Privacy Notice

Mycel UG (haftungsbeschränkt), Kollwitzstraße 76, 10435 Berlin, Germany, e-mail: info@arknexus.eu. Further details are in the Imprint. You can write to us in German or English.

We are the controller for the website arknexus.eu, for user accounts and login, for contact requests and for the security of the platform.

Data in a funder’s tenant, such as expert profiles, proposals, applications, reviews, project reports and financial data, is processed on behalf of that funder. The funder is the controller; we act as its processor under a data processing agreement (Article 28 GDPR). To exercise your rights regarding this data, contact the funder; we help the funder respond. If you do not know which funder is responsible, write to us and we will forward your request.

• Account data: name, e-mail address and your ArkID identifier (ARKU) if you log in with ArkID; your ORCID iD if you link ORCID; the roles a funder grants you; or your e-mail address if you log in with a one-time code.
• Login and security data: login sessions, trusted devices for one-time-code login, and log entries on logins with time and IP address.
• Contact requests: name, e-mail address, organisation (optional), topic and message, plus the IP address and time of submission to prevent misuse, if you use the contact form.
• Server logs: IP address, time, requested address, status code and browser identifier of each request.
• Settings: your language, your display mode and that you have seen the cookie notice.

Where we do not collect data from you directly, we receive it from ArkID or ORCID when you log in through them (name, e-mail address, identifier), or from the funder who invites you (name, e-mail address, role).

You are not obliged to provide personal data. Without your account data, however, you cannot log in, and without a name, e-mail address and message we cannot answer a contact request.

• Purpose

  Providing accounts, login and access to the platform

  Legal basis

  Performance of a contract (Article 6(1)(b) GDPR); where you act on behalf of an organisation, legitimate interest (Article 6(1)(f) GDPR): providing you with the access the funder intends

• Purpose

  Sending one-time codes and service e-mails

  Legal basis

  Performance of a contract (Article 6(1)(b) GDPR)

• Purpose

  Login or linking with ORCID at your request

  Legal basis

  Performance of a contract (Article 6(1)(b) GDPR)

• Purpose

  Answering contact requests

  Legal basis

  Pre-contractual measures where your request concerns a contract with us (Article 6(1)(b) GDPR); otherwise legitimate interest (Article 6(1)(f) GDPR): answering enquiries

• Purpose

  Security of the service and prevention of misuse, including logs

  Legal basis

  Legitimate interest (Article 6(1)(f) GDPR): operating an available, secure service, detecting attacks and preventing misuse

• Purpose

  Handling reports under the Digital Services Act

  Legal basis

  Legal obligation (Article 6(1)(c) GDPR)

• Purpose

  Meeting legal obligations, such as retention duties

  Legal basis

  Legal obligation (Article 6(1)(c) GDPR)

• Purpose

  Storing login, security and settings information on your device

  Legal basis

  Section 25(2) no. 2 TDDDG; related processing: Article 6(1)(b) and (f) GDPR

Funders can use AI features, for example to group proposals and suggest experts. Each funder decides which AI providers its tenant uses and can restrict processing to the European Economic Area. The funder tells you on request which providers these are and where they process data.

In expert matching, the fields for names and contact details are replaced with neutral codes before data goes to an AI provider; the codes are matched back to people only on our servers. Free texts such as short biographies, publication titles or CV excerpts are passed on as entered and may contain names.

AI suggestions are recommendations; people at the funder make the decisions. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

• The funder in whose tenant you work: name, e-mail address, roles and your activity in its tenant.
• Contabo GmbH, Munich: server hosting in a data centre in France, as processor.
• Hetzner Online GmbH, Gunzenhausen: encrypted backups, stored in Finland, as processor.
• IONOS SE, Montabaur: sending e-mails, as processor.
• AI providers chosen by a funder for its tenant, as sub-processors on its instructions.
• ArkID (arkid.org), a login service that we also operate, with its own privacy notice.
• ORCID, Inc., Bethesda (USA), as an independent controller: only if you log in with ORCID or link your account.
• Authorities and courts, where we are legally obliged.

This list is complete for the processing we are responsible for. The sub-processors for data in a funder’s tenant are set out in the data processing agreement with the funder.

We host data in France and back it up in Finland. Data reaches a country outside the European Economic Area in only two cases. If you log in with ORCID or link ORCID, you sign in directly with ORCID, Inc. in the USA; we receive your ORCID iD from ORCID, and ORCID’s privacy notice applies. If a funder chooses an AI provider outside the European Economic Area for its tenant, the transfer is based on an adequacy decision of the European Commission (Article 45 GDPR) or the EU Standard Contractual Clauses (Article 46(2)(c) GDPR). Information on these safeguards is available from the funder or from us at info@arknexus.eu.

• Data

  Accounts

  Retention

  Until you or the funder delete the account

• Data

  Login sessions

  Retention

  Until logout, at most 7 days; up to 30 days after your last visit if you choose to stay logged in; one-time-code logins: 12 hours

• Data

  Trusted devices for one-time-code login

  Retention

  60 days from confirmation of the device

• Data

  Web server access logs

  Retention

  At most 7 days

• Data

  Application logs, including login events

  Retention

  Until overwritten by new entries in ongoing operation

• Data

  Contact requests

  Retention

  Until your request is settled, unless a retention duty applies

• Data

  Data in a funder’s tenant

  Retention

  As agreed with the funder

• Data

  Backups

  Retention

  Deleted step by step, at the latest after 12 months

Statutory retention duties remain unaffected; in that case we restrict processing instead of deleting.

You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Article 7(3) GDPR). Write to info@arknexus.eu.

You can lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example the authority responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

Where we process data on the basis of legitimate interests (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. Send your objection to info@arknexus.eu.

We use only strictly necessary cookies and browser storage for login, security and your settings. Details are in the Cookie Notice.

All connections are encrypted with TLS. Each funder’s data sits in its own tenant with role-based access, backups are encrypted, and important actions are recorded in an audit trail.

We update this notice when the service or the law changes. The current version is always on this page.