Installation Privacy Statement Template
A fill-in privacy statement that an organisation running a LeraLink installation can publish for its own members and readers.
Last updated: 12 November 2026
How to use this template
Guidance — delete: This template is provided by SSStudio, trading as LeraLink, for customers that run an installation. When you run an installation, you are the controller under the General Data Protection Regulation (GDPR) for the personal data of your members, contributors and readers in that installation, and SSStudio is your processor under the Data Processing Agreement. Articles 13 and 14 of the GDPR require you to tell people how you process their data. This template covers what the LeraLink platform does in an installation. It does not cover what your organisation does outside LeraLink (for example your own membership administration, accounting or other systems): add that yourself.
Guidance — delete: Fill in every field in square brackets. Delete the rows and sections for features your installation does not use. Delete every paragraph marked "Guidance — delete" before publishing. The template is written for a controller established in the Netherlands; if you are established elsewhere in the EU, replace the references to Dutch law and the Dutch supervisory authority. This template is not legal advice; have it reviewed if your installation processes sensitive data or if you are a public authority.
Guidance — