Privacy policy

Controller

Controller within the meaning of Article 4(7) GDPR is:

Business Meets Tech e.V.
c/o WHU – Otto Beisheim School of Management
Burgplatz 2
56179 Vallendar
Germany
Represented by the executive board.

vall.ai is a division of the association and not a legal entity of its own; the association is therefore the controller for all processing described here. Enquiries concerning this website should be sent to jan.klassen@whu.edu. Enquiries concerning the association itself should be sent to info@businessmeetstech.de.

No data protection officer has been appointed. The conditions of Article 37(1) GDPR and of section 38(1) of the German Federal Data Protection Act (BDSG) are not met: the association is not a public body, its core activity consists neither in extensive regular and systematic monitoring of data subjects nor in extensive processing of special categories of data, and fewer than twenty persons are constantly engaged in the automated processing of personal data.

General information on the processing

Personal data is any information relating to an identified or identifiable natural person. This policy describes each processing operation on this website separately, together with its purpose, its legal basis, the recipients of the data and the period for which it is stored.

The legal bases relied on are Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (performance of a contract or of pre-contractual measures taken at your request) and Article 6(1)(f) GDPR (legitimate interests). Where a processing operation rests on legitimate interests, the interest in question is named in the relevant section.

This website is delivered exclusively over an encrypted TLS connection. All files are served from this domain; no fonts, images, scripts or other resources are loaded from third-party servers.

Hosting and server logs

This website and the Studying Suite at suite.vall-ai.com are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, providing the hosting infrastructure. Their server functions run in Frankfurt am Main (region fra1).

When a page is called up, your IP address, the date and time of the request, the page requested, the HTTP status and your browser identification are transmitted to the host and stored there for a short period. The purpose is the technical delivery of the site and its protection against attacks and misuse. Legal basis: Article 6(1)(f) GDPR; the legitimate interest is the secure and stable operation of the site.

Database

Everything this site stores permanently is held in a PostgreSQL database operated by Neon Inc., San Francisco, California, USA, providing the database infrastructure. The configured deployment region is Frankfurt am Main, Germany (eu-central-1); the provider may also process service and support data.

This concerns the data described in the sections below: accounts and sessions, messages, newsletter subscriptions, event registrations, submitted use cases, votes, survey answers and the visit counter. Legal basis: the basis stated in the relevant section for each processing operation.

Internal administration

Authorised team members use a separate password-protected administration area. Its signed HttpOnly cookie __Host-pa_intern lasts up to twelve hours and identifies the internal user. Stored password verifiers are salted hashes. This administration login is separate from WHU member accounts. The administration area also sets a cookie intern-flash for ten seconds to show the result of an action, and stores in the browser whether its assistant panel is open (localStorage) and the current assistant conversation, at most the last 30 turns (sessionStorage).

Storing it is strictly necessary in order to provide the service you expressly requested by signing in, so it requires no consent under section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Legal basis for subsequent processing: Article 6(1)(f) GDPR; the legitimate interest is limiting administration and access to personal data to authorised team members.

Information stored on your device

During private testing, a separate shared preview password protects the website before the personal account screen. The preview password alone does not grant account access. Its signed __Host-pa_gate cookie remembers this access for up to seven days. It is HttpOnly, Secure, SameSite=Lax and restricted to the website host; it contains no email address and does not replace the personal WHU account. Storage is necessary for the requested protected preview under section 25(2)(2) TDDDG; security processing is based on Article 6(1)(f) GDPR. Legal information, contact and signed newsletter unsubscribe links remain accessible without this password.

In addition to the cookies described in this policy, the browser stores your selected language and the use cases you have voted for locally. The introduction animation uses only the current page’s memory. A temporary sessionStorage flag displays the registration-success message and is removed after it is read; it contains no account details.

The Studying Suite at suite.vall-ai.com stores your library only in this browser: settings including any API keys you enter, and course, card, chat, mind-map, exam and progress data in localStorage (keys beginning with “pai.”), PDFs and images in IndexedDB (database “whu-recall”), and a temporary sessionStorage flag. The Suite may ask the browser to protect this storage from automatic eviction. This storage is strictly necessary to provide the Suite you requested (section 25(2) no. 2 TDDDG); its contents are not transmitted to us.

