Privacy Notice

Who is responsible?

LEON Sci is operated by Dr. Shahin Ghaziani, sole proprietor, Hasenpfuhlstraße 11, 67346 Speyer, Germany.

For privacy questions or requests, contact info@leon-sci.com. Further contact details are in our Impressum / Legal Notice.

The operator currently handles member administration and privacy requests personally.

Visiting the website

Your IP address and technical request information are processed to deliver the pages and files you request, troubleshoot faults and protect the website against misuse. The legal basis is our legitimate interest in providing a reliable and secure website (Article 6(1)(f) GDPR).

You are not legally or contractually required to provide this information, but we cannot deliver the requested page without the necessary technical data.

Technical request information can include the requested page or file, request time, browser-supplied headers and cookies, and the information you submit. Account and recovery protection also uses coded identifiers derived from network or email information to limit repeated attempts. These identifiers help recognise related attempts without storing the original address in that particular record; they are not treated as anonymous data.

Routine detailed web-access logging is not enabled in the inspected service configuration. LEON operational journals and database logs are configured for a seven-day retention period; size limits can shorten journal retention. Error and operational records may still contain information relevant to a fault or security event. These routine logs are separate from the account-security, administrative and email records described below.

Separate host-system and administrative-security logs follow different settings. In the inspected hosting configuration, several system and authentication log files are configured for weekly rotation with four retained archives. The host-wide system journal uses storage-based limits without a configured maximum retention age. These settings are separate from the seven-day LEON application journal and do not establish an exact deletion date for every record or copy. AWS also maintains a separate CloudTrail management-event history covering the past 90 days. This includes infrastructure administration and supported Cognito account actions, such as registration, sign-in and recovery requests. Records can include the action, time, request-source IP address and account identifiers. For requests made by our server, the source address can be the server’s address. These records help trace and investigate account and service activity; they are separate from routine website-access logs.

Creating and using an account

We process your email address, authentication information, verification and recovery activity, account identifiers and status to create your account, confirm your email address, sign you in and help you recover access. Authentication uses Amazon Cognito. Passwords and verification codes are processed for their authentication purpose; they are not professional profile information.

Account completion includes your name and confirmation that you are at least 18. Membership is for adults. We record the versions of the Terms and Privacy Notice presented to you, the relevant action and time, and their association with your account. Agreeing to the Terms and acknowledging a Privacy Notice are different from giving consent to an optional use of personal data.

The legal basis for processing objectively necessary to provide the account and functions you request is Article 6(1)(b) GDPR. We keep limited agreement records objectively necessary to administer your current account (Article 6(1)(b) GDPR). Necessary records of notice delivery and other specific legal obligations are processed under Article 6(1)(c) GDPR. We do not maintain a general post-closure archive merely against possible future claims. Any particular remaining record needs a specific necessary purpose and lawful basis, as explained below.

Registration and completion screens identify the information needed to proceed. Without necessary identity, authentication or eligibility information, we cannot create or provide the account. Other profile information is optional unless a particular requested function identifies it as necessary.

Your private profile and Settings

You can provide professional information such as a biography, academic titles, headline, position, institution, selected location, interests, education and work history, professional links, a profile picture and a banner. We process the information you choose to save to provide the private profile functions you request (Article 6(1)(b) GDPR).

Member profiles are private in this phase. Only the member who owns a profile can view and edit it through the service. We do not publish member profiles, display them to other members or make them available for public search. Public information about the people behind LEON Sci is separate and is explained below.

This describes visibility through the platform. It does not exclude the operator's or service providers' necessary access to stored data for the purposes explained in this notice.

We process uploaded profile images to prepare the saved image, including cropping and image conversion. This is not an identity-verification or facial-recognition service.

Your saved Settings include your selected time zone and date/time display preferences. The browser also provides language and time-zone information for local display, including when account functions are unavailable. Those detected display values are used locally; the account preference-saving function sends the settings you choose to save. Selected profile locations are separate from these display preferences. We do not use these functions to obtain your precise physical location.

