Privacy

Privacy notice.

This notice describes how extendedmatrix.org handles personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR). The site is a static, public information service for the Extended Matrix research project; we keep data processing to the minimum compatible with running it.

Last reviewed: .

1 · Data controller

The data controller for this website is Emanuel Demetrescu (personal capacity). Contact: emanuel.demetrescu@cnr.it.

Affiliation: Consiglio Nazionale delle Ricerche, Istituto di Scienze del Patrimonio Culturale (CNR-ISPC). The institutional affiliation is provided for context; this site is operated in personal research capacity, not as an institutional CNR-ISPC service.

The Heriverse 3D viewer embedded on the home page (see §3) is served from a CNR-ISPC server (strativerse-test.ispc.cnr.it). Any processing performed through that embed sits under CNR-ISPC's responsibility, with the CNR Data Protection Officer (rpd@cnr.it) as the point of contact for that service.

2 · What this website collects

The site is statically generated and served via GitHub Pages. It does not set first-party cookies, does not use any client-side storage (localStorage, sessionStorage), and does not log visitors beyond what GitHub does on its own infrastructure.

Aggregate, cookieless visit measurement is provided by GoatCounter — see §4 for the details and the legal basis.

GitHub may log technical information such as the IP address of incoming requests and the user-agent string, for the sole purpose of operating its CDN and detecting abuse. This is covered by GitHub's own privacy statement.

3 · Third-party content embedded on this site

A small number of pages embed content served by third parties. When you load such a page (and, for the Heriverse embed, when you explicitly click to load it), your browser establishes a direct connection to those services and they may, in turn, process technical data (IP address, user agent, time of access) under their own privacy policies.

  • Heriverse (strativerse-test.ispc.cnr.it) — the home page features an interactive 3D viewer (Heriverse) hosted on a CNR-ISPC server. To respect your privacy, this iframe does not load until you explicitly click "Load Heriverse" on the page. When you click, a connection is opened to strativerse-test.ispc.cnr.it and a session cookie (connect.sid, HttpOnly, no cross-site tracking) may be set on that domain. The processing of any data through that iframe is governed by CNR-ISPC's privacy policy.
  • YouTube (youtube-nocookie.com) — used on the Events pages to embed recordings of EM Conference, EM Bazaar and related talks. We use the privacy-enhanced youtube-nocookie.com domain, which defers the placement of persistent identifiers until you actually press Play. See Google's privacy policy.
  • Zenodo (zenodo.org) — when you click a DOI or community link, you leave this site and continue on zenodo.org, operated by CERN. See the Zenodo policies.
  • GitHub (github.com / topics) — repository and topic pages opened from the navigation, footer, and tools pages.
  • Telegram (t.me) — an outbound link to the community chat, no embed; subject to Telegram's privacy policy once you join.

We do not embed advertising tags, social-media widgets or fingerprinting scripts.

4 · Analytics

This site uses GoatCounter (operated by Martin Tournoij, EU-hosted in the Netherlands) to measure aggregate visits, page views and download counts. GoatCounter is cookieless and privacy-friendly: it does not set persistent cookies, does not track users across sites, and does not collect personal data.

The visit measurement is based on a daily-rotating, anonymous hash derived from a salted combination of IP address and user agent. By design, this identifier is reset every 24 hours, making cross-day or cross-visit tracking impossible.

Aggregated data (monthly visits, top pages, download counts) is retained as long as the analytics service operates; no per-visit raw data with identifying information is stored.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR — research project audience measurement and dissemination metrics). No consent banner is required because no personal data is processed. See the GoatCounter privacy policy for technical details.

5 · Web fonts

Web fonts (Inter, Manrope) are self-hosted on this site — they are served directly from the same domain as the rest of the content. No data is transferred to third-party font services (Google Fonts, etc.) when you visit any page.

6 · Cookies

This site does not set any first-party cookies on its own.

The Heriverse iframe (strativerse-test.ispc.cnr.it), if you choose to load it, may set a session cookie called connect.sid on the CNR-ISPC domain. This cookie is technical (session management for the 3D viewer), is HttpOnly, does not perform cross-site tracking, and is automatically discarded when you close the browser. We have no access to or control over this cookie.

GoatCounter is cookieless and does not set any cookies.

7 · Forms and contact

The site has no contact form. If you choose to write to the email address listed above, your message and the associated email metadata will be processed on the legal basis of consent (Art. 6(1)(a) GDPR) and/or legitimate interest (Art. 6(1)(f) GDPR) for the purpose of replying. Messages are retained no longer than necessary to handle the conversation.

8 · Legal bases for processing

To the extent any personal data is processed in the context of this website, the legal bases are:

  • Art. 6(1)(f) GDPR — legitimate interest in operating, securing and analysing the site (infrastructure logs at the GitHub Pages level; aggregate, cookieless audience measurement via GoatCounter).
  • Art. 6(1)(a) GDPR — explicit consent: when you click "Load Heriverse" to load the third-party 3D viewer, or when you press Play on an embedded YouTube video.

9 · Your rights

Under Articles 15 to 22 of the GDPR, you have the right to access, rectify, erase or restrict processing of your personal data, to object to processing, and to data portability where applicable. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

To exercise these rights with respect to this website, write to emanuel.demetrescu@cnr.it. For matters specific to the Heriverse embed served from strativerse-test.ispc.cnr.it, the CNR Data Protection Officer is the point of contact: rpd@cnr.it.

10 · Changes to this notice

This notice may be updated when the site changes (new embedded services, new functionality, etc.). The "last reviewed" date at the top of this page reflects the latest substantive update. The full revision history is available in the site repository.