The language setting preserves your expressly selected language, and the vote indicator displays your previous action. These functional settings are stored under section 25(2) no. 2 TDDDG. You can remove the local settings in your browser’s site-data settings.

The vote itself is additionally transmitted to us when you cast it. What is stored on our side is described under "Votes and surveys" below.

Usage statistics and download records

When the server provides a protected skill ZIP in response to a file request, we record the account identifier, product identifier and time. This records the request and prepared response, not proof that the file was saved on your device. Authorised team members can view these records with the account email in the internal dashboard to diagnose access and delivery issues and identify affected users. This is not advertising tracking. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in operating and supporting the requested downloads. You can object on grounds relating to your particular situation. Records are retained for up to twelve months or erased earlier with the account. Hosting request logs and security rate limits are described separately.

To see how the site is used, our server counts page requests and clicks on the buttons that open an agent or the Studying Suite, at the moment the request reaches it. No script runs on your device for this and nothing is stored on or read from your device; no cookie is used. From the request your browser sends anyway, we store the page or button, the time, a coarse device class (mobile or desktop), the preferred browser language (German or other), the domain of a referring external website without path or query, a flag for self-declared automated clients, and a keyed hash of IP address, browser identification and date. The hash changes every day, so entries from different days cannot be linked to one another; IP address and browser identification themselves are not stored. These entries are pseudonymous, not anonymous. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in understanding which pages and offers are used and in improving them. You can object at any time on grounds relating to your particular situation, for example via the contact page. Entries are erased after twelve months. The figures are visible only to the authorised team in the internal dashboard and are not shared with third parties or used for advertising.

Otto, the AI assistant

Otto is available from the button in the bottom right corner, including without an account. To answer, your question, the earlier turns of the same conversation and the address of the page you are viewing are transmitted to Langdock GmbH, Greifswalder Straße 212, 10405 Berlin, which generates the answer on our behalf under a data processing agreement, using its configured model providers as subprocessors. If the first model is unavailable, the same request may be answered by a second model through Langdock. The scope of provider processing depends on the model and contractual settings.

If no model is configured or a request is refused before dispatch, the browser can request a server-side keyword search without an account. A provider error after dispatch does not undo that transfer. To protect login and API endpoints, pseudonymous request counters are held in the database across instances. They contain a keyed hash, count and expiry, not a raw IP address; expired counters are removed in bounded batches during subsequent requests after 24 hours. Legal basis: Article 6(1)(f) GDPR; the legitimate interest is operating the service and preventing abuse.

In this quick-answer mode, your question and, if there is one, your previous question in the same conversation are sent through Vercel AI Gateway (Vercel Inc.) to TypeSafe AI, Inc., USA, whose model Jev selects which of our prepared answers fits. Jev does not write any text; the answer shown is always one of our fixed texts. Zero data retention is requested for these requests. If Jev is unavailable, our server selects the answer by keyword rules alone. Legal basis: Article 6(1)(f) GDPR; the legitimate interest is answering your question when the language model is unavailable.

The public website assistant can be used without an account. For each answer our server sends up to twelve recent messages to Langdock, your own limited to 600 characters each and the assistant's earlier replies shortened to 1,600 characters, together with public descriptions of the website and its catalogue and the current date. Protected article bodies and internal account records are not part of that catalogue. The account email or member identifier is not automatically attached; information you type yourself is part of the message, so please avoid personal or confidential details. Chat history stays in the page's memory and is not saved in an application chat database. Provider processing and retention remain subject to the applicable provider arrangements described below.

Otto processes questions you deliberately submit. Legal basis: Article 6(1)(f) GDPR; our legitimate interest is answering requested questions about the website. Use is optional and the website remains usable without the assistant. Your right to object is described below. Otto is not a private communication channel with the team; please avoid sensitive or unnecessary personal data.

Contact form and messages

If you send us a message using the contact form, we store the fields you completed, that is your name, your email address, the subject of your enquiry and the text of your message, together with the time of receipt. The purpose is to answer the enquiry.

