Privacy

This notice explains what happens to personal data when you use IMPULSE Curator at https://impulse-bridge.octo-code.de. In short: no tracking, no advertising, no cookies you have to consent to. The site processes what it needs to show you search results from the archives and to keep the collections you create.

1. Controller

Institut für Strategische Ästhetik gGmbH
Contact: see the imprint

2. Hosting and server logs

The Curator runs on a virtual server provided by Oracle, located in Frankfurt, Germany. The hosting provider processes data on our behalf (Art. 28 GDPR).

Whenever your browser requests a page, a search or a file from our server, the server records your IP address, the time, the requested address, the response status and your browser's identification. We use these logs to run the service securely and to find errors. Legal basis: our legitimate interest in a secure, working service (Art. 6 (1) (f) GDPR). The logs are kept in a rotating buffer of at most 30 MB per service; the oldest entries are overwritten as new ones arrive, typically within days.

3. Searching the archives

When you search, our server sends your search terms to the archives' interfaces (Europeana, Wikimedia Commons, Heidelberg University Library and any archive added later) and passes the results on to you. The archives see our server, not your IP address, for these searches.

Preview images and the full-size files, however, load directly from the archives' servers into your browser. The archive then receives your IP address and your browser's identification, but no information about the page you came from (referrerpolicy="no-referrer") and, as a rule, no cookies: images are requested with crossorigin="anonymous". Two archives' image servers refuse such anonymous requests (the Cleveland Museum of Art and The Metropolitan Museum of Art); for them the browser retries the image as an ordinary request, which sends any cookies you may have from earlier visits to that museum's website. This happens only for results that are actually shown to you.

• Europeana Foundation, The Hague, Netherlands (api.europeana.eu) — and, for 3D models, the providing museum's own server (for example mmb.cimec.ro, Romania)
• Heidelberg University Library, Germany (digi.ub.uni-heidelberg.de)
• Statens Museum for Kunst, Copenhagen, Denmark (iip.smk.dk)
• Zenodo, run by CERN in Geneva, Switzerland (zenodo.org), and Wellcome Collection, London, United Kingdom (iiif.wellcomecollection.org) — both countries are covered by an EU adequacy decision
• Wikimedia Foundation, San Francisco (upload.wikimedia.org, thumb.wikimedia.org), the Cleveland Museum of Art (openaccess-cdn.clevelandart.org) and The Metropolitan Museum of Art, New York (images.metmuseum.org) — all in the USA, a country for which the EU has not issued an adequacy decision covering these recipients. Such a transfer happens only when a result from that archive is shown to you; you can avoid it by choosing another archive in the source list.

Legal basis: our legitimate interest in showing you the results you asked for (Art. 6 (1) (f) GDPR). The archives are responsible for the works, descriptions and rights statements they provide; the Curator links to them.

4. Collections you create

A collection consists of the name and description you write, the assets you selected (with a copy of their descriptions from the archive) and the times it was created and changed. It is public at its own address: anyone who has the link can view it, and IMPULSE's software loads it from there. Only someone with the edit link can change it. We keep a collection until you delete it or an administrator removes it. Legal basis: providing the service you asked for (Art. 6 (1) (b) GDPR).

You can give an email address with a collection. It is optional, never shown publicly, and used only for the sign-in and edit-link emails described below.

5. Email and sign-in

If you enter your email address, we send you sign-in links (valid for 15 minutes, usable once) the edit link of a collection you create (and again on request). These emails are delivered through our email service provider, which processes them on our behalf (Art. 28 GDPR).

After you sign in, a session cookie keeps you signed in on that device for 30 days. The cookie holds only a random identifier (HttpOnly); the session itself is stored on our server together with your email address and deleted when it expires or you sign out. This cookie is strictly necessary for the sign-in you requested, so no consent is needed (§ 25 (2) No. 2 TDDDG). Legal basis: Art. 6 (1) (b) GDPR.

6. Storage in your browser

The site keeps a few things in your browser's local storage: the assets you have currently selected, the list of collections you created or opened on this device together with their edit keys, and your appearance setting (light, dark or system). All of this is written only as a result of your own actions and read only by this site to show you your own things; nothing is used for analytics or tracking. You can delete it at any time through your browser's settings. Strictly necessary under § 25 (2) No. 2 TDDDG — no consent required.

7. Submitting a collection to IMPULSE

"Submit to IMPULSE" opens your own email program with a pre-filled message to the IMPULSE team. The Curator does not send that email and does not record it.

8. Reports

If you report a collection, we process your report and the contact details you give to handle it and to tell you the outcome. Legal basis: our legal obligations under the Digital Services Act (Art. 6 (1) (c) GDPR).

9. What we don't do

No analytics, no tracking, no advertising, no third-party scripts, fonts or embeds. The fonts and the 3D viewer's code are served from this site, and the site's content security policy allows scripts only from this site itself. The only connections to other servers are the archive images described above and, when you press "View in 3D", the model file from its archive.

10. Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict its processing, to receive it in a portable format and to object to processing based on our legitimate interests (Art. 15–21 GDPR). To exercise these rights, contact us through the imprint. You also have the right to lodge a complaint with a data protection supervisory authority, for example the one at your place of residence.

11. Changes

We update this notice when the service changes, for example when an archive is added. The date at the top shows the current version.

See also the terms of use and the imprint.