, in particular your IP address, the date and time of the request, and information about your browser and operating system. We have no influence on the scope and duration of GitHub’s processing. When your browser loads a file that is delivered by Cloudflare, Cloudflare processes the same kind of connection data. This is needed to deliver the pages and files and to keep the services secure.
Transfer to a third country: a transfer to the USA is possible. GitHub, Inc. and Cloudflare, Inc. are certified under the EU-U.S. Data Privacy Framework (list of participants).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and efficient delivery of the teaching material). Details are in the GitHub Privacy Statement and the Cloudflare Privacy Policy.
8. Content from other providers
Some pages load content from other providers. When you open such a page, your browser connects to the provider, which receives your IP address and technical request data such as the browser type and the page you came from. On this website this concerns:
- Script libraries such as MathJax (for formulas), jQuery and RequireJS are loaded from the content delivery network jsDelivr (
cdn.jsdelivr.net), operated by Volentio JSD Limited, a company registered in England and Wales. jsDelivr delivers the files through infrastructure providers (Cloudflare, Fastly, Gcore). See the jsDelivr privacy policy. - Animated images on some slides are embedded from Giphy (
giphy.com), a service of Giphy, Inc., New York, USA. - A form is embedded from Tally (
tally.so), a service based in Belgium. See the Tally privacy policy. - One interactive figure loads the Plotly library from
cdn.plot.ly(Plotly, Canada). See the Plotly privacy policy. - One image is embedded from
i0.wp.com, an image service of Automattic Inc., San Francisco, USA. See the Automattic privacy policy.
Embedded content from Giphy and Tally can store cookies or similar data on your device when it loads. We have no influence on this. A transfer to countries outside the EU, in particular to the United Kingdom and the USA, is possible.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliable and clear presentation of the teaching material).
9. Your data protection rights
Under the EU General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:
- Right to access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restrict processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
To exercise any of these rights, please contact us as the controller using the details in Section 1. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.
10. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the date at the top. We encourage you to review this policy periodically.