Controller

The controller for the processing described in this policy is Antonios Karvelas, Dimarhou Skoura, 34100 Chalkida, Greece (the “Operator”), who may be contacted at ant.karvelas@pm.me.

No data protection officer has been designated. The Operator's processing does not meet the conditions in Article 37(1) of the Regulation, and designation is accordingly not required.

Scope

This policy applies to personal data processed through the website at articulivitales.com (the “Service”). It applies both to visitors who do not hold an account and to registered account holders (each, a “User”).

Categories of data, purposes, legal bases and retention

Category of data	Purpose of processing	Legal basis	Retention period
Username and password	Creation and authentication of a User account. The password is stored as a cryptographic hash and is not recoverable in plaintext.	Art. 6(1)(b), performance of a contract	Until deletion of the account
Email address, where supplied	Transmission of password reset links. Supply is optional. The address is not used for any other purpose, including notification or marketing.	Art. 6(1)(b), performance of a contract	Until removal by the User, or deletion of the account
Records of articles opened, frequency of access, and completion of reading	Provision of the reading-progress functionality that constitutes the Service.	Art. 6(1)(b), performance of a contract	Until deletion of the account
Bookmarks, saved passages and associated notes	Provision of the annotation functionality. Saved passages include a limited quantity of surrounding text to permit the passage to be located again following amendment of the source article.	Art. 6(1)(b), performance of a contract	Until deletion by the User, or deletion of the account
Assessment records: questions presented, answers submitted, scores and timestamps	Scoring of assessments, prevention of repeated presentation of the same questions, and application of the interval imposed following an unsuccessful attempt.	Art. 6(1)(b), performance of a contract	Until deletion of the account
Reports submitted in respect of defective assessment questions	Identification and correction of defective questions, and prevention of duplicate reports by the same User.	Art. 6(1)(f), legitimate interests in maintaining the accuracy of the Service	Until deletion of the account
A counter derived from the IP address of requests to the sign-in, registration and password-reset forms	Limiting the rate of such requests, in order to prevent the guessing of credentials and the use of the password-reset facility to send messages in bulk. The address is stored in hashed form and is not retained in plaintext.	Art. 6(1)(f), legitimate interests in the security of the Service and of User accounts	The duration of the applicable rate-limiting window, being at most one hour
Web server logs: requested resource, timestamp, user-agent string and originating IP address	Operation, maintenance and security of the server, and detection of abusive traffic. Logs are not analysed, are not aggregated into usage statistics, and are not associated with any account.	Art. 6(1)(f), legitimate interests in the security and availability of the Service	14 days, after which they are deleted by log rotation

Supply of a username and password is a contractual requirement for the creation of an account; an account cannot be provided without them. Supply of an email address is not required, and an account for which no address has been supplied is fully functional save that no password reset can be effected.

The contract referred to above is the terms of use, which are accepted upon registration. No payment is made or required.

Cookies and local storage

The Service sets two cookies, both of which are strictly necessary for the provision of a service explicitly requested by the User, and neither of which is used for tracking, measurement or profiling:

• sessionid, which maintains the authenticated session and is set upon sign-in and cleared upon sign-out; and
• csrftoken, which is a security measure against cross-site request forgery.

Display preferences selected by the User, comprising theme, typeface, text size, column width and the display of the opening initial, are stored in the browser's local storage under the key reader. They are not transmitted to the server. Deletion of browser storage restores the default values and has no further effect.

Consent is not sought for the above because each item falls within the exemption in Article 5(3) of Directive 2002/58/EC for storage strictly necessary to provide a service explicitly requested by the subscriber or user. No analytics, measurement or advertising technology is deployed on the Service. Should this change, this policy will be amended before the change takes effect.

Recipients

Personal data is not sold, licensed, disclosed for consideration, or made available to advertisers. The Service incorporates no third-party analytics, embedded content, social media components or externally hosted fonts, scripts or icons; all such resources are served from the Operator's own server, and no request arising from a page of the Service is directed to any third party.

The following processors act on the Operator's behalf:

• Hetzner Online GmbH, which provides the server infrastructure on which the database is stored; and
• Mailjet, which transmits password reset messages and accordingly processes an email address at the time of transmission. Where no email address has been supplied, no data is disclosed to this processor.

Each processor acts under a written agreement satisfying Article 28 of the Regulation. In addition, the Operator has access to stored data by means of the administrative interface of the Service.

Processing by language model providers

Assessment questions are generated by a large language model accessed through an external interface. No personal data is transmitted in the course of that generation. The input consists exclusively of encyclopedia article text, and generation is performed in advance of any User interaction. Answers, notes, reading records and account data are not transmitted to any model provider.

Location of processing and international transfers

Data is stored on a single server located in Nuremberg, Germany. Backups are retained on the same machine and are not replicated to any third-party service.

No personal data is transferred to a country outside the European Economic Area or to an international organisation. The server is situated within the Union, Mailjet transmits from within the Union, and no further recipient exists. The safeguards provided for in Chapter V of the Regulation are accordingly not engaged.

Automated decision-making

Assessments are scored automatically, a pass requiring correct responses to four of the five questions on a first attempt and to three thereafter. That scoring does not produce legal effects concerning the User and does not similarly significantly affect the User within the meaning of Article 22 of the Regulation; the sole consequence of an unsuccessful attempt is a temporary interval before a further attempt may be made. No profiling is carried out.

Rights of the data subject

The User has the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21).

Two of those rights may be exercised directly and without application to the Operator:

• Export of data produces a file in JSON format containing the account details, completion records, assessment attempts, bookmarks, notes and reading history held in respect of the User, in a structured, commonly used and machine-readable format.
• Deletion of the account erases the account and all records set out in the table above. Deletion takes immediate effect and is irreversible.

Any other request may be addressed to ant.karvelas@pm.me and will be answered within one month of receipt, in accordance with Article 12(3) of the Regulation.

The User has the right to lodge a complaint with a supervisory authority, in particular in the Member State of the User's habitual residence, place of work or place of the alleged infringement, or with the supervisory authority of Greece.

Security

Transport is encrypted by means of TLS. Passwords are stored salted and hashed and cannot be recovered, which is the reason a forgotten password may only be reset. No payment data, identity document data or postal address is collected or stored.

Minors

The Service is not directed at children and no age verification is performed. Under Article 8 of the Regulation as applied in Greece, the consent of a holder of parental responsibility is required in respect of users below the age of 15 where consent is the applicable basis.

Amendment

Where this policy is amended in a manner affecting the categories of data processed or the recipients thereof, notice of the amendment will be given on the Service before it takes effect.

Last reviewed: 30 August 2026.