Legal basis: Article 6(1)(b) GDPR where the enquiry concerns a contract or its initiation, otherwise Article 6(1)(f) GDPR; the legitimate interest is answering the enquiry you addressed to us.

After storing your message, the server attempts to send a confirmation using a fixed template. Your message is not sent to a language model for classification or drafting that receipt. Delivery can fail or remain uncertain; acceptance by the mail server does not establish arrival in your inbox.

Your message is assigned internally to the team member responsible for the subject matter and handled in the internal administration area; it is not forwarded by email. A personal reply uses a sending address and a Reply-To address for direct follow-up.

For each message we record when the confirmation was sent, when the message was passed on, when a reply was sent, and whether any of these steps failed. The purpose is to ensure that no enquiry goes unanswered without this being apparent. Legal basis: Article 6(1)(f) GDPR; the legitimate interest is the traceable handling of enquiries.

Sending of emails

All emails sent by this site, that is sign-in links, confirmations of receipt, double opt-in messages, replies and the newsletter, are dispatched through Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, providing the email dispatch service.

For that purpose the provider receives your email address, the subject line and the content of the message. Legal basis: the basis stated for the processing that the email belongs to.

The internal outbox additionally stores recipient, subject, message content, any attachments, the related enquiry or event, delivery state and provider response in our database. It supports processing the enquiry and checking or resuming interrupted delivery. SMTP acceptance does not establish arrival in your inbox; uncertain attempts require a provider check before they are repeated. Outbox records follow the retention period of the related enquiry or event.

Submitted use cases

A submitted use case is stored with the details you entered, including your email address. A fixed receipt is sent and the submission remains a draft for human review. It is not automatically classified, rewritten or rejected by a language model.

A person decides whether to take up or decline the idea. You can contact us to request review or correction of the submission.

Legal basis: Article 6(1)(f) GDPR; the legitimate interest is processing the submission you sent us and keeping the public list free of abusive content.

WHU account and sign-in

Overview pages are public. Reading individual articles or studies, downloading tools, accessing the Studying Suite, voting and submitting use cases require a free WHU account. Registration stores your WHU email, selected student/alumnus/faculty and staff category, programme and year where applicable, current-enrolment declaration, form language, request source and times, confirmation times and accepted terms version/time. We store a salted scrypt password hash, never your plaintext password. Email confirmation verifies mailbox control, not a university register. Legal basis: Article 6(1)(b) GDPR for the requested account and Article 6(1)(f) GDPR for abuse prevention and limiting access to the intended community. Accepting terms is not consent to optional processing. Newsletter subscription is separate.

For account verification or password setup/reset we send a confirmation link to your WHU address. Existing verified accounts can sign in with a password. A completed password setup/reset revokes previous sessions. The confirmation link expires after 15 minutes and can be confirmed only once. Requesting another replaces the previous link. Only a hash of the random proof is stored in our account database. Opening the link alone does not sign you in: you confirm on the page. After confirmation, the vall_pass cookie holds a random session identifier, not your email address or year group. Its server-side record links the session to your account. Newly issued sessions expire after 365 days unless revoked earlier; sessions issued before this change keep their original expiry. The cookie is HttpOnly and Secure in production, with SameSite=Lax, and is valid for vall-ai.com and its subdomains (used by suite.vall-ai.com). It is used to authenticate the service you requested, not for advertising. This necessary authentication storage falls under section 25(2) no. 2 TDDDG; subsequent account processing is based on Article 6(1)(b) GDPR.

The account records the most recent sign-in; a download can update that usage date at most once daily. This supports administration of active and unused accounts. Protected downloads and usage statistics are recorded as described above. The Suite checks session validity online when serving protected pages and periodically while open; if verification is unavailable it locks access. No remembered offline grant replaces that check. Our access response to the Suite contains status, expiry and an internal account number, not your email address, year group or learning library.

Signing out revokes the current session. Account deletion revokes all account sessions. Account deletion removes the account, sessions, sign-in proofs, personal download history, event registrations and copies of event notification emails sent to you, associated votes and identifiable survey answers from the application database. Newsletter subscriptions and contact or submitted-use-case correspondence are separate records and are not automatically erased through this button. Use the newsletter unsubscribe link or contact us to exercise your rights for those records. Provider backups and logs follow their separate retention periods and cannot be erased through this account button.

