Privacy Notice

1.Controller and contact

The controller responsible for processing personal data on world-wide.org is:

Science Communications Worldwide
Science Communications Worldwide - Verein zur weltweiten Verbreitung wissenschaftlicher Kommunikation
ZVR 1255966019
c/o Tim Vogels, Fischergasse 6, 3400 Klosterneuburg, Austria

For all privacy matters, including exercising your rights under Section 10, contact info@world-wide.org. The association is not legally required to appoint, and has not appointed, a data protection officer; privacy requests are handled by the association’s board through the address above.

2.Scope of this notice

This notice covers the World Wide platform at world-wide.org, including its domain-branded areas (for example World Wide Neuro), its conference portals (for example the FENS 2026 ePoster portal), and its APIs. It covers both people who hold an account and people whose personal data appears in research content we host (see Section 3.3). Conference- or campaign-specific terms, such as the FENS 2026 ePoster posting terms, supplement this notice for those submissions.

3.Data we process and where it comes from

3.1 Account and profile data

World Wide has no passwords. You sign in with Google or with a passkey stored on your device; no other identity provider is offered at present, and this notice will be updated before any is added. When you first sign in with Google we receive your Google account identifier, your name, and your email address. If you create an account with a passkey instead, we ask for your name and email address and send a code to confirm the address. We store your name and email address in your account record, and we keep the link to a Google account in the form of the provider’s identifier and a keyed hash of the provider-side email address, so that the same Google account is recognised on later sign-ins. Passkey sign-in stores a public-key credential, never a password. Each signed-in device is recorded as a session holding keyed hashes of its network address and browser string, a hash of its sign-in token, the sign-in method, and when it was created and last used; you can see and end these sessions under Settings → Security. If you add an authenticator app to confirm sensitive account actions, its secret is stored encrypted. At account setup we record which versions of the Terms & Conditions and this notice you accepted, and when; when you accept the Content Posting and Use Policy on a posting form, we record its version in the same way.

At account setup you also choose your fields and, if you wish, your career stage and research interests. They stay private and are stored with your account; your fields and career stage are also kept in two cookies on your device (see the Cookie Policy). If you add a separate address for messages, we store it once you have confirmed it. When you save an item, we store which item it is and when you saved it; your Library lists saved items, saved talks drive your reminders, and a dated item offers its date as a calendar file you download.

Everything beyond that is up to you. Your public profile can hold, if you add it: display name, photo and banner, position, affiliation, department, education, biography, research interests and expertise, publications, ORCID iD and other links, a public email address, city, and country. A new profile stays hidden until you publish it under Settings → Public profile. Under Settings → Opportunities you can also record career details — for example the positions and places you are looking for, availability, salary expectations, work authorisation, skills, degree, and CV documents. Career details appear on your public profile only if you list yourself, which requires our approval, and a CV you mark as public is linked from your profile.

3.2 Content you submit

Listings you post — such as talks and seminar series, conferences, workshops, jobs, funding calls, podcasts, and conference abstracts and posters — are stored together with the submission record. Where a listing names other people — speakers, instructors, organisers, co-authors — you are providing personal data about third parties and must be entitled to do so. Uploaded files are isolated and checked for malware before they are published or delivered. World Wide does not take job applications: a job page links to the employer’s own application page or address. Applications made through an earlier version of World Wide remain visible to the employer that received them. Likes, reposts, and comments you leave on profile updates are stored with your account. Reports, feedback, and support messages you send us are stored with the request, together with an email address if you give one.

