Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on this website is:

Erpenbach Institute OÜ
represented by Eva M. Erpenbach
Tartu mnt 67/1-13b, 10115 Tallinn, Estonia
E-mail: contact@erpenbach.institute

2. Principles of data processing

The Erpenbach Institute processes personal data only to the extent necessary for the provision of the website and for handling inquiries. No cookies are set, no third-party tracking tools are used, and no personal data is processed for advertising purposes or sold.

3. Hosting

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The servers are located in Germany. When the website is accessed, IONOS, as hosting provider, processes technical data on our behalf.

A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS. Since 19 July 2022 it has been part of the IONOS terms and conditions and is therefore automatically included in the contract.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of the website).

4. Content Delivery Network (Cloudflare)

For secure, fast and resilient delivery, this website uses a Cloudflare content delivery network provided through IONOS. Traffic is routed via Cloudflare servers, which processes technical data such as the IP address of the accessing device.

Cloudflare may also process data in third countries (in particular the USA). This is safeguarded by EU standard contractual clauses. As Cloudflare is provided through IONOS, the processing is covered by the data processing agreement with IONOS.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and availability of the website).

5. Server log files

When this website is accessed, the hosting provider records technical access data in server log files. This may include: IP address of the accessing device, date and time of access, page accessed, browser and operating system used, and HTTP status code.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free provision of the website).

Retention period: Storage and deletion of server log files is carried out by the hosting provider within the scope of its technical specifications.

6. Reach measurement (self-hosted analytics)

This website uses a self-operated, data-minimising reach measurement. No IP addresses are stored and no cookies are set.

To avoid duplicate counting, a purely random, daily-rotating technical value is generated in the browser (sessionStorage). It does not allow recognition beyond a single day and has no personal reference. It is deleted when the browser tab is closed.

Only aggregatable, non-personal information is stored: date, time, page accessed, a rough referrer category (e.g. "linkedin", "google", "direct"), device type (mobile/desktop), a bot flag and the country (at country level).

Retention period: The raw reach-measurement data is automatically deleted after 90 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the statistical evaluation of website usage). As no personal data is stored and no cookies are used, no consent is required.

7. Contact form and e-mail contact

If you use the contact form, the information you provide – name, e-mail address, optionally organisation, subject and message – is transmitted by e-mail to the Institute's mailbox. Transmission and mailbox are handled via the hosting and mail provider IONOS.

Form data is not stored in a database; it remains as an e-mail in the Institute's mailbox. The same applies if you contact us directly by e-mail.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Retention period: Data is deleted as soon as it is no longer required to handle the inquiry and no statutory retention obligations apply.

8. Fellowship Applications

When applying for an Erpenbach Institute Fellowship, applicants may voluntarily submit personal information including contact details, professional biographies, CVs, profile links and other materials relevant to the application.

Application materials are processed solely for the purpose of reviewing, evaluating and administering Fellowship applications.

Access to application materials is restricted to individuals involved in the Fellowship selection process.

Application materials of unsuccessful applicants will be deleted within a reasonable period after completion of the selection process unless legal obligations require longer retention.

Applicants may request access, correction or deletion of their data at any time by contacting contact@erpenbach.institute.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in conducting and administering the selection process).

9. No cookies

This website does not set any cookies – neither technically necessary nor analytical or marketing cookies. Only for the duplicate-counting avoidance described in section 6 is a technically necessary, non-personal value stored in the browser's sessionStorage, which is deleted when the tab is closed. No consent is required for this.

10. Typefaces

This website uses typefaces (Cormorant Garamond, DM Mono, Instrument Sans) hosted exclusively on its own server. No data is transmitted to external font providers.

11. Your rights as a data subject

To the extent that personal data is processed, you have the following rights under the GDPR:

Access (Art. 15 GDPR): You have the right to request information about the data stored about you.

Rectification (Art. 16 GDPR): You can request the correction of inaccurate data.

Erasure (Art. 17 GDPR): You can request the deletion of your data under certain conditions.

Restriction (Art. 18 GDPR): You can request the restriction of processing.

Objection (Art. 21 GDPR): You have the right to object to the processing of your data on the basis of Art. 6(1)(f) GDPR.

Complaint: You have the right to lodge a complaint with a data protection supervisory authority. As the Institute is based in Estonia, the competent authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You may also contact the supervisory authority of your habitual residence.

To exercise your rights, please contact: contact@erpenbach.institute

12. Data security

This website is operated via an encrypted HTTPS connection. Data transmitted is thus protected from third-party access during transmission.

13. Currency and amendments

This privacy policy is current as of June 2026. The Erpenbach Institute reserves the right to update this policy in the event of technical or legal changes. The current version is always available on this page.