Lax Lean Archive

Privacy Notice

Last updated: 2 September 2026

1. Controllers

  • Clemens Kuske; c/o Hasso Plattner Institute, Chair for Algorithm Engineering; Prof.-Dr.-Helmert-Str. 2–3, 14482 Potsdam, Germany
  • Jan Dreier; c/o Hasso Plattner Institute, Chair for Algorithm Engineering; Prof.-Dr.-Helmert-Str. 2–3, 14482 Potsdam, Germany
  • Édouard Bonnet; c/o Laboratoire de l'Informatique du Parallélisme (LIP), ENS de Lyon; 46 allée d'Italie, 69007 Lyon, France

The three persons named above jointly operate the Lax Archive. You may exercise your data protection rights against any of them. For privacy enquiries and requests, the central contact is mail@clemens-kuske.de.

2. Website hosting

The static website laxarchive.org is hosted on GitHub Pages. When you visit the website, GitHub processes technical connection data, in particular your IP address, the requested address, and time and browser information, to deliver and protect the website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the archive.

The provider is GitHub, Inc. or, for certain European services, GitHub B.V. Data may also be processed in the United States and other third countries. GitHub describes the safeguards it uses for these transfers, including the EU-US Data Privacy Framework and Standard Contractual Clauses, in its Privacy Statement.

3. Comments and community reviews

Comments, endorsements, and reports of possible errors (flags) are processed through comments.laxarchive.org, where we operate a customised Remark42 installation and the Lax reactions service. When a page is loaded, the account display in the page header contacts this service to check whether a session already exists. The infrastructure runs on Amazon Web Services (AWS) in the Frankfurt region. AWS may receive technical data as a processor; the AWS Data Processing Addendum provides Standard Contractual Clauses where transfers to third countries are necessary. Further information is available from the AWS GDPR Center.

When these functions are loaded or used, the server processes in particular the IP address, time, requested Lax page, and technical request data. When a comment is submitted, Remark42 replaces the IP address before storing it with the comment data with a cryptographic hash generated using a secret key. This processing is necessary to operate and secure the service and prevent misuse (Article 6(1)(f) GDPR).

Signing in with ORCID

You must sign in through ORCID to participate. Lax receives only your ORCID iD and public display name. Temporary OAuth credentials are used exclusively for signing in and are not stored permanently by the Lax reactions service. Your ORCID iD and display name are linked to the internal Remark42 user identifier so that contributions and reviews can be attributed unambiguously.

ORCID, Inc. is based in the United States and is independently responsible for processing within the ORCID registry. ORCID explains transfers to third countries and its use of Standard Contractual Clauses in its Privacy Policy.

Public participation

Comments, endorsements, and flags form part of the public scientific discussion and review record. Depending on the action, your public ORCID name, ORCID iD, comment or explanation, the affected submission or concept, the time, and, where applicable, the referenced line of Lean source code are displayed publicly. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a transparent and attributable scientific review process.

4. Technically necessary browser storage

For ORCID sign-in, comments.laxarchive.org uses a technically necessary HttpOnly session cookie. sessionStorage temporarily remembers a review action that you started while you are redirected to ORCID. A short-lived authentication value is held only in the memory of the embedded comment frame; it is neither stored permanently nor passed to the main website.

We do not use analytics, advertising, or tracking services. Runtime scripts, fonts, and other website assets are served locally. The storage operations described above are necessary to provide the sign-in or review function that you expressly request (Section 25(2)(2) TDDDG); they therefore do not require consent or a cookie banner.

5. Submission and contributor data

The archive publishes scientific content and attribution data from the public Lax database and linked repositories. This may include the names of authors and contributors, GitHub usernames, repository and commit links, and submitted scientific material. The data originates from the relevant submission and its public sources. It is processed for permanent scientific documentation, traceability, and correct attribution (Article 6(1)(f) GDPR).

6. Retention and deletion

Public comments, endorsements, and flags are generally retained for as long as the associated Lax submission remains part of the archive, unless they are deleted sooner. The link between an ORCID iD and display name is retained only for as long as it is needed for a retained contribution or review. Session data expires when the session ends or you sign out. Technical log data is retained only for as long as necessary for operation, security, or legal obligations; logs maintained by service providers are additionally subject to their retention policies.

You may request deletion at any time by emailing mail@clemens-kuske.de. Where a deletion request is justified, we remove the affected data from Remark42 and the associated ORCID/name mapping from active systems, unless a statutory exception applies. Deleted data from the Lax reactions service may remain in daily rotating backups for up to 14 days. Remark42 backups are overwritten automatically according to the configured rotation and are used exclusively for restoration.

7. Your rights

Subject to the conditions of the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. To exercise these rights, contact us at the email address above. You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Access to Information of Brandenburg.

We do not carry out automated decision-making or profiling.