1. Controller and contact
The controller is Heritage International Institute (HII), Via Camilla 3, 00181 Rome, Italy, C.F. 96638600583. Questions, privacy requests, provenance concerns and takedown notices may be sent to info@lebanonarchive.org.
The Directorate General of Antiquities of Lebanon (DGA) is a project partner and beneficiary of the licence granted for the contributed material within the access level selected by the contributor. HII determines the purposes and means of the personal-data processing described in this notice.
2. Data we collect
We process the contributor's name, mandatory email address, optional phone number, organisation and country; descriptions, dates, places, keywords and provenance information; access and attribution choices; legal confirmations and their timestamps; uploaded files; technical identifiers, checksums and submission records; and limited security and request logs.
Do not use the public form for passwords, financial information, medical records, criminal-offence data, highly confidential correspondence, or material whose lawful submission has not been established. A person under 18 must not submit independently.
3. Purposes and legal bases
- Contribution agreement — Article 6(1)(b) GDPR: to receive and administer the contribution, record the selected access level and attribution, preserve and catalogue the material, communicate with the contributor, and apply the Contributor Terms.
- Legitimate interests — Article 6(1)(f) GDPR: to safeguard Lebanese cultural heritage exposed to destruction, deterioration or dispersal; preserve provenance and archive integrity; protect the service; screen files for security risks; manage rights claims, restrictions and takedowns; and establish, exercise or defend legal claims.
- Legal obligations — Article 6(1)(c) GDPR: where processing is required by applicable law or a competent authority.
- Consent: only where a separate, optional use specifically requires it. Consent is not used as the general basis for operating the archive.
HII does not intentionally request special-category data through the form. If uploaded material incidentally reveals sensitive information, HII may restrict access, request further evidence, redact, reject or remove the material and will make it public only where a valid legal basis and the necessary safeguards exist.
4. Why certain data is mandatory
Fields marked “Required”, the uploaded material, the selected access level and the legal confirmations are necessary to create and administer a submission. An email address is required so HII can identify the contribution, contact the contributor about rights or cataloguing questions and respond to requests. Without the required information, the contribution cannot be accepted through the form.
5. Recipients and service providers
- CNR/DARIAH Nextcloud: provides the protected infrastructure that receives the submission package. After receipt, CNR is responsible for its internal security screening and archive workflow.
- Vercel: hosts the website and server-side submission function. Uploaded data passes through the function before being transferred to the CNR infrastructure; the website does not intentionally retain a second permanent archive copy on Vercel.
- Google Workspace: provides the project mailbox used for contact and administrative correspondence. Archive files are not intentionally stored in that mailbox.
- Authorised HII personnel and service providers: access is limited to what is needed for administration, security, cataloguing, rights management and support.
- DGA: may receive or use contributed material only within the Contributor Terms and the access level selected by the contributor.
Personal data may also be disclosed where required by law, to protect rights or safety, or to resolve a credible ownership, provenance or rights claim.
6. International transfers
The CNR archive infrastructure is located in Italy. The hosting and email providers may process limited data outside the European Economic Area. Where Chapter V GDPR applies, HII relies on the safeguards included in the relevant provider agreement, including applicable Standard Contractual Clauses, together with access controls and data minimisation.
7. Retention
- Accepted cultural material, essential metadata, provenance, permissions and rights records: for the lifetime of the Archive and potentially permanently, because the Archive exists to safeguard heritage exposed to war, destruction, deterioration and dispersal.
- Rejected, abandoned or incomplete submissions: normally no longer than 12 months, unless a longer period is needed for a rights claim, security incident or legal obligation.
- Security and operational logs: normally up to 12 months, subject to the provider's shorter technical retention or a longer period required for an incident or legal claim.
- Backups: retained according to the applicable infrastructure cycle and then overwritten or deleted, unless preservation is required by law or for an active incident.
Retention is reviewed periodically. HII applies data minimisation, access restrictions, pseudonymous technical identifiers and separation between administrative contact data and public catalogue information where appropriate.
8. Publication, attribution and access choices
Submitting material does not automatically make it public. The access level selected in the form controls the permitted uses, subject to legal review and the Contributor Terms. Public catalogue information will not include the contributor's email or phone number. Attribution follows the contributor's selected preference where reasonably possible.
9. Your rights
Subject to the conditions and limitations of applicable law, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may also request a future change to the public access level. Some information may need to be retained in restricted form to preserve the integrity and legal history of the Archive, comply with law, resolve claims or document completed lawful uses.
Send requests to info@lebanonarchive.org and include the submission reference where available. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority.
10. Security and automated decisions
HII uses server-side validation, restricted credentials, unique submission and file identifiers, integrity checksums and protected transfer to the CNR archive. No decision producing legal or similarly significant effects is made solely by automated means. Security screening may restrict a file pending human review.
11. Cookies and changes
The project site does not use analytics, advertising or non-essential cookies. Essential hosting security and request logs may still be generated. See the Cookie Notice.
Material changes to this notice will be published with a new version and effective date. The version accepted with each submission is recorded in the archive package.
12. Version history
Version 1.0 — 9 October 2026: first operational English notice.