Privacy Policy
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Prof. Dr. Tom Wagner
August-Bebel-Straße 2
07743 Jena
Germany
The protection of personal data is important to us. Personal data is processed on this website only to the extent necessary for the provision, security and use of the services offered, or where you have expressly consented to additional processing. The specific purposes and legal bases for processing are explained in the following sections. The processing of personal data is based in particular on Article 6 GDPR and, where information is stored on or accessed from your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
We take appropriate technical and organisational measures to protect personal data processed through SPACELABS against loss, manipulation, unauthorised access and other forms of misuse. However, complete protection of data transmitted over the internet cannot be guaranteed.
This website is hosted by:
STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany
As part of the hosting services, STRATO processes data that is technically necessary to provide the website and ensure its secure operation. In this context, STRATO acts as a processor. When you access this website, the servers process technical access data. This may include, in particular, the IP address, date and time of access, the page or file accessed, the amount of data transferred, browser type and version, operating system, referrer URL and the requesting internet service provider. Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically error-free provision of this website and in detecting and preventing attacks. STRATO states that IP addresses are stored for a maximum of seven days for the purpose of detecting and preventing attacks.
This website uses Borlabs Cookie to obtain, store and manage your consent to the use of certain services. Borlabs Cookie stores, in particular, information about the consent you have given or refused, the cookie version, the website domain and path, the lifetime of the cookie and a randomly generated identifier. According to Borlabs, no visitor data is transmitted to Borlabs. Storing your consent decision is necessary so that your choice can be taken into account on subsequent visits and so that any consent given can be documented. Article 7(1) GDPR requires the controller to be able to demonstrate that consent has been obtained. Where such storage is technically necessary, it is carried out pursuant to Section 25(2)(2) TDDDG. The associated processing of personal data is based in particular on Article 6(1)(c) GDPR. You may change or withdraw your consent at any time with effect for the future via the cookie settings on this website.
Technically necessary cookies and comparable storage technologies are used to operate the website. These include, in particular, storage of your cookie preferences and technically necessary functions of WordPress, language management and, where applicable, login to a SPACELABS user account. When EVA is used, a randomly generated access token is also stored in the browser’s session storage after successful validation of an access code. This token is used solely to authorise the current EVA session with the server. The access token is retained only for the duration of the relevant browser session or until the EVA access expires. The original six-character access code is not used as a permanent identifier for the EVA session after successful validation. These technologies are not used for advertising or profiling purposes. Where their use is strictly necessary to provide functions expressly requested by you, no consent is required under Section 25(2)(2) TDDDG.
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is used to statistically analyse the use of this website. In particular, information about page views, sessions, approximate geographic location and browser and device information may be processed. Google Analytics uses, among other things, first-party cookies to distinguish between users and sessions.
Google Analytics is activated on this website only after you have expressly consented to the “Statistics” category. Without this consent, the Analytics code is not loaded and no Analytics requests are initiated by this website. The legal basis for the processing of personal data is Article 6(1)(a) GDPR. Where cookies or comparable technologies are used on your device, this takes place on the basis of your consent pursuant to Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie settings. For access from the European Union, Google states that IP addresses are not logged or stored. The IP address is initially processed to derive approximate location information and is then discarded. The retention period for user and event data in our Google Analytics property is 2 months. Aggregated standard reports may remain available independently of this retention period. When using Google Analytics, processing of data outside the European Economic Area, in particular in the United States, cannot be ruled out. Google LLC states that it is certified under the EU-U.S. Data Privacy Framework and relies, among other things, on this adequacy mechanism for relevant data transfers.
This website uses Adobe Fonts to provide the fonts used on the website. The provider for users outside North America and Japan is Adobe Systems Software Ireland Limited. When you access a page, your browser establishes a connection to Adobe’s servers in order to retrieve the required fonts. In doing so, information such as the fonts used, the web project ID, embedding type, account ID, hostname of the website accessed and the IP address may be processed. Adobe states that the IP address is received for delivery of the font file but is not stored. According to Adobe, Adobe Fonts does not set cookies when providing web fonts. Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in providing a consistent, technically reliable and visually coherent presentation of our online services. Adobe may also process personal data in countries outside the European Economic Area. Adobe describes, among other things, adequacy decisions and standard contractual clauses as safeguards for such transfers.
If you contact us by email, the data you provide will be processed in order to handle your enquiry. This includes, in particular, your email address, the content of your message and any other information you voluntarily provide. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in processing and responding to enquiries. Where the contact relates to the initiation or performance of a contractual or user relationship, Article 6(1)(b) GDPR may also apply. The data will be deleted once it is no longer required for processing your enquiry and provided that there are no statutory retention obligations or other legitimate grounds for continued storage.