The account does not synchronise the Suite's PDFs, flashcards, learning progress or API keys. They remain in your browser profile and are shared by accounts using that same profile. AI requests send the relevant material directly from your browser to the provider you selected, under your own contract with that provider: native PDFs to Anthropic, Google (Gemini) and OpenAI, and locally rendered pages to Mistral and OpenRouter, which forwards requests to the underlying model provider. Chat and generation requests can also include your saved learning notes and settings. We do not receive these requests and do not commission this processing. Anthropic, OpenAI, Google and OpenRouter are based in the USA; transfer, storage and use are governed by the provider's terms. PDF page counts and images may be reused in bounded tab memory until reload; no cloud memory or embedding service is involved. Mindmap source-page references are saved locally and exported in backups; preview images require the local original PDF, which is not exported. Sign-out and account deletion do not remotely erase these local data. Export your library before ending access if you wish to keep it; local deletion is available in Suite settings and through the browser's site-data controls. Use separate browser profiles on shared devices.

Newsletter

Newsletter signup is optional, separate from account terms and not required for access. You can select it during registration or request it in your account. If you select the optional newsletter checkbox during registration, your account confirmation also confirms that newsletter request; no separate newsletter confirmation email is sent. Without that checkbox, account confirmation does not subscribe you. A later request in your account or through the standalone newsletter form uses a separate confirmation email with a link valid for 48 hours; requesting another replaces it. Signing up stores your email address, language and request and confirmation times. No newsletter is sent before the relevant confirmation is completed on the page. The optional choice followed by mailbox confirmation records your consent under Article 6(1)(a) GDPR and protects against requests made using someone else’s address.

For each issue we record which addresses it was sent to, whether the mail server accepted it, and any errors or uncertain delivery states. The purpose is to trace delivery attempts and resume interrupted sends while reducing duplicates. Uncertain attempts require a provider check. SMTP acceptance does not establish delivery to the recipient inbox. Legal basis: Article 6(1)(f) GDPR; the legitimate interest is the demonstrable and non-duplicated delivery of the newsletter. Our dispatch service Brevo offers open and click measurement by default. With every email we instruct Brevo not to measure opens or clicks, and tracking is switched off in our Brevo account, so opens and clicks are not linked to you. We do not evaluate such data.

You can unsubscribe or cancel a pending newsletter request in your account. Every issue carries an unsubscribe link in its footer. The link is signed and is therefore valid only for the address it was issued for. Unsubscribing requires no reply and no reason. Withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal (Article 7(3) GDPR).

Events

This site lists events. Registration does not take place here but on Luma, an external service. The registration link on an event page takes you to Luma; from there, Luma's own terms and privacy notice and those of the event's organisers apply, and this site receives no data about your registration.

Until October 2026, registration was possible on this site. Those registrations (WHU email address, year group, a first name derived from the address, language and the times of registration and cancellation) are kept only until the end of the half-year in which the event took place and then erased, or earlier on request to jan.klassen@whu.edu or with your account. Legal basis was Article 6(1)(b) GDPR.

Votes and surveys

Voting for a use case and answering a survey require the signed-in WHU account described above. The server derives identity from the account rather than accepting another address typed into a form. The results of both are stored in the database described above, and the two are treated differently.

The vote table does not store your address directly. It stores a keyed hash derived from it, the time and the item voted for. This is pseudonymisation, not anonymisation: with the server-side secret and a known address, we can identify the associated votes, for example to handle an erasure request.

Unless you choose to answer anonymously, your email address is stored with the answers. For the anonymous option your account provides the access check but its address is not stored with the response. So that each person can answer a survey only once, we store separately, without a time and without any link to the answer, a keyed hash of your address for that survey; it is deleted with your account or with the survey's data. Free-text answers may nevertheless identify you or another person; please avoid such details. We can handle requests relating to an answer only if we can locate it reliably.

Individual votes and responses are not published; only aggregate results are published. The data is processed through the database and infrastructure providers named in this policy.