3.3 Data about people who do not use World Wide

World Wide is a directory of public research activity, so it also contains personal data that we did not obtain from the person concerned (Article 14 GDPR). This falls into five groups:

• Imported listings. Seminar, conference, workshop, job, grant, and podcast announcements ingested from public sources (institutional websites, funder databases, event pages) can include the names and affiliations of speakers, organisers, and contacts as published there. We record the source of each imported item.
• Conference programme data. Conference organisers provide us with programme and abstract data — author names, affiliations, and contact addresses — so that accepted work can be hosted and, where authors request it, made citable. We may contact listed authors about their own submission (for example, to let them claim or manage their poster).
• Person pages. A person page lists the public talks, posters, and podcast episodes on World Wide that name someone, with the affiliation each listing gives. It is assembled from World Wide’s own listings by exact name, so people who share a name appear on the same page.
• DOI metadata. Where a DOI is registered for hosted work, its identifier and bibliographic metadata are distributed through DataCite. The DOI is intended to remain resolvable, including through a tombstone if the work is withdrawn; that persistence does not make inaccurate or unlawfully retained personal metadata immune from correction, restriction, or erasure (see Sections 7, 9, and 10).
• Feeds and partners. Public listings, with the names and affiliations they give, are also distributed through calendar feeds, the read-only public API, and a feed of upcoming neuroscience seminars that The Transmitter (thetransmitter.org) shows on its site.

The data in these groups is limited to professional, publicly presented information. If you are named on World Wide and want your entry corrected, restricted, or removed, contact info@world-wide.org — Section 10 applies to you in full.

3.4 Technical, security, and operational data

Operating a public platform requires technical records. They differ in what they contain:

• Perimeter records. Every request passes our content delivery network, web application firewall, and load balancer. Firewall logs contain the full IP address of the requesting device, the requested address, the request headers your browser sends except cookies and sign-in credentials (logs written up to 2 October 2026 may also contain cookies), the response, and the country, and are kept for 7 days. Load-balancer access logs contain the requested address, the browser identification string, the response status, and timings, and are kept for 90 days; the network address they record is our content delivery network’s, not yours. The content delivery network itself keeps no access logs. These records are used to detect and block abusive or automated traffic, investigate security and reliability incidents, and attribute errors. They are stored separately from product analytics and may be correlated with other records when an incident requires it.
• Request traces. To find slow or failing requests, about 3% of requests are traced (AWS X-Ray). A trace records the requested address without its query string, the browser identification string, and timings, and is kept for 30 days. It does not contain your IP address. Traces recorded before this version of the notice took effect also contain the full requested address and the IP address; each expires 30 days after it was recorded.
• Application records. Inside the platform itself, network addresses are stored as keyed hashes of the full address, in some records together with a truncated network prefix; raw IP addresses are used transiently for request delivery, rate limiting, and security checks without being written to our database. Logs of automated traffic that we slow down record the network address it comes from and are kept for 7 days. Country is supplied as a coarse request header by our content delivery network rather than inferred by an external geolocation service. Security-relevant events (sign-in attempts, security-setting changes, administrative actions) are written to an append-only audit trail, and calls to our APIs are recorded in operational logs kept for 7 days, both with hashed network identifiers. Browser security reports (Content Security Policy violations) record the page and the blocked resource, not who you are.
• Error reports. When the server fails unexpectedly, a sanitised report — the error type and message, the code location, the runtime, and the release, without request contents, headers, or account details — is sent to PostHog so that we can fix the fault. These reports do not depend on your analytics choice.