SPACELABS offers registered users the option to subscribe to an email newsletter. The newsletter is sent at irregular intervals and provides information in particular about new and revised simulations, teaching materials and other developments at SPACELABS.
Subscription to the newsletter is voluntary and is not a requirement for creating or using a SPACELABS user account. The corresponding consent option is not preselected during registration.
We use a double opt-in procedure. If you subscribe to the newsletter, we first send an email to the email address associated with your SPACELABS user account. The newsletter subscription becomes active only after you follow the confirmation link contained in that message.
In connection with the newsletter, the following information is processed in particular:
- the email address associated with the SPACELABS user account,
- first name and surname, where available,
- newsletter subscription status,
- the time the subscription was requested and confirmed,
- where applicable, the time of unsubscribing,
- the language of the subscription,
- the source of the subscription, for example registration or the profile area,
- the version of the consent text used at the time of subscription.
This information is used in particular to manage the newsletter subscription and to document that valid consent was obtained.
The newsletter is delivered using the email service Brevo. Depending on the contractual entity responsible for our Brevo account, services may be provided by companies within the Brevo group, in particular Sendinblue SAS or Brevo GmbH. Brevo processes the data required for newsletter delivery on our behalf. This includes in particular the email address, name, language-related information, the individual unsubscribe link and the message data required for delivery.
Brevo states that the databases used for its services are operated within the European Union. Processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.
Newsletter delivery is based on your consent pursuant to Article 6(1)(a) GDPR. Information required to document and demonstrate consent is stored on the basis of Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.
You may withdraw your consent at any time with effect for the future. You can unsubscribe through your personal SPACELABS profile area or by using the unsubscribe link contained in every newsletter email. No SPACELABS login is required to unsubscribe using the newsletter link.
After unsubscribing, you will no longer receive the newsletter. Information relating to the previously granted and subsequently withdrawn consent may continue to be stored where necessary to demonstrate the proper operation of the consent procedure and the withdrawal.
SPACELABS currently does not use its own open or click tracking to analyse the individual reading or clicking behaviour of newsletter recipients.
Ein letzter organisatorischer Punkt: Prüfe im Brevo-Konto bitte noch einmal, dass der DPA/AVV für dein Konto akzeptiert bzw. Bestandteil deiner Vertragsunterlagen ist. Brevo verweist selbst auf diesen Vertrag in seinen Terms.
Dann ist der Datenschutzstand für den Newsletter aus meiner Sicht konsistent mit dem, was wir technisch tatsächlich gebaut haben.
Teachers may create a personal user account on SPACELABS. The user account is used in particular to access and manage teacher-related functions and to enable EVA for groups of learners. When registering, the following information is processed in particular:
- first name and surname,
- email address,
- school or institution,
- city and postal code of the school or institution,
- country,
- federal state or region,
- technical account data such as the time of registration and the status of email verification.
The password you choose is not stored in plain text. Password management is handled using the security mechanisms provided by WordPress; only a cryptographic password hash is stored. A verification email is sent to activate a new user account. In addition, emails may be sent at your request for re-verification or password reset. The processing takes place in order to provide and manage the user account requested by you and is based on Article 6(1)(b) GDPR. Account data is generally stored for as long as the user account exists. Teachers may permanently delete their SPACELABS account through their personal profile area. In doing so, SPACELABS access codes, learning spaces and related usage events associated with the account are also deleted, unless statutory obligations prevent deletion.
To protect SPACELABS against automated registrations, brute-force attacks and other misuse, we use technical security measures. These include in particular:
- invisible input fields to detect automated form submissions (“honeypots”),
- timing-based plausibility checks for forms,
- limits on the number of login, registration, password reset and verification requests within defined periods,
- temporary blocks where an unusually high number of failed access attempts is detected.
For these measures, the IP address of a request is technically processed. For rate limiting, the IP address is not permanently stored in plain text, but is converted into a hash together with a server-side secret value. The corresponding counters and blocking values are retained only for limited periods. In addition, technical security events such as failed login attempts, triggered access restrictions or detected honeypot submissions may be logged without storing the raw IP address. Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in protecting the website, user accounts and the services provided against misuse and unauthorised access.
Registered teachers may enable EVA for individual SPACELABS simulations for a limited period for a group of learners. For this purpose, the following information is processed and stored in particular:
- the user account of the teacher granting access,
- the selected simulation,
- a class or course label entered by the teacher,
- optionally, the expected group size,
- a randomly generated six-character access code,
- the start and end of the validity period,
- the status and time of creation of the access.