Voting requires the access described above and nothing else: no address is entered, no box is ticked and there is no form, because the address is already on your access and the vote is derived from it. Legal basis for a vote: Article 6(1)(f) GDPR; the legitimate interest is that one person counts once, on a list the team actually builds from. For a survey answer, where you voluntarily participate and tick the consent box, the basis is Article 6(1)(a) GDPR and your consent is given by that act. You may withdraw it at any time with effect for the future; withdrawal does not affect the lawfulness of the processing carried out before it (Article 7(3) GDPR).

Automated assistants

The internal assistant Otto uses a read-only interface for predefined operational questions. Separately approved views can provide authorised named team members with email addresses and registration, confirmation or cancellation status for WHU accounts, pending account requests, newsletter subscriptions and legacy website event registrations; submitted use-case content and its moderation status; and the team member, action and time of recorded moderation. These views support administration of the corresponding service and handling submissions, not unrelated marketing or linking mailing lists to account activity. Each new view requires explicit approval before activation. Passwords, password hashes, authentication tokens, reset links and individual learning data are excluded. The shared service credential cannot retrieve identifying lists or unreviewed submission content. Content is reviewed by a person before publication; Otto cannot send mail or make moderation decisions.

New moderation records store the acting internal user, the affected use-case identifier, action and time for 180 days to make changes traceable. They contain no submission text or email address; earlier actions are not retrospectively attributed. These records are erased earlier if the use case is deleted. New event registrations on Luma are not imported through this interface. Langdock chat contents and results follow the applicable provider retention settings; deletion of our access metadata does not delete provider chats or backups.

Questions that logged-in team members type into the internal assistant are sent to Langdock together with the conversation so far and an overview of the site’s figures and editorial status: counts and survey tallies, titles and states of articles, events, surveys and newsletter issues (including the team’s drafts), and titles and summaries of published use cases. The overview contains no names, email addresses, message contents, free-text answers or unreviewed submissions. Personal results in the dashboard are displayed directly and are not sent to the model or stored in shared chat history. Personal results requested through a private Langdock connection are disclosed to that provider and require a separate approval. Access records contain the requesting user, channel, purpose, operation, event filter, time, outcome and row count, but no result payload, and are deleted after 180 days. Legal basis: Article 6(1)(f) GDPR; the legitimate interest is the efficient administration of the website by the team. Langdock processes these requests on our behalf under a data processing agreement.

Recipients and processors

The following providers receive personal data for the functions described above. We have data processing agreements under Article 28 GDPR with them; for Vercel, Neon, Brevo and Langdock these form part of the respective terms of service:

Vercel Inc., Covina, California, USA (hosting)
Neon Inc., San Francisco, California, USA (database, instance in Frankfurt am Main)
Brevo GmbH, Köpenicker Straße 126, 10179 Berlin (dispatch of emails)
Langdock GmbH, Greifswalder Straße 212, 10405 Berlin (language models and assistants)
TypeSafe AI, Inc., USA, through Vercel AI Gateway (selection of prepared answers in Otto's quick-answer mode)

Within the association, the responsible team members access enquiries through the internal administration area. Infrastructure and model providers may engage subprocessors under their contractual arrangements. No advertising service, tracking pixel or social-media plugin is integrated in this website. Fonts are served by this website. Data is disclosed to public authorities where required by law.

Transfers to third countries

Vercel Inc. and Neon Inc. are based in the USA. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework; transfers to Vercel are based on the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR). Transfers to Neon are based on the standard contractual clauses of the European Commission (Article 46(2)(c) GDPR) contained in Neon's data processing agreement. Questions in Otto's quick-answer mode reach TypeSafe AI, Inc., San Francisco, USA, through Vercel AI Gateway, that is through Vercel as our processor and under its data processing agreement. Vercel engages TypeSafe AI under a zero data retention agreement: questions are kept only as long as needed to produce the answer and are not used for training. Every request requires this agreement; without it the request is not forwarded. A database or server region in Germany does not exclude access from third countries. You can request a copy of the safeguards using the contact details above.