3.5 Optional analytics (only with consent)

If — and only if — you accept analytics in the cookie banner or on the Cookie Policy page (or under Settings → Privacy & data), we measure how the platform is used: pages viewed (the page path and the names, never the values, of query parameters), the referring site, search terms entered, time on page and scroll depth, product interactions such as sharing or saving, audio and video playback, which suggested items were shown and opened, form use and errors, clicks on links to external sites (destination site and page only, never query parameters), performance timings, and the campaign or channel (UTM parameters) a visit arrived from. These records use a random session identifier (30 minutes of inactivity, at most 24 hours) and a random consented browser identifier lasting up to 180 days. Keyed hashes of the browser and, when signed in, your account identifier recognise return visits. Analytics identities are not derived from network addresses or device characteristics. Withdrawal, sign-out and account changes remove the browser identifier. Separate aggregate server request counters contain only consent state, coarse browser/bot category and conference versus other pages, with no visitor, account, IP or page address; they do not track visits across days. Country-level location comes from our content delivery network; no external IP-geolocation service is used. With the same consent, the consent-gated Google Analytics described in the Cookie Policy runs in parallel. After our first-party database accepts a page view or a selected, high-signal product event, our server also sends PostHog a pseudonymous copy containing the event name, the page address for public pages (generalised routes for others), the kind of page, the type of item and its scientific field, how the page was reached, the referring site’s domain and campaign on the first page of a visit, coarse technical context, and hashed entity references. The copy excludes search text, form content, query strings, raw account, session, and content identifiers, email addresses, and IP addresses. For a signed-in account, these copies and earlier consented activity associated with the same browser identifier are linked to one pseudonymous PostHog person record; anonymous copies create none. This recognises an account or browser, not a unique individual. Separately, PostHog session replay runs in your browser only after the same consent and only on approved public, non-sensitive pages. It records visible public-page text and layout, pointer interaction, and navigation, and marks each page of a recording with its address, without any referrer, search terms, query string, or fragment. All form inputs, selects, and textareas are masked in the browser before transmission; forms, dialogs, account menus, file and hidden inputs are blocked; query strings and fragments are removed; and account, sign-in, administration, Library, calendar, settings, employer, submission, upload, contact, and support routes are excluded. Network bodies and headers, console logs, canvas content, cross-origin frames, automatic product events, and heat maps are disabled. With the same consent, the browser library reports unexpected script errors on those public pages: the error type, message, and code location. Delivering a replay request necessarily exposes your IP address and basic request metadata to PostHog, but World Wide does not add the IP address to the replay payload, and replay creates no PostHog person profile. If you browse with analytics consent and then sign in, the pages you viewed in the preceding 7 days are linked to your account. Declining or withdrawing analytics stops first-party measurement, provider event copies, pageviews, and replay, and never limits the platform.

3.6 Advertising campaigns and attribution

World Wide displays no advertising and sets no advertising cookies. We may occasionally buy search advertising (Google Ads) to make the platform known to researchers. Such campaigns bring visitors to world-wide.org through links that carry campaign parameters in the address. If you have accepted analytics, those parameters are recorded as the source of your visit — that is how we judge whether a campaign was worthwhile. No advertising tag, conversion pixel, or remarketing code runs on the platform. Consented Google Analytics receives page views, engagement, clicks on outbound links, sign-ups and sign-ins, saves, searches (never their words) and calendar clicks, together with the source of the visit, never what you post. Google Analytics runs here with advertising storage, signals, and personalisation disabled. Without analytics consent, a visit from an advertisement leaves no trace beyond the perimeter records described in Section 3.4.

3.7 Cookies and device storage

The cookies and material browser-storage categories the platform uses, together with their purposes and lifetimes, are documented in the Cookie Policy, together with the control for changing your choice at any time.

3.8 Email and notifications

We currently send email only to confirm an address: the code that confirms your email address when you create an account with a passkey, and the confirmation of a separate address for messages if you add one. Email is delivered through Amazon Simple Email Service from our EU hosting region. Inside World Wide you receive notifications — for example reminders for talks you saved, which are on by default and can be turned off under Settings → Notifications. If you set up keyword alerts or followed series before those features were removed in September 2026, notifications about matching listings can still appear. We do not send advertising on behalf of third parties.

4.Purposes and legal bases

Where we rely on legitimate interests (Article 6(1)(f)), we have balanced those interests against your rights, limited the data involved (professional context, pseudonymisation of technical identifiers inside the platform, short retention of perimeter records), and you may object at any time as described in Section 10.

5.AI-assisted processing

World Wide uses machine-learning services to make research content discoverable. In concrete terms: an announcement you paste into a posting form can be parsed to pre-fill it; topic tags and field classifications are suggested for listings, including imported ones; summaries of seminars posted on World Wide, and some topic descriptions, are generated; submissions are screened for policy violations, with human review available for contested outcomes; and the text of listings — and of your profile if you have one, including the contents of a CV you upload — is converted into numerical representations (embeddings). Listing embeddings find related listings and order personalised calendar feeds; profile embeddings are not used by any current feature. Search matches words and does not use embeddings. Every model response is checked by rules and by a second model before it is used, and administrators can have a model summarise a small set of recent log and audit entries while investigating a problem. Decorative artwork for scientific fields is generated from text prompts that contain no personal data.

