Privacy Policy

1. Introduction

The SITES Spectral Thematic Center ("we", "us", "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect information when you use the SITES Spectral Instruments Registry ("the Service").

Our mission is to support SITES field stations in their ecosystem research and to fulfill our commitment to FAIR (Findable, Accessible, Interoperable, Reusable) and Open Science principles, following the guidelines of Lund University and the Swedish Infrastructure for Ecosystem Science.

2. Data Controller

The data controller for the SITES Spectral Instruments Registry is:

3. Purpose of Data Collection

We collect and process data for the following purposes:

• Station Support: To provide technical support and coordination services to SITES field stations
• Instrument Management: To maintain an accurate registry of spectral instruments across the SITES network
• Quality Assurance: To ensure data quality and calibration tracking for ecosystem monitoring
• Research Coordination: To facilitate collaboration between stations and researchers
• FAIR Data Compliance: To support open science and data sharing according to FAIR principles
• Service Improvement: To improve the functionality and user experience of our platform

4. Data We Collect

4.1 Account Information

• Username (typically station-based, not personal names)
• Role and permissions within the system
• Station affiliation

4.2 Instrument and Station Data

• Instrument specifications and configurations
• Calibration records and maintenance logs
• Geographic coordinates of stations and instruments
• Regions of Interest (ROI) definitions

4.3 Technical Data

• IP addresses (for security and access logging)
• Browser type and version
• Access timestamps
• Activity logs for audit purposes

4.4 Cookies - Essential Only

Cookie used:

• sites_spectral_auth - Authentication session cookie (httpOnly, Secure, SameSite=Strict)

Cookie security features:

• httpOnly: Cannot be accessed by JavaScript (prevents XSS attacks)
• Secure: Only transmitted over HTTPS
• SameSite=Strict: Prevents CSRF attacks
• Expires: 24 hours (session-based)

We do NOT use:

• Tracking cookies
• Analytics cookies
• Third-party cookies
• Advertising cookies

5. Legal Basis for Processing (GDPR Article 6)

We process your data under the following legal bases:

• Legitimate Interest (Art. 6(1)(f)): To support the scientific mission of SITES and ecosystem research
• Public Task (Art. 6(1)(e)): As a university infrastructure supporting publicly funded research
• Consent (Art. 6(1)(a)): Where applicable, for optional features or communications

6. Data Sharing and Recipients

We may share data with:

• SITES Network: Station data is shared within the SITES infrastructure network
• Lund University: As our host institution for administrative purposes
• Research Partners: Aggregated, anonymized data for research collaboration
• Technical Providers: Cloudflare (hosting) under appropriate data processing agreements

7. Data Retention

• Account Data: Retained for the duration of your station's participation in SITES
• Instrument Records: Retained indefinitely for scientific continuity and data provenance
• Access Logs: Retained for 12 months for security purposes
• Activity Logs: Retained for 24 months for audit and quality assurance

8. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Request correction of inaccurate data
• Right to Erasure (Art. 17): Request deletion of your data (subject to research retention requirements)
• Right to Restriction (Art. 18): Request limitation of processing
• Right to Data Portability (Art. 20): Receive your data in a portable format
• Right to Object (Art. 21): Object to processing based on legitimate interest

To exercise these rights, contact us using the details below.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encrypted data transmission (HTTPS/TLS)
• Secure authentication with httpOnly cookies
• Password hashing using PBKDF2 with SHA-256
• CSRF protection on all state-changing operations
• Input sanitization to prevent injection attacks
• Rate limiting to prevent brute force attacks
• Regular security audits and updates

10. International Data Transfers

Our service is hosted on Cloudflare infrastructure with data centers in the EU. We ensure that any data transfers outside the EU/EEA comply with GDPR requirements through appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Significant changes will be communicated through the Service. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact Information

13. Acknowledgments

SITES Spectral is part of the Swedish Infrastructure for Ecosystem Science (SITES), funded by the Swedish Research Council and participating universities. We are committed to supporting excellent ecosystem research while respecting privacy and data protection principles.