Provide only information relevant to your professional profile. Do not include another person's confidential information or identifiable medical histories. A scientific interest does not itself mean that you have a particular health condition.

Account security and essential emails

We process session and authentication identifiers, relevant activity times, verification/recovery attempts and necessary security or administrative records to protect accounts, prevent misuse and administer permitted account actions. These records are generated by account activity, permitted operator actions and authentication or delivery-provider feedback. Our legitimate interests are preventing unauthorised access, abuse and fraudulent requests, and maintaining an accountable service (Article 6(1)(f) GDPR).

Automatic technical checks validate requests and apply authentication and abuse-prevention limits. Contact us if you need help with an account restriction or believe that a security check has affected you incorrectly.

We send messages needed for email verification, account recovery, security and permitted account administration. They use your email address and relevant account/action information. Depending on their purpose, processing is necessary to provide the requested account service (Article 6(1)(b) GDPR) or to protect and administer it (Article 6(1)(f) GDPR). These messages are distinct from optional marketing.

Email delivery records can include the recipient, message subject and contents, message identifiers, delivery attempts and failure or complaint feedback. We also keep limited blocking records to avoid further failed or inappropriate sends. Authentication is managed by Cognito, which uses Amazon Simple Email Service for its configured emails; relevant security and administrative emails also use Amazon Simple Email Service. Delivery-event feedback is passed through Amazon Simple Notification Service and Amazon Simple Queue Service. These delivery and blocking records are separate from your private profile. Our configured email service also uses an SES suppression list for bounced addresses and complaints. SES normally keeps addresses on that list until they are removed. These provider-held blocking entries are separate from our routine completed delivery history and follow the necessity reviews described below.

Browser storage and external links

We use first-party cookies to maintain your signed-in session and securely associate registration, completion and recovery steps with your browser. These cookies support functions you request and protect the account journey. We do not treat them as permission to track you for unrelated purposes.

Successful account completion or sign-in sets a session cookie automatically. We do not give this cookie a persistent browser expiry. Your browser may preserve or restore session cookies through its session-restoration features, so closing the browser does not guarantee sign-out. Server access expires after 30 days without foreground use or 90 days since fresh sign-in, whichever is earlier; security action can end access sooner. Confirmed sign-out clears the session cookie. Cookie removal or loss of access does not itself erase related server or provider records.

Registration cookies use a 15-minute interval that can renew during valid registration activity. Recovery cookies normally last up to 15 minutes; a new recovery context can issue a new cookie. Completion cookies follow the remaining validity of their short, normally 15-minute context.

We use browser session storage for navigation/sidebar display choices during the tab's browsing session. When you explicitly restart the “How LEON Sci Works” experience, a temporary session-storage value carries your sound and motion choices through the reload and is removed when read. If it is not read, it can remain for that tab's session. Pages also use browser language/time-zone, reduced-motion, screen and input settings locally to format dates and adapt display and interaction. Automatic display detection is separate from saving account Settings: the preference-saving function sends the settings you choose to save.

Necessary storage/access for the service you expressly request relies on section 25(2), no. 2 TDDDG. The personal-data processing relies on the relevant account-service or legitimate-interest basis described above. Any non-exempt device access requires its own appropriate information and consent.

We do not use optional visitor analytics or session replay in this phase. Links to external profiles or other websites take you to the relevant external service when followed; those services handle data under their own privacy notices.

Email and telephone enquiries

When you contact us, we use the contact details and information you provide to handle and reply to your enquiry. We use an email application on the operator's computer to handle contact emails. Calls can involve your telephone number and connection information, including call-log entries on the operator's phone. We make follow-up notes only when needed for the enquiry. We do not record calls or offer voicemail, SMS or WhatsApp enquiry handling.

Our legal basis for general enquiries is our legitimate interest in responding (Article 6(1)(f) GDPR). Where processing is necessary for a contract or steps you request before one, Article 6(1)(b) GDPR applies. We handle privacy-rights requests to meet our obligations under Articles 12–22 GDPR (Article 6(1)(c) GDPR).

