Privacy Information

1. Scope

This information describes the processing of personal data when you register for and use the MAGNET research service. MAGNET predicts candidate molecular structures from EI mass spectra. The service is separate from the commercial NXT Spectra production system.

2. Controller

University of Münster, represented by its Rector, Prof. Dr Johannes Wessels,
Schlossplatz 2, 48149 Münster, Germany
Telephone: +49 251 83-0 · Email: mailbox@uni-muenster.de

Scientific contact for MAGNET: ajnabiul.hoque@uni-muenster.de

3. Data Protection Officer

Nina Meyer-Pachur, University of Münster, Schlossplatz 2, 48149 Münster, Germany
Telephone: +49 251 83-22446 · Email: datenschutz@uni-muenster.de

4. Hosting and technical operation

ChemInnovation GmbH, Gottfried-Hagen-Str. 60–62, 51105 Cologne, Germany, operates hosting and account administration on the University's instructions and processes personal data as a processor. Technical, account, access and deletion requests can be sent to info@nxt-spectra.de.

Before ChemInnovation independently reuses submitted spectra, predictions or derived research data for its own research or commercial machine-learning development, the link to your account and other personal identifiers is removed. This independent reuse concerns non-personal research data and is governed by the licence in the Research-use Terms.

5. Data we process

• Account data: name, email address, password hash, institution, country, research use case, account status and individual limit.
• Usage data: timestamps, job status, queue position, processing duration, error information and quota counters.
• Research data: complete submitted spectra, molecular formulae, technical parameters, all predicted structures, confidence information and derived results.
• Security data: an IP address is temporarily recorded after failed login attempts to restrict automated password attacks.

Passwords are stored only as one-way cryptographic hashes. Please do not submit personal data, special-category personal data, trade secrets, confidential material or third-party research data unless you are authorised to do so and accept the data-use licence.

6. Purposes and legal bases

• Account management, authenticated access and delivery of the research service: Art. 6(1)(e) GDPR in conjunction with the University's public research task.
• Scientific analysis, validation and further research: Art. 6(1)(e) GDPR in conjunction with Section 17 DSG NRW, where applicable.
• Service security, quota enforcement, misuse investigation and defence of legal claims: Art. 6(1)(f) GDPR or the corresponding public-task legal basis, as applicable.
• Non-commercial scientific and service-related communication directly connected with MAGNET or submitted research data: Art. 6(1)(e) GDPR in conjunction with the University's public research task and, where applicable, Section 17 DSG NRW.

The University, or ChemInnovation acting on its instructions, may contact you at the registered email address for scientific questions concerning your submissions, validation and research-quality assurance, invitations to non-commercial scientific surveys, information about relevant MAGNET research results or publications, and necessary account, security or service communication. Your contact details will not be used for commercial advertising or product marketing. You may object to non-essential contact at any time via info@nxt-spectra.de. Messages that legally qualify as electronic direct marketing will only be sent where a separate legal permission exists.

7. Recipients and transfers

Access is restricted to authorised members of the University research project and authorised ChemInnovation personnel responsible for hosting, account administration, security and approved processing. Personal data is not sold. It may be disclosed to public authorities where legally required or to professional advisers where necessary for legal claims.

The service does not use advertising trackers, analytics services or externally loaded web fonts. Personal service data is intended to remain on the designated server in Germany. No transfer to a third country is planned.

8. Cookies and sessions

MAGNET uses only a technically necessary, cryptographically signed session cookie for login and CSRF protection. It contains no name, email address, password or submitted research data. It is inaccessible to JavaScript, restricted to same-site requests and sent only over HTTPS in production. Sessions end after 60 minutes of inactivity and no later than 12 hours after login. Disabling the cookie prevents authenticated use.

9. Retention and account deletion

• Account and contact data is retained while the account is active and is erased on a valid deletion request or no later than six months after the service ends, unless a legal obligation or pending claim requires longer retention.
• Failed-login IP records are retained for no longer than 24 hours.
• Usage records remain linked to an account for no longer than 24 months where needed for security, misuse investigation and research quality assurance.
• When an account is deleted or the linkage period ends, direct account identifiers are removed. Submitted spectra, predictions and non-personal derived data may then be retained indefinitely for scientific research, reproducibility, model training, validation and commercial model development under the Research-use Terms.
• Anonymous aggregate statistics and model parameters that cannot reasonably be linked back to you may be retained indefinitely.

10. Your rights

Subject to the statutory requirements, you may request access, rectification, erasure, restriction, data portability where applicable, or object to processing. Research-related statutory restrictions may apply where exercising a right would make the research impossible or seriously impair it. Contact info@nxt-spectra.de or the University's Data Protection Officer.

You may lodge a complaint with the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, email: poststelle@ldi.nrw.de.

11. Provision of data and automated decisions

The required registration fields and research-data processing are necessary to provide controlled access to MAGNET and for the communication described above. Without them, an account cannot be created. MAGNET generates scientific predictions, but no decisions producing legal or similarly significant effects about you are made automatically.