Public Layer Lab
Privacy
Last updated: 20 September 2026
This privacy notice explains how Stichting Instituut voor Digitale Publieke Systemen, using the public-facing name Public Layer Lab, handles personal data in connection with this website, correspondence, and related research exchanges.
Controller
Stichting Instituut voor Digitale Publieke Systemen ’s-Hertogenbosch, Netherlands KvK 42061376 Email: publiclayerlab@gmail.com
This website
Public Layer Lab operates a small static website.
Public Layer Lab does not currently use website analytics, advertising tools, newsletter tracking, contact forms, comments, or embedded social-media feeds.
The website is hosted using GitHub Pages. When a GitHub Pages site is visited, GitHub logs and stores the visitor’s IP address for security purposes.
Public Layer Lab does not use GitHub Pages visitor information for analytics, advertising, or profiling.
Contact by email
If you contact Public Layer Lab by email, the information you provide may include your name, email address, organisation, role, and the content of your message.
This information may be used to:
- read, manage, and respond to your message;
- follow up on questions, corrections, source material, research exchanges, or other matters you raise;
- maintain appropriate records where reasonably necessary for Public Layer Lab’s research or institutional administration;
- comply with applicable legal obligations.
For ordinary correspondence, Public Layer Lab relies on its legitimate interest in managing communications connected with its research and institutional activities.
Where information must be retained to comply with a legal obligation, processing is based on that legal obligation.
Public Layer Lab does not use correspondence for advertising, automated profiling, or automated decision-making.
Research contributions and source material
If you send Public Layer Lab corrections, source material, factual information, professional observations, or other material relevant to its research, that information may also be used to check, develop, or correct research and public analysis.
For this processing, Public Layer Lab relies on its legitimate interests in conducting accurate and accountable public-interest research, checking the factual basis of its work, correcting errors, and maintaining appropriate source provenance.
Private correspondence will not normally be published verbatim or attributed to you by name without first discussing attribution with you.
If information is being shared on a confidential or not-for-attribution basis, please make that clear when you provide it so that the intended terms of use can be established.
Information that is already publicly available may be cited or analysed as public-source material where this is lawful and appropriate.
Where proposed publication would involve consequential personal data, sensitive information, or material that was not originally provided for public use, Public Layer Lab will separately assess the purpose, legal basis, necessity, proportionality, and safeguards before publication.
Use of AI-assisted tools
Public Layer Lab may use AI-assisted tools, currently including ChatGPT provided by OpenAI and Claude provided by Anthropic, on a limited basis to assist with drafting, summarising, reviewing, or analysing correspondence and research material.
Where personal data are included in material submitted to these services, Public Layer Lab aims to limit the information shared to what is reasonably necessary for the task. Identifying details should be omitted or redacted where they are not needed.
Public Layer Lab does not use AI-assisted tools to make automated decisions about people.
Sensitive personal information should not normally be submitted to AI-assisted tools unless there is a specific and justified reason to do so.
If Public Layer Lab begins using additional AI providers to process personal data, this notice will be updated accordingly.
Retention
Ordinary enquiries and correspondence are normally deleted within 12 months after the matter is closed.
Where correspondence forms part of a substantive research, correction, collaboration, source, or continuing institutional exchange, it may be retained for up to three years after the last substantive exchange, where there remains a genuine reason to keep it.
Information that forms part of financial, contractual, or other legally required administration may be retained for the applicable statutory period.
Information may be deleted earlier where there is no longer a reason to retain it.
Third-party services and international processing
Public Layer Lab currently uses third-party services including:
- Google / Gmail for email;
- GitHub Pages / GitHub for website hosting;
- ChatGPT / OpenAI for limited AI-assisted drafting, review, and analysis;
- Claude / Anthropic for limited AI-assisted drafting, review, and analysis.
These services may involve processing of personal data outside the European Economic Area.
Google states that it relies on adequacy decisions where applicable, participates in the EU–US Data Privacy Framework, and uses Standard Contractual Clauses where required for transfers not otherwise covered by an adequacy mechanism. Further information, including how to request copies of applicable safeguards, is available in Google’s data-transfer framework.
GitHub
GitHub states that personal data may be processed in the United States and other countries and that, for transfers from the European Union to countries without an adequacy decision, it generally relies on the European Commission’s Standard Contractual Clauses. GitHub also participates in the EU–US Data Privacy Framework. Further information is available in GitHub’s General Privacy Statement.
OpenAI
For users in the European Economic Area, OpenAI Ireland Limited is the controller under OpenAI’s European privacy policy. OpenAI states that it relies on adequacy decisions where applicable and Standard Contractual Clauses for other international transfers. Information or copies of relevant safeguards can be requested from OpenAI. See OpenAI’s Europe privacy policy.
Anthropic
Anthropic identifies Anthropic Ireland Limited as the controller for consumer users in the European Economic Area. Anthropic states that international transfers outside the EEA are protected through adequacy decisions and Standard Contractual Clauses where appropriate. See Anthropic’s Privacy Center and its information on international data transfers.
You may contact Public Layer Lab at the address above if you would like further information about the third-party services used in connection with your personal data.
Your rights
Depending on the circumstances, you may have the right to:
- request access to personal data Public Layer Lab holds about you;
- ask for inaccurate data to be corrected;
- request deletion of your data;
- request restriction of processing;
- object to processing based on legitimate interests.
You can make a request by contacting:
Public Layer Lab will normally respond to a valid request within one month.
You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
Data you do not need to provide
There is no general requirement to provide personal data through this website.
If you choose to contact Public Layer Lab, some contact information is necessary in order to respond to you.
Please avoid sending sensitive personal information unless it is genuinely necessary for the matter you are contacting Public Layer Lab about.
Changes to this notice
This notice will be updated if the website begins using additional tools, Public Layer Lab begins using additional providers to process personal data, or Public Layer Lab materially changes how personal data connected with the website, correspondence, or research exchanges are handled.