Providing enquiry information is voluntary, but we may be unable to respond without the information needed to understand your request and contact you. Please send only necessary information; we do not request medical records or other sensitive personal information through these channels.

We review ordinary contact emails, LEON enquiry call-log entries on the operator's phone and telephone follow-up notes manually each month. We delete them when no longer needed, and at the latest 12 months after the enquiry closes. Specific legal retention obligations or necessary evidence for a particular dispute may justify keeping particular records longer.

The contact-email rule covers messages held in our contact mailbox and email application, including Deleted Items or Trash. Provider recovery copies are described below.

Reports, account decisions and consumer requests

When you report a concern, ask us to review an account restriction, end your account agreement or exercise a statutory withdrawal right, we use the contact and account details, relevant statement, necessary supporting information and handling records to assess and respond. Records can include the time and content of a request, decision or confirmation. Information may come from you, another person reporting a concern, relevant account activity or our service providers.

We process information necessary to handle your account agreement under Article 6(1)(b) GDPR. Where a legal duty requires handling a notice, withdrawal, confirmation or other request, Article 6(1)(c) GDPR applies. Where a particular complaint or existing dispute requires additional handling or evidence, we assess the specific purpose, necessity, lawful basis and retention separately. Where applicable, Article 6(1)(f) GDPR covers necessary legitimate interests in fair case handling, protecting people and the service, and resolving that matter. This is not a general permission to keep records against hypothetical future claims.

We do not automatically publish a reporter's contact details. Necessary information may be shared with the affected person to explain or review an allegation or decision, or with relevant providers, advisers or authorities as needed for the particular matter. We limit disclosures to the information needed and respect applicable confidentiality and other people's rights. Where information about you comes from another source, we provide the information required by law, subject to its applicable exceptions.

Ordinary correspondence follows the contact-enquiry retention rule described above. Necessary agreement and notice evidence follows its separate limited rule. Other legal-duty, complaint or claim records are kept only while the particular obligation or matter requires them; unnecessary supporting information is removed sooner. A complaint is not a reason to retain the entire account indefinitely. Your account and consumer rights are explained in our Terms.

People featured on the public website

We publish names, professional biographies, roles, portraits and professional profile links to introduce the people supporting LEON Sci. They supplied their photographs and professional information for publication. Profiles also draw on LEON Sci's existing public team page and current professional details approved by those people.

The legal basis is the featured person's consent (Article 6(1)(a) GDPR). Publication is voluntary. They can withdraw permission at any time through info@leon-sci.com, without affecting their role with LEON Sci. Withdrawal does not affect processing already carried out on valid consent.

We remove the portrait, biography and profile links from the live website when permission is withdrawn or publication is no longer needed. We keep only the permission/withdrawal records needed to demonstrate compliance (Article 6(1)(c), with Articles 5(2) and 7(1) GDPR) or deal with specific legal claims (Article 6(1)(f) GDPR), for as long as those purposes require.

These public biographies can be viewed by anyone and may appear in search results or independent copies. Where a duty to seek removal or notify another controller applies, we take the required steps; we cannot guarantee deletion of every independent copy. This public-biography arrangement does not make members' private profiles public.

How long we keep data

The following rules determine when information is no longer needed and when it is reviewed for deletion. Reviews and individual requests are handled manually in this phase; there is no automatic account or history cleanup. A review date, an expired login or signing out is not confirmation that stored data has been erased.

Our Terms, section A05 commit us to closing login access and deleting active account/profile data, including profile images, within 72 hours of receiving your account-ending email, unless you request a later date. Limited lawful evidence and provider copies follow their separate rules; this is distinct from the general privacy-response period.

Account closure and erasure requests are handled individually through our privacy contact. There is no self-service whole-account deletion tool in this phase. Ending access and erasing stored data are separate actions; we explain the outcome of your request and any particular information that must remain. A need to retain limited evidence does not justify keeping the full account or profile.