Please use only general labels such as “10A” or “Chemistry Advanced Course 12” as class or course names and do not enter the names of individual students. The access may be shared with the group as a code, direct link or QR code. The QR code is generated within SPACELABS; no external QR code service is used. When an EVA access link is used, the access code may initially form part of the URL that is opened. After successful validation, the simulation removes the code from the visible browser address and uses a separately generated access token for the remainder of the EVA session. Processing is carried out to provide the access functionality requested by the teacher on the basis of Article 6(1)(b) GDPR and, with regard to secure operation and technical development of the functionality, on the basis of Article 6(1)(f) GDPR.
SPACELABS records certain technical usage events in order to provide teachers with information about the use of the EVA access they have enabled and to analyse and further develop the technical and educational functions of SPACELABS. The following events may be recorded in particular:
- creation, deactivation or expiry of an access code,
- successful or rejected validation of an access code,
- start of an EVA session,
- first use of EVA within a session,
- further messages within an EVA session,
- end of an EVA session.
For students, no names, email addresses or user accounts are collected. An EVA session is assigned only a randomly generated technical session identifier. However, usage events may be associated with the user account of the teacher granting access, the access itself, the simulation used and school location information associated with the teacher’s account, in particular federal state or region, city, postal code and country. The content of questions submitted to EVA or responses generated by EVA is not stored as part of these usage statistics. Only the fact that the relevant interaction took place is recorded. Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in making the use of the provided functions transparent, ensuring their technical operation and further developing SPACELABS for scientific and educational purposes.
SPACELABS provides the AI-based learning support system EVA – Explore. Understand. Apply. in selected simulations. Students do not need their own SPACELABS user account to use EVA. EVA may be enabled for the relevant simulation using access provided by a teacher. When you send a message to EVA, the message you enter and information from the current state of the simulation that is relevant to answering your question are processed. This may include, for example:
- the selected simulation,
- experimental conditions and settings,
- simulation time,
- measured values and calculated quantities,
- chart and curve data,
- the current state or section of the simulation,
- a limited portion of the previous EVA conversation.
This contextual information enables EVA to relate questions to the specific experimental situation and the data observed by the learner. The dialogue messages displayed during the current use of EVA are not permanently stored by SPACELABS as a chat transcript in the WordPress database. A limited part of the current dialogue is retained in the browser during the active session and is transmitted again with subsequent EVA requests as conversational context.
Verarbeitung durch OpenAI
To generate an EVA response, the message, the required conversational context and relevant simulation information are transmitted server-side to the OpenAI API.
For customers established in the European Economic Area, OpenAI’s current Data Processing Addendum identifies OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland as the relevant contracting entity for data processing.
Communication with OpenAI takes place exclusively server-side. The API key required to use the OpenAI API is not transmitted to the user’s browser. SPACELABS requests responses from the OpenAI API with persistent response storage disabled (store: false). OpenAI states that API inputs and outputs are not used by default to train or improve its models, unless the API customer has expressly opted in to such data sharing. OpenAI also states that, under standard API usage, input and output data may be retained for up to 30 days for safety and abuse monitoring, unless a longer retention period is legally required. EVA is not intended for the processing of personal or particularly sensitive information. Please therefore do not enter names, email addresses, contact details, health information or any other personal or confidential information about yourself or other individuals into EVA. Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in providing interactive, simulation-based learning support and in the development of digital tools for chemistry education. EVA is not used for automated grading, performance decisions or other decisions that produce legal effects or similarly significantly affect students.
After successful validation of an EVA access code, SPACELABS generates a random technical session identifier and a separate access token. The server associates the EVA session in particular with the relevant simulation, the authorised access, the session identifier, the number of EVA messages sent within the session and the expiry time. The access token is stored in the browser’s session storage. It is used solely to authorise subsequent EVA requests within the same session. An EVA session ends no later than when the access enabled by the teacher expires or when the technically defined maximum session duration is reached. This storage is technically necessary to provide the EVA functionality expressly requested by the user and is based on Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.
Unless a specific retention period is stated in this Privacy Policy, personal data is processed only for as long as necessary for the respective purpose. The data is then deleted unless statutory retention obligations or other legal grounds justify continued storage. Data associated with a SPACELABS user account is generally stored until the account is deleted. If the user deletes the account, access codes, learning spaces and related usage events associated with that account are also deleted. Technical rate-limit and session data is stored only temporarily and is automatically removed after expiry.
Subject to the applicable legal requirements, you have in particular the right to:
- obtain information about personal data stored about you,
- have inaccurate data corrected,
- request deletion,
- request restriction of processing,
- receive your data in a portable format.
Where processing is based on a legitimate interest pursuant to Article 6(1)(f) GDPR, you may object to the processing where the statutory requirements are met. You may withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.
Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
This Privacy Policy may be amended where the technical services used, the nature of data processing or the applicable legal framework change.
Last updated: 5 September 2026