COD Privacy Policy and GDPR
compliance2022-07-15
The Crystallography Open Database (COD), running at https://www.crystallography.net/cod/, wasbuilt with confidentiality of personal information in mind since its very inception in 2003, i.e. long
before GDPR was even created. This is because the founders and maintainers value freedom, rightto access scientific information as well as the privacy of individuals. We were always against
manipulating someone's personal data behind their back, without the person knowing about it.
Consequently, we collect only a very minimal amount of information about our visitors and dataproviders, the minimum that is absolutely necessary for the efficient operation of the COD.
You do not need to register, login, or otherwise reveal your identity if you are downloading datafrom the COD. COD data are in the public domain (licensed under CC0), and thus you may copy
the COD even from sources other than the COD website. For example, you may distribute the COD
inside your company or your university from internal servers. We do not track such distributions.
When you connect to the COD website, our Web server registers standard information that Apache2is set up to register by default: the client IP address, the access timestamp (date and time) and thebrowser type (aka "user agent"). This information is not revealed publicly. It is used internally fortechnical and organisational purposes, such as balancing the load of our servers, detecting potential
cyberattacks and defending against them, and counting the number of unique visitors. We may
publish aggregated statistics on numbers of unique visitors, countries from which the visitors come(based on IP geolocation), numbers of visitors and visits per country as well as numbers of visits indifferent time spans. The aggregated statistics might be used to justify requests for the financing of
the COD. In no case will we reveal your IP address or other information that might identify you.
For depositing data, we ask you to create an account on the COD server and identify yourself using
this account. Upon creating an account, in addition to the data stored when you access the COD in aread-only manner, we always store your personal name which you provide to us, your working
e-mail address, your encrypted password and your account creation date. We will check that thee-mail address you have provided is valid by sending you a confirmation e-mail, but we will nototherwise try to identify or track you as a physical person. You can, however, voluntarily provide
and optionally publish your personal information items such as your ORCID iD, your home page
URI or information about your affiliation; this may be used to associate your depositions with yourpublished works or with the organisation your work in. Optionally, we will also store information
about your education and your scientific interests, if you choose to provide such information. Only
your name, e-mail address and password are mandatory for depositing data. None of thisinformation will ever be made public or transferred to third parties, except in cases when we might
be obliged to do so under Lithuanian law.
When you deposit a data set, we record when and what data you have deposited, and associate itwith your account. This information is needed to ensure integrity, validity and provenance of datathat enters the COD repository. In case of questions regarding the data, we might send you anoccasional e-mail asking for a clarification on how the data have been obtained, why are certainaspects of the data recorded, ask for additional data or the original publication associated with thatdata, etc. We might also send you a reminder when the hold period for your data which you havedeposited with the "on-hold" option expires and the data are about to become public. We might also
send you personal e-mails from the COD maintainers discussing possible use of the COD data or
possible collaboration opportunities.
Exception to the publication rule is when you deposit data under your claimed authorship. Since allrecords in the COD are public (CC0), your name and surname will be published on the COD
website, either immediately after deposition or after a certain hold period. No other information will
be published. In particular, your e-mail address will not be included into the public COD record,
unless you choose to do this yourself by inserting your e-mail address into the submitted CIF file.
The handling of your name and your deposited data follows the same rules as the handling of yourname and other data when you publish a scientific paper. In fact, a COD deposition can be regarded
as a kind of scientific publication.
You have a moral and legal right to alter you personal data records, ensure that these records havecorrect information and delete your personal account from the COD server. If you have notdeposited any structures to the COD, your account will be, as a rule, deleted immediately upon yourrequest, except in the cases when the logs indicate that the account might have been used for someillegal activities. In that case information might be retained for a certain period necessary forinvestigation of the activities, after which it will be completely deleted as permitted and required by
Lithuanian law.
If you have deposited data to the COD, then, if you request to remove your account, we will delete,
as in the case before, the information from your account record, i.e. we will remove your name,e-mail address and encrypted password, together with all optional information that you haveprovided. We will, however, retain the numeric user ID of that account that is associated with thedepositions you have done, and the depositions themselves. Your name will also be retained in thepublished COD records. The depositions are regarded as factual statements about nature madeunder your name, and treated as scientific publications. You cannot "unpublish" or "unauthor" ascientific paper; in the same way, you cannot simply delete a COD crystal structure record that wasmade public. You can and may, however, withdraw or retract your COD record (again, in a way
similar to the retraction of scientific papers). If you choose to do so, the corresponding COD record
will be marked as such and moved to the retracted record directory.
All data are stored and processed in Vilnius, Lithuania, Vilnius University Life Sciences Center on
the basis of legitimate interest. In case you need to correct your personal data records, you can use
the Web interface to edit your personal data form or e-mail us at cod-bugs@ibt.lt. If you wish todelete otherwise modify your account, please e-mail us at cod-bugs@ibt.lt and we will respondwithin a reasonable time as mandated by the law.
The COD Advisory Board