Changing or deleting a live record does not by itself remove every backup, delivery-system record or provider-managed copy. These copies require separate consideration when handling a request. Copies held for a specific legal obligation or claim must remain limited to that purpose. The same necessity rules apply to retained information; a technical limitation does not create a separate reason to keep it.

Our account database uses automated backups configured for seven days in the Frankfurt region. The provider does not count periods when the database is stopped toward that retention calculation, so a backup can remain for longer than seven calendar days. This backup setting is separate from any manual or final snapshot and from the other provider records described here. It does not mean that individual records are erased from every copy when removed from the active database.

For contact emails, STRATO describes a recovery window of up to 30 days after removal from the mailbox, including its trash. Its mail-service processing terms provide a maximum of six months from creation for mail logfiles. These are separate from the retention of your enquiry in the active mailbox and from AWS records.

Providers, access and processing locations

We use Amazon Web Services (AWS) for website servers and databases, authentication and relevant service emails, with Frankfurt, Germany as the primary infrastructure location. Our AWS provider is Amazon Web Services EMEA SARL, Luxembourg. The account services use Amazon Cognito for authentication, Amazon Simple Email Service for relevant service emails, and Amazon Simple Notification Service and Amazon Simple Queue Service for delivery feedback. AWS processes customer data on our behalf under its data-processing terms.

STRATO GmbH provides domain registration and the contact mailbox. It processes mailbox data for us under our data-processing agreement. Telecommunications providers process connection data to carry telephone calls. Email delivery also involves the recipient's email provider.

The operator currently handles member administration and privacy requests personally. Service providers process relevant data to deliver their services. Account administration does not make your private member profile public or available to other members. Necessary disclosures to public authorities or professional advisers are limited to the applicable legal requirement or specific matter.

Providers may also process information for their own legal, billing or service-security responsibilities where they act independently. The applicable role depends on the particular service and purpose; it is not determined solely by the provider's name.

Our selected AWS authentication and service-email configuration uses Frankfurt. Under AWS's data-processing terms, customer data stays in the selected region unless a transfer is necessary to provide a service we request or to comply with the law or a binding government order. A German hosting region therefore does not guarantee that every processing activity or support access takes place in Germany or the EEA. For covered transfers to countries without an applicable adequacy decision, AWS's terms provide European Commission standard contractual clauses, subject to their alternative-transfer provisions.

AWS publishes its data-processing terms and subprocessor information. The latter distinguishes service-specific processing from support involving customer data shared for that purpose. Not every entity or service on that list is used for LEON Sci.

You can contact info@leon-sci.com for information about the processing locations and international-transfer safeguards relevant to your data, including a copy of applicable safeguards. The published AWS terms include the contractual transfer provisions; we explain which safeguards apply to the processing concerned.

Your rights and account closure

Subject to the applicable conditions, you can request access to your personal data, correction, deletion, restriction of processing and data portability. You can request closure of your account separately from a request concerning particular data.

Contact info@leon-sci.com; no account or special request form is required. Requests are handled personally, including manual coordination of relevant records and providers. We may ask for proportionate information where reasonably needed to confirm identity or clarify your request.

We act without undue delay and normally respond within one calendar month. Where a lawful extension is necessary, we explain the reasons and extension within that month. If we cannot fulfil all or part of a request, we explain why and the applicable complaint/remedy routes. Rights requests are normally free of charge.

Where we rely on legitimate interests, you may object on grounds relating to your particular situation. Where we rely on consent, you may withdraw that consent at any time.

You may complain to a data-protection supervisory authority, including the Rhineland-Palatinate Commissioner for Data Protection and Freedom of Information, or an authority in the EU member state of your habitual residence, place of work or the alleged infringement.

This notice applies to the described service regardless of where you use it. Mandatory rights under applicable local law are not limited by this notice.

Updates to this notice

We identify revisions by version and date. When processing changes, we provide the information required for the affected use and inform affected people directly where necessary. A notice update or acknowledgement is not by itself consent to a new optional use of personal data.