A provider subject to third-country law may face disclosure requests from public authorities. The protection and remedies depend on the applicable transfer mechanism and recipient; an EU hosting region alone is not a guarantee against such access.

Storage periods

The periods below describe our retention policy under Article 13(2)(a) GDPR. A daily automated job deletes visit records and personal download records older than twelve months, removes name and email address from event registrations and the related event notification records once the half-year in which the event ended is over, and deletes access records of the internal assistant after 180 days. The same job deletes sign-in links and sessions that have been expired for more than 24 hours, and newsletter sign-ups that were not confirmed within seven days together with their unused confirmation links. Expired sign-in links and sessions are also removed earlier, during subsequent sign-in requests, and expired rate-limit counters during subsequent requests after 24 hours; their expiry prevents further use regardless of cleanup. Unused confirmation links are deleted by a separate administrative process more than 24 hours after expiry. The remaining periods below are implemented through a periodic review by the responsible team. Data is erased earlier on request where no legal retention obligation prevents it.

A message and the record of its handling are kept for as long as the enquiry is open and for two years after it has been answered, since enquiries about agreements made with sponsors or supervisors recur beyond one term. Name and email address of an event registration are erased at the end of the half-year (30 June or 31 December) in which the event took place; what remains is an entry without name or address, with status, language and year group, used only for attendance figures. After you unsubscribe, your address is excluded from delivery and remains with its unsubscribe status to prevent further sends. The subscription and delivery evidence are reviewed for erasure after two years; erasure can be requested earlier.

A submitted use case is kept while the idea is under consideration; its address is erased two years after the submission was answered. Pseudonymous votes are kept while the associated idea is open and are reviewed for erasure when it closes; you can request erasure using your address. Anonymous survey responses remain as long as needed for the survey’s documented purpose. Identifying addresses on other survey responses are erased two years after the survey closes, or earlier on request; retained results must no longer identify the respondent. Accounts are erased through account deletion or on request. Inactive or revoked accounts are reviewed for continued necessity; graduation alone is not an erasure deadline because alumni and staff may also hold accounts. This review is an administrative responsibility, not an automatic scheduled job. Personal download records are subject to the separate twelve-month limit above and are erased earlier with the account. Visit records are erased after twelve months. Access records of the internal assistant are deleted after 180 days.

Whether you have to provide data

Information under Article 13(2)(e) GDPR: registration is voluntary. A verified WHU email address, a password, WHU affiliation and acceptance of the terms are required for an account. Programme and graduation year are requested where applicable; current students declare their enrolment. Overview pages remain accessible without sign-in. Opening individual articles or studies, protected downloads, the Studying Suite and account-bound submissions or votes require sign-in. Provider information, privacy policy, terms and contact remain publicly accessible.

The fields marked as required in a given form are, however, necessary in order to provide the function concerned: without an email address no reply and no confirmation can be sent, and without a verified WHU account the membership restriction for votes and survey responses cannot be enforced. If you do not provide those details, that function is unavailable; there is no other consequence.

No automated decision-making

Information under Article 13(2)(f) GDPR: no automated decision-making within the meaning of Article 22(1) GDPR, including profiling, takes place on this site. Submitted use cases are reviewed by a person; no automated assessment takes place.

Your rights

You have the right to obtain confirmation as to whether personal data concerning you is processed and to obtain access to it (Article 15 GDPR), to obtain rectification of inaccurate data (Article 16 GDPR), to obtain erasure (Article 17 GDPR), to obtain restriction of processing (Article 18 GDPR) and to receive the data you have provided in a structured, commonly used and machine-readable format (Article 20 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Article 7(3) GDPR).

To exercise any of these rights, an email to jan.klassen@whu.edu is sufficient and no reason need be given. You may also write to the postal address given in the imprint.

You further have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz
Germany

Right to object

This information is given separately, as Article 21(4) GDPR requires.

Where processing of your personal data is based on Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing (Article 21(1) GDPR). If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

An informal message to jan.klassen@whu.edu is sufficient to object.

Amendments to this policy

We amend this policy whenever a change to the site changes what happens to data, and we do so before that change goes live. The date below states when the version you are reading took effect.