Privacy Policy

NADRE — the National Academic Digital Repository — is a service operated by EthERNet. This policy explains what personal data we collect, why we collect it, and what you can do about it.

1. Who is responsible

The controller for the personal data described in this policy is [FULL LEGAL NAME OF OPERATING ENTITY], of [REGISTERED ADDRESS], Ethiopia. EthERNet is responsible for deciding why and how personal data is processed in the repository.

Questions about this policy, or about our use of your data, can be sent to [PRIVACY CONTACT EMAIL].

2. What we collect

We collect only what is needed to run the repository and to protect it:

Account data. If you register, we store your name, email address, and a hashed password. We never store your password itself. If you sign in through an external identity provider such as ORCID, OpenAIRE or the EOSC AAI, we store the identifier that provider returns together with the name and email address it releases, and we do not receive or store your password for that provider.
Deposit data. Records you publish, including the files you upload, the metadata you supply, licensing decisions, and the timestamps of publication, versioning and withdrawal.
Technical data. IP address, browser type and requested URL, retained in server logs for security and troubleshooting.
Communications. Messages you send to us, including support requests, and the replies we give.

We do not ask for, and do not want, special-category data about you. Please do not place such data in files you deposit or in your account profile.

3. Why we use it, and on what legal basis

To operate the repository — publishing and preserving research outputs, and providing durable identifiers and stable links. This is our performance of a task in the public interest and our compliance with [LEGAL MANDATE, IF ANY].
To authenticate you — verifying that you are who you say you are when you sign in, deposit or edit a record. This is necessary for the security of the service.
To keep the service secure — detecting abuse, preventing automated scraping that degrades the service, and investigating incidents.
To support you — answering your questions and notifying you about changes to the service or to your records.

Where we rely on consent — for example, if you ask us to include your name alongside a record, or to send you notifications — you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

4. Who we share it with

We do not sell personal data. We share it only with:

Service providers acting on our instructions, including hosting, backup and email delivery. They may not use it for their own purposes.
Public metadata services, where a published record is openly licensed and intended for public discovery. The metadata of a published record — including your name where you chose to display it, and your ORCID iD if you connected one — is deliberately made public. It is not personal data that we keep private.
Authorities, where disclosure is required by law.

Records that are not openly licensed (embargoed, restricted or draft) are not exposed to public metadata services. Their metadata and files are served only to users with the access level set on the record.

5. Retention

Published records are intended to be kept permanently as part of the scholarly record. A published metadata record is not deleted on request; it may be withdrawn, which keeps the metadata and marks the files as no longer available.
Account data is kept for as long as the account is active, and for [RETENTION PERIOD] afterwards.
Server logs are kept for [RETENTION PERIOD].

[ADJUST THESE PERIODS TO MATCH ETHERNET'S ACTUAL RETENTION SCHEDULE.]

6. Security

Data in transit is protected with TLS. Passwords are stored only as cryptographic hashes. Access to the systems that hold repository data is restricted to the staff who need it. No system is perfectly secure, so please report any suspected problem to [SECURITY CONTACT EMAIL] rather than exploiting it.

7. Your rights

Subject to the law that applies to us, you have the right to:

obtain a copy of the personal data we hold about you;
correct personal data that is inaccurate or incomplete — most fields can be edited directly from your account settings;
request deletion of personal data we hold about you, where the law allows it. Note that published metadata forms part of the permanent scholarly record and cannot be deleted; you can withdraw the record instead;
object to, or restrict, processing carried out on the basis of legitimate interests;
receive your data in a portable, machine-readable form;
lodge a complaint with your data protection supervisory authority.

To exercise any of these rights, email [PRIVACY CONTACT EMAIL]. We may need to verify your identity first. We aim to respond within [RESPONSE PERIOD].

8. Cookies

The repository uses a small number of cookies, all strictly necessary to function: a session cookie that keeps you signed in, and a CSRF cookie that protects forms against cross-site request forgery. We do not use advertising or third-party tracking cookies. Session cookies are cleared when you sign out or when the session expires.

9. Children

The repository is intended for use by researchers and is not directed at children. We do not knowingly collect personal data from anyone under [MINIMUM AGE]. If you believe a child has provided personal data, contact [PRIVACY CONTACT EMAIL] and we will remove it.

10. International transfers

Our email delivery provider and some infrastructure providers process data outside Ethiopia. Where personal data is transferred abroad, we rely on [STATE THE SAFEGUARD, e.g. standard contractual clauses].

11. Changes to this policy

We will post any change to this policy on this page and update the date below. If a change materially affects how we use your data, we will notify registered users by email before it takes effect.

12. Contact

Data protection enquiries: [PRIVACY CONTACT EMAIL]
Security reports: [SECURITY CONTACT EMAIL]
Postal address: [REGISTERED ADDRESS]