Privacy Notice – IAVS Open Data Index (Vegetation Science Metadatabase)

Last updated: October 16, 2026

This privacy notice applies specifically to the IAVS Open Data Index ("the Metadatabase"). It supplements the general IAVS Privacy Policy.

1. Controller

The Metadatabase is operated by the IAVS Ecoinformatics Working Group ("we", "us").

The International Association for Vegetation Science (IAVS) provides the domain and institutional framework. The IAVS Ecoinformatics Working Group and IAVS may act as joint controllers for the processing of personal data.

The IAVS Ecoinformatics Working Group is the primary contact point for all data protection requests: admin@opendata.iavs.org

2. Purpose of Processing

We process personal data solely to:

• register and manage user accounts
• enable users to submit and manage dataset metadata
• verify submissions and prevent automated or abusive registrations (e.g. via DOI validation)
• operate, maintain, and secure the Metadatabase
• communicate with users regarding their accounts (e.g. password reset emails)

3. Categories of Personal Data

We process the following personal data:

• First and last name
• Email address
• Password (stored in secure, hashed form)
• Publication DOI (used for verification purposes)
• Dataset metadata submitted by users, which may include publicly available information such as names and affiliations of dataset authors
• Technical data necessary for operation and security (e.g. IP address, login/session logs)

4. Legal Basis

Processing is based on:

• Provision of the service requested by the user (e.g. user accounts and database functionality)
• Legitimate interests (ensuring security, preventing abuse, and operating the service reliably)

5. Public Visibility of Data

Dataset metadata submitted to the Metadatabase is publicly accessible and may be indexed by search engines. This may include names of dataset authors as provided in the metadata.

The identity of the user submitting the data (account name and email address) is not displayed publicly.

Users should not submit personal data they do not wish to make publicly available.

6. Data Retention

• Account data is retained as long as the account is active
• If you request account deletion, your personal data will be removed within 30 days, unless retention is required by law
• Submitted dataset metadata may remain publicly available unless removed or modified
• Technical logs are retained only for a limited period necessary for security and operation

7. Data Sharing and Processing

We do not share personal data with third parties for their own purposes.

Personal data is processed by technical service providers strictly for the purpose of operating the service. This includes hosting and email infrastructure (e.g. via cPanel), which act as data processors on our behalf.

8. International Data Transfers

Data may be processed on servers located outside the user's country of residence. Where required, appropriate safeguards are applied in accordance with applicable data protection laws.

9. Cookies

The Metadatabase uses only essential session cookies required for login and operation of the service. No tracking or analytics cookies are used.

10. Your Rights

You have the right to:

• access your personal data
• request correction or deletion
• restrict or object to processing
• request a copy of your data in a structured, machine-readable format (data portability)

Requests can be sent to: admin@opendata.iavs.org

11. Security

We implement appropriate technical and organizational measures to protect personal data. Passwords are stored using secure hashing methods. However, no system can guarantee complete security.

12. Relationship to IAVS Privacy Policy

This notice supplements the IAVS Privacy Policy, which applies to general aspects of the website and infrastructure. In case of conflict, this notice prevails for the Metadatabase.

13. Changes

This notice may be updated periodically. The latest version will always be available on the Metadatabase website.