Privacy notice

Information pursuant to Articles 12 and 13 of the General Data Protection Regulation (GDPR), version 2026-07-18.

1. Controller and contact

Finn Rehnert
Albert-Einstein-Allee, 89081 Ulm, Germany
Email: refinn01@thu.de

Data-protection contact:
No contact has been configured. If the university is the controller, its data-protection officer must be listed here.

2. Purpose and legal basis

The study compares two adaptive e-commerce systems and examines how algorithmically selected interface elements affect navigation and shopping decisions. Study data and browser storage are processed on the basis of your voluntary consent (Article 6(1)(a) GDPR and § 25(1) TDDDG). Security and access logs required to operate the service are processed to provide and protect the website (Article 6(1)(f) GDPR, where applicable).

3. Data processed

• the nickname you choose, the generated participant and session identifiers, assignment to a study condition and scenario, consent version and time;
• page views, clicks, scrolling, dwell time, cart and simulated-order actions, attention-check answers, completion code, and timestamps;
• algorithm decisions, displayed interface elements, interaction outcomes, propensities, and contextual attributes used by the research systems;
• browser and device information such as user agent, referrer, screen dimensions, and technical access data such as IP address in server logs.

Do not use your real name as a nickname and do not enter real names, addresses, email addresses, or payment information in the simulated shop. Checkout field values are not evaluated or saved by the study application.

4. Pseudonymization and publication

During collection, records are linked by participant and session identifiers and are therefore pseudonymized, not anonymous. Direct identifiers are not required. Publications and thesis results use only aggregated or anonymized data from which participants are not reasonably identifiable.

5. Cookies and browser storage

• wid and study_persona: study attribution, up to 1 hour;
• session_id: connects actions within the simulated shop, up to 30 days;
• local storage entries for study start time and page count: remain until browser storage is cleared;
• session storage for page depth and serving controls: until the browser tab is closed.

6. Recipients, hosting, and third-party resources

Access is limited to the researcher and authorised academic supervisors as required for the thesis. The website is hosted by: IONOS. The shop currently loads Bootstrap and Bootstrap Icons from the jsDelivr content-delivery network; the provider therefore receives technical request data and may process it through infrastructure outside the EU/EEA. Information about any third-country transfer and safeguards: The simulated shop loads frontend resources from the jsDelivr content-delivery network operated by Volentio JSD Limited in the United Kingdom. When these resources are requested, technical data such as the participant's IP address, browser information, requested URL, referrer domain and request time may be transmitted to jsDelivr and its delivery providers Cloudflare, Fastly and Gcore. Transfers to the United Kingdom are covered by an adequacy decision of the European Commission. Because a global delivery network is used, processing may also occur in other countries outside the EU/EEA.. No study dataset is sold or used for advertising.

7. Automated personalization

Algorithms select recommendations, offers, help elements, or other shop widgets using session behaviour. This is part of the experiment and has no legal or similarly significant effect. No real prices, purchases, credit decisions, or contractual decisions are made.

8. Retention and anonymization

Study records: Study records will be anonymously stored at least until 31.12.2027

Technical server logs: Technical server logs will be stored until 31.12.2027

9. Voluntary participation and withdrawal

Providing study data is not legally or contractually required. Without consent you cannot participate, but refusing or stopping causes no disadvantage outside any separate compensation rules of the recruitment platform. You may withdraw consent at any time by contacting refinn01@thu.de and providing your participant ID. Withdrawal does not affect processing that was lawful before withdrawal. Once data have been irreversibly anonymized, individual records can no longer be located or deleted.

10. Your rights

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent. You may also complain to a data-protection supervisory authority, including the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.