Privacy Notice

1. Who We Are (Data Controller)

The Meta-Student platform is operated by the Sports Science Replication Centre at Technological University Dublin (TU Dublin), Ireland. The project coordinator and contact for all data protection matters is:

Joe Warne — Sports Science Replication Centre, TU Dublin
Contact: ssreplicationcentre.com/contact

TU Dublin's Data Protection Officer can be contacted at dataprotection@tudublin.ie.

2. What Personal Data We Collect

• Account data — your name, university email address, institution, role (student / supervisor), and a securely hashed password.
• Registration data— the studies you register for, your supervisor's name and email address, and any co-contributors' names, emails, and institutions that you provide.
• Submission data — the dataset files, ethics approval letters, methods reports, and signed Data Sharing Agreements you upload.
• Research participant data — pseudonymised participant-level data contained in submitted datasets (no names or direct identifiers are accepted; see section 7).
• Communications preferences — whether you have opted in to project update emails, and your acceptance of the Terms and this notice.

We do not collect special-category data about platform users, and we do not use cookies for advertising or tracking — only the session cookie required to keep you signed in.

3. Why We Process It (Legal Bases)

• Running your account and the submission workflow — necessary for the performance of our agreement with you (GDPR Art. 6(1)(b)).
• Scientific research — pooling submitted datasets into collaborative meta-analyses is carried out in the public interest / our legitimate interest in conducting scientific research (Art. 6(1)(e)/(f)), with the safeguards of Art. 89.
• Project update emails — your consent (Art. 6(1)(a)), which you can withdraw at any time using the toggle on your dashboard.
• Supervisor and co-contributor details — our legitimate interest in verifying supervision and correctly attributing contributions (Art. 6(1)(f)). Co-contributors receive a notification email when their details are added.
• Security and audit records — our legitimate interest in keeping the platform and its data secure (Art. 6(1)(f)).

4. Who Receives Your Data

• Platform administrators and the project coordination team — for quality review, supervision checks, and analysis.
• Your supervisor — receives your name and submission materials as part of the approval workflow you initiate.
• Service providers (processors) — our database and file storage are hosted by Supabase in the EU (Ireland, eu-west-1); the website is hosted by Netlify; transactional emails are sent through our email provider. These providers process data on our behalf under their data processing agreements.
• Open repositories — pseudonymised research data included in a published meta-analysis may be deposited in open repositories such as Zenodo, as described in the Terms and covered by participant informed consent.

We never sell personal data, and we do not use it for advertising.

5. How Long We Keep It

Retention follows TU Dublin's Research & Innovation Records Retention Schedule. In summary: research data not included in any analysis is retained for 7 years from the end of the project or destroyed on valid withdrawal request, whichever is sooner; ethics approvals for 7 years; protocols, methods documentation, and signed Data Sharing Agreements for 10 years; and data included in published, openly deposited meta-analyses in accordance with the repository's terms, which may be indefinite. Account data is kept while your account is active and removed when you delete your account (see section 6). Full details are on our FAQ page.

6. Your Rights

Under GDPR you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erasure(“right to be forgotten”, Art. 17) — you can delete your account directly from your dashboard; withdrawal of already-submitted research data is subject to the practical limits described in the Terms (§8) and FAQ;
• Restrict or object to processing (Arts. 18, 21);
• Data portability (Art. 20);
• Withdraw consent at any time where processing is based on consent (e.g. the project-updates email toggle), without affecting prior processing;
• Lodge a complaint with the Irish supervisory authority — the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2 — or with your local EU supervisory authority.

To exercise any of these rights, use the tools on your dashboard or contact the project coordinator (section 1). We respond within one month.

7. Research Participant Data

Datasets submitted to the platform must contain no names, contact details, or other direct identifiers — participants are represented only by a student-assigned anonymous ID. Because the collecting student retains the ID-to-identity linkage under their own institutional ethics approval, this data is pseudonymised rather than anonymous and is treated as personal data under GDPR. Research participants who wish to withdraw their data should contact the student researcher who collected it in the first instance; see the FAQ for the practical limits once data has been published in an open repository.

8. How We Protect Your Data

• All traffic is encrypted in transit (HTTPS/HSTS).
• Passwords are stored only as salted, peppered bcrypt hashes — we cannot read them.
• Uploaded files are not publicly accessible and are served only to authorised reviewers through short-lived signed URLs.
• Access to personal data is role-restricted, and administrative actions are recorded in an audit log.
• Data is hosted in the EU (Ireland).

9. Changes to This Notice

We will update this notice when our processing changes and revise the “last updated” date above. Significant changes will be announced to account holders by email or on the platform.