Text generation and analysis use OpenAI models hosted by Amazon Bedrock. AWS processes these inputs and outputs; OpenAI does not receive them through this route. Global inference can process content outside the EU, including the United States. We disable Responses application-state storage with store: false. This is not a promise of zero retention: AWS may retain flagged traffic for up to 30 days for abuse detection. Embeddings are currently computed with Amazon Titan Text Embeddings on Amazon Bedrock in the EU (Ireland) region; we can switch them back to OpenAI’s embedding service, which would then receive the same text. Image generation for field artwork uses the direct OpenAI API when it runs; its prompts contain no personal data. Under OpenAI’s standard terms, API content is not used for model training unless the customer opts in, and abuse logs may be retained for up to 30 days. World Wide has no special zero retention agreement. We send only content needed for the task, which may contain personal data in a submission, profile, or CV. Credentials and analytics records are not sent as model inputs. Uploaded recordings are not automatically transcribed.

What AI is used for, its limits, and how to report problems with machine-generated content are described in the AI Transparency Statement.

6.Recommendations and personalisation

World Wide personalises only by ordering or filtering public content:

• The fields and career stage you choose decide which field opens first and narrow your field page's sections, and Jobs and Funding offer your stage as a filter you can apply, whether you choose them while signed out (kept in cookies) or in your account.
• If you choose Use my interests when subscribing to a seminar calendar, the subscription address carries a numerical summary of the items you saved and liked, and the feed is ordered by it. Your calendar service stores that address and sends it each time it refreshes the feed; it contains no name or account identifier.
• Related listings on a page are chosen by their similarity to that page, not by your activity.

Personalisation only orders and filters content; it produces no legal or similarly significant effects, and no advertising. You can use every content surface without signing in.

7.Recipients and processors

Where a provider acts as our processor, the processing is governed by Article 28 GDPR terms. Some named recipients instead act as separate controllers for their own service, as the table states. We do not sell personal data or share it with advertising networks.

8.International data transfers

The platform is hosted in the European Union (AWS region eu-west-1, Ireland). Some data reaches other countries:

• Amazon Bedrock. Text-model requests enter through Ireland and use global inference profiles. Processing and applicable abuse-detection retention may occur in other AWS regions, including outside the EEA. The AWS data processing terms govern these transfers; the Ireland endpoint does not guarantee EU-only processing.
• United Kingdom. The legacy poster archive named in Section 7 is stored in AWS’s London region. The United Kingdom benefits from an EU adequacy decision (Article 45 GDPR), renewed by the European Commission in December 2025.
• United States. Google LLC, PostHog, Inc., and Amazon Web Services, Inc. process the limited data described in Section 7 in the United States. Where the relevant recipient is currently certified, the EU–U.S. Data Privacy Framework applies; otherwise the provider terms use the European Commission’s Standard Contractual Clauses or another lawful safeguard. A framework listing or group certification is not a blanket statement about every transfer.
• OpenAI processing takes place in part in the United States. Today it covers only image-generation requests, which contain no personal data. OpenAI’s data processing addendum uses an adequacy decision or the EU Standard Contractual Clauses (Article 46(2)(c) GDPR), as applicable, for onward transfers.
• Your browser’s requests to map-tile services (when a page shows a map), Google Maps (in posting forms), image hosts (when a page shows their images), and video platforms (only when you start a recording) may reach servers outside the EEA.

Copies of the relevant safeguards can be requested via info@world-wide.org.

9.Retention

We keep personal data no longer than the purpose requires; the Data Retention & Deletion Policy lists the concrete periods. The key points:

• Account data is kept while your account exists. Deleting your account starts a 30-day restoration window, after which identity data is erased or irreversibly de-linked.
• Published research content forms a scholarly record and can outlive an account in de-identified or attributed form as appropriate; a DOI remains resolvable by design, while associated metadata can be corrected, restricted, or reduced where applicable rights require it. Withdrawn material resolves to a tombstone.
• Automated backups of the production database are retained for 7 days. Manual recovery snapshots can remain longer while a migration, recovery, or documented legal hold requires them. Application, worker, and API logs are kept for 7 days; firewall logs for 7 days; request traces for 30 days; load-balancer access logs for 90 days; build logs for up to 30 days.
• Raw opt-in analytics records are pseudonymised at collection and deleted automatically after 26 months by a daily audited job. Aggregate content metrics and consent records are excluded from that purge; consent evidence is kept as long as needed to demonstrate compliance.

10.Your rights

Under Articles 15–21 GDPR you have the right to:

• Access (Art. 15) — obtain confirmation and a copy of your personal data;
• Rectification (Art. 16) — have inaccurate data corrected; most profile data you can edit directly in your settings;
• Erasure (Art. 17) — have data deleted; account deletion is available self-service under Settings → Privacy & data and follows the process in the retention policy;
• Restriction (Art. 18) — have processing limited while a dispute is resolved;
• Portability (Art. 20) — receive data you provided in a machine-readable format. A self-service JSON export is available in Settings → Privacy & data and covers your account and sign-in records, every profile field including career details, skills, and links, settings, saved items, content and submissions, comments, alerts, applications, attendance, consent, and attributable analytics. You can also request an export by email;
• Objection (Art. 21) — object, on grounds relating to your particular situation, to processing based on legitimate interests, including the third-party listings described in Section 3.3.

Where processing is based on consent, you may withdraw it at any time with effect for the future — for analytics, directly on the Cookie Policy page. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any right, email info@world-wide.org. We normally respond within one month (Art. 12(3) GDPR). For a complex request or several requests, the GDPR permits an extension of up to two further months; if that is necessary, we will tell you within the first month and explain why. We may need to verify that a request really comes from you. Exercising your rights is free of charge, except where the GDPR permits a reasonable fee for manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence or workplace. For Austria:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42, 1030 Vienna, Austria
Tel. +43 1 52 152-0 · dsb@dsb.gv.at · dsb.gv.at

If you are in the United Kingdom, the UK GDPR gives you equivalent rights, which you exercise through the same address; complaints can be lodged with the Information Commissioner's Office (ICO).

11.Automated decision-making

Automated systems assist with content screening and ranking, and rules can approve or reject a submission. These decisions affect publication on World Wide. You can contest an outcome and request human review using the report controls or by contacting us. If you believe a decision has legal or similarly significant effects on you, explain those effects so we can assess the applicable Article 22 GDPR rights and safeguards.

12.Children

World Wide addresses the research community and is not directed at children. As a product rule, accounts require a minimum age of 14. Separately, § 4(4) DSG sets 14 as Austria’s threshold for a child to consent independently to information-society services where consent is the applicable legal basis. We do not knowingly permit younger children to create accounts; contact us if you believe one has done so.

13.Security of processing

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), including HTTPS for public connections and certificate-verified TLS for database connections, passwordless sign-in with passkeys, an optional authenticator app for sensitive account actions, least-privilege access to production systems, malware scanning of uploads before publication or delivery, pseudonymisation of network identifiers inside the platform, append-only security audit trails, and regular backups. Details that would aid attackers are not published; the Security & Responsible Disclosure page describes our practices and how to report vulnerabilities. In the event of a personal-data breach we will notify the supervisory authority and affected people where Articles 33 and 34 GDPR require it.

14.Whether you must provide data

You can read everything on World Wide without an account. An account requires a sign-in identity — a Google account, or a passkey together with your name and a confirmed email address — and confirmation that you are at least 14; without these we cannot operate the account. All profile fields beyond that are voluntary. Posting a listing requires the information needed to publish it. There is no statutory obligation to provide us with any data.

15.Changes to this notice

We update this notice when the platform or the law changes; the effective date and version above identify the current revision. For material changes affecting account holders we will provide notice through the platform or by email. Earlier versions are available on request.