Last updated: 25 October 2026
This exhibition guide accompanies the exhibition “Tiny lodgers, big goals” by TRR 356 PlantMicrobe. This page explains what data it processes, why, and for how long. You can read every station without anything about you being stored. Data only comes into play when you ask the guide a question.
Controller
campusready GmbH
Pommernstraße 12a
82327 Tutzing, Germany
Email: info@campusready.de
Represented by the managing director Kilian Hann. We have not appointed a data protection officer because we are not required to. Please send any data protection questions to the address above.
When you read the pages
The guide’s pages are prepared in advance on our server and delivered without login, tracking or analytics tools. We do not keep access logs. If a technical error occurs while a page is delivered, the web server writes an error message that may contain your IP address; we delete these error logs after 14 days at the latest. The legal basis is our legitimate interest in operating the service securely (Art. 6(1)(f) GDPR).
The server belongs to campusready GmbH and is located in the data centre of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. We have a data processing agreement with IONOS (Art. 28 GDPR).
Settings on your device
The guide remembers your language, level of detail, font size, light or dark display and whether you have already seen the start screen in your browser’s storage (localStorage, keys sprache, niveau, schrift, thema and start). These values never leave your device. They are needed so that the guide stays the way you set it up (Section 25(2) no. 2 TDDDG). You can delete them at any time in your browser settings.
When you ask a question
Follow-up questions are answered by an AI system, not by a person. To answer, we process:
- Your question, together with the station, the level of detail and the language. We send it to OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have a data processing agreement with OpenAI. OpenAI does not use the data to train its models and stores it for abuse monitoring for no more than 30 days. Where OpenAI transfers data to countries outside the EU, it does so on the basis of standard contractual clauses (Art. 46 GDPR).
- The conversation history, in a cookie named
guide_verlauf. It holds the last six messages of your conversation so that the guide understands a follow-up question. It is signed, cannot be read by scripts in the browser and is only sent to the address/api/chat, never when a page is loaded. It only lasts until you close your browser; “Start a new conversation” deletes it immediately (Section 25(2) no. 2 TDDDG). - Your IP address, but only to prevent misuse. We do not store it in plain text but as an encrypted check value (HMAC-SHA256 with a secret key). We use it to count how many questions came from the same address within one hour. The check value is deleted once that hour has passed; a clean-up run every ten minutes ensures this even when nobody is asking.
The legal basis is our legitimate interest in answering visitors’ questions about the exhibition and in protecting the service from misuse and uncontrolled costs (Art. 6(1)(f) GDPR).
Evaluation of the questions
We log every question that reaches the AI system, together with the answer, the station, the level of detail, the language and the time, rounded to the full hour. The log contains no IP address, no check value, no conversation identifier and no cookie content; questions in it cannot be traced back to a conversation or a person.
We use it to improve the exhibition and the guide, and we pass it on to TRR 356 PlantMicrobe at Ludwig-Maximilians-Universität München for scientific evaluation. Only content without any personal reference is passed on: if someone writes a name or something personal into a question, we remove it first. So please don’t enter names or contact details.
The legal basis is our legitimate interest in improving the exhibition and in its scientific evaluation (Art. 6(1)(f), Art. 89 GDPR). We delete the log once the scientific evaluation is complete, and no later than 31 December 2027.
Backups
We back up the guide’s database once a day on the same server. We keep seven backups; each older one is deleted. A backup contains the question log and the check values that happen to be within the one-hour window at the moment of the backup.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, write to info@campusready.de.
Because the question log has no link to a person, we usually cannot attribute a single question in it to anyone — and therefore cannot specifically hand it over or delete it. Feel free to tell us the exact wording and we will look for it.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.