Privacy policy
Last updated: 3 November 2026
This policy explains what happens to personal data when you use forrt.org, why, and what rights you have.
Who is responsible
FORRT, the Framework for Open and Reproducible Research Training, is an international network. It processes some limited personal data while you are using this site, and is represented by Flávio Azevedo and Lukas Wallrich.
Please contact us with any questions at info@forrt.org
We have not appointed a data protection officer.
Summary
- Google Analytics runs only if you allow it.
- Videos, forms, calendars and teaching activities load only if you click to load them.
- Our host receives your IP address and other technical data each time you open a page, and so do the services listed below on the few pages that use them.
When you visit a page
Hosting. GitHub Pages (GitHub, Inc., USA) hosts this site. Your browser sends it your IP address and standard request data such as the page requested, the time and your browser type. GitHub logs and stores IP addresses for security purposes. We need this to deliver the site and keep it secure, which is our legitimate interest (Art. 6(1)(f) GDPR). We do not receive these logs. GitHub states that it is certified under the EU-US Data Privacy Framework.
Other services. A few pages use content we cannot serve ourselves. Those services receive your IP address and standard request data when you open the page:
| Service | Based in | What it delivers | Where used |
|---|---|---|---|
| Esri (ArcGIS Online) | USA | Map tiles | Community map |
| Altmetric (Digital Science) | UK, with a US affiliate | Attention badges | Publications page |
| Datawrapper | Germany | Charts | NOWHERE Lab page |
| Posit Connect and shinyapps.io (Posit), Heroku (Salesforce) | USA | Interactive tools that run on those platforms | The pages for those tools |
The legal basis is our legitimate interest in showing this content (Art. 6(1)(f) GDPR). You can object at any time; see your rights. We serve fonts, scripts, stylesheets and icons from forrt.org.
Esri, Posit, Salesforce (including Heroku) and Altmetric’s US affiliate each state that they are certified under the EU-US Data Privacy Framework. The European Commission has found that the UK provides adequate protection.
Cookies
| Cookie | Set by | Purpose | Lifetime | Basis |
|---|---|---|---|---|
forrt_analytics_choice | forrt.org | Remembers whether you allowed or declined analytics | 1 year | Necessary to honour your choice |
_ga, _ga_2BTFVS6SPM | Google Analytics | Distinguish visitors and sessions | Up to 2 years, shorter in some browsers | Your consent |
Embedded services may set their own cookies once you load them.
Analytics
If you select Allow analytics, we load Google Analytics 4 from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its parent Google LLC, USA). We use it to see which pages are read and how visitors find them, so that we can improve the site, and we publish aggregated figures on our visitor statistics page.
Google receives the pages you view, page titles, a random client ID, approximate location, device and browser details, and interactions such as scrolling. Google states that Google Analytics 4 does not log or store IP addresses, and that it drops IP addresses from EU users before logging, although Google still receives them when the data is collected.
- Legal basis: your consent (Art. 6(1)(a) GDPR).
- Withdrawing consent: select Cookie settings, also at the foot of every page, and then Decline. Analytics stops and we remove the
_gacookies. Withdrawal cannot affect processing that took place before it. - Retention: 14 months.
- Google’s role: under Google’s Data Processing Terms, Google acts as our processor for this data (Art. 28 GDPR). We have turned off all of Google Analytics’ optional data sharing, so Google uses this data only to provide and maintain the service.
- Transfers to the USA: Google collects EU data on servers in Europe, but it may then process the data in other countries, including the USA, and relies on the EU-US Data Privacy Framework for those transfers. Google LLC is certified under that framework, which the European Commission has found provides adequate protection ( Decision (EU) 2023/1795).
If you decline or do not choose, Google Analytics does not load.
Embedded content
Other services, some of them in the USA, host our videos, forms, calendars and some teaching activities. Each one shows a placeholder until you select Load, or a thumbnail until you press play. Your click is your consent for that item on that page view (Art. 6(1)(a) GDPR). Once it loads, the provider receives your IP address and browser data, may set cookies, and handles the data under its own privacy policy.
| Provider | Content |
|---|---|
| Google (YouTube, Forms, Calendar, Sheets), privacy policy | Videos, forms, calendars, spreadsheets |
| LearningApps, Padlet, Rebus Press, NeuroQueer, GitHub Pages | Teaching activities and pages in the neurodiversity lesson bank |
Videos use the youtube-nocookie.com player.
If you contact us or send us something
Newsletter. The sign-up form loads from EmailOctopus (Three Hearts Digital Ltd, 86-90 Paul Street, London EC2A 4NE, UK), and also loads Google reCAPTCHA for spam protection. If you subscribe, EmailOctopus stores your email address as our processor, under the data processing schedule in its terms, and we use it to send the newsletter. Its sub-processors are listed here. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe through the link in every email, and we then remove you from the list. The European Commission has found that the UK provides adequate protection.
Forms and feedback. Our Google Forms and the feedback forms on glossary and other pages store what you enter, and any email address you choose to give, in Google Sheets. We hold this in our forrtproject@gmail.com account, and use it to act on your message or application. We keep it for as long as we need it for that purpose, and then delete it. The legal basis is our legitimate interest in improving our resources and running our programmes (Art. 6(1)(f) GDPR), or your consent where a form asks for it. Google stores this data and may process it in the USA, as described under Analytics.
Email. If you email us, we use your message and address to reply (Art. 6(1)(f) GDPR). Google Mail hosts our email. We keep messages for as long as we need them to deal with your request.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing and to receive it in a portable format (Arts. 15-18 and 20 GDPR). Where processing rests on legitimate interests, you can object to it (Art. 21 GDPR). Where it rests on consent, you can withdraw that consent at any time for the future (Art. 7(3) GDPR).
To use these rights, write to the contact above. You can also complain to a data protection supervisory authority, in particular where you live or work (Art. 77 GDPR).
You do not have to provide personal data to read this site. Forms and the newsletter need the details they ask for. We do not make automated decisions about you that have legal or similarly significant effects.
Changes
We update this policy when the site or its services change. The date at the top shows the latest version.