Processing of personal data
This page describes what we learn about visitors to the portal, why, how long we keep it, and what you can do about it.
The portal uses no cookies and stores nothing on your device. That is why there is no consent banner — there is nothing to consent to. The duty to inform remains, and that is what this page is for.
What is processed
| What | Where it comes from | How long | Personal data? |
|---|---|---|---|
| IP address, time, page address, browser type, referring page | web server access log | 14 days, then deleted | yes |
| Visit counts by organisation and day | aggregated statistics | indefinitely | no — the address is resolved to an organisation and discarded, never stored |
| Which pages are read, how people move through the site | web analytics (Umami, run by us) | per the tool’s settings | no — no cookies, no device identifier |
⚠️ An IP address is personal data even when we do not know the name behind it — this follows from the Court of Justice of the EU judgment in C-582/14 (Breyer). A web server access log is therefore processing of personal data, independently of any analytics.
Why we process it
- Operation and security. Without the log there is no way to tell that the server is broken, or to recognise an attack. The overwhelming majority of traffic to this portal today is automated scanning.
- Demonstrating usefulness. The portal is publicly funded and we need to be able to show who uses it — at the level of institutions, not individuals.
The legal basis is the controller’s legitimate interest (Art. 6(1)(f) GDPR) in secure operation and in evaluating the usefulness of the service.
What we deliberately do not do
- ⛔ We do not track individual visitors across visits or across sites.
- ⛔ We do not pass data to third parties. The analytics runs on our own server, not at an external service — the data does not leave it.
- ⛔ We do not profile and do not make automated decisions.
- ⛔ We do not store IP addresses in the statistics. An address is resolved to an organisation (for example “Charles University”) and only counts are kept.
How long
The access log is deleted after 14 days. Aggregated counts by organisation are kept indefinitely — they are not personal data, because nothing in them leads back to a particular person or device.
Your rights
You have the right of access to your data, to rectification or erasure, to restriction of processing, to object to processing based on legitimate interest, and to lodge a complaint with the Czech Data Protection Authority.
⚠️ A practical note: we cannot find your records in the access log unless you tell us the IP address and roughly when you visited — we keep nothing else that could be searched on. That is a consequence of not collecting more than we need.
Controller and contact
The portal is operated by the Institute of Molecular Genetics of the Czech Academy of Sciences as part of the ELIXIR IMPACT2 project.
Contact for matters of personal data processing: Mgr. Jan Pačes, Ph.D. — hpaces@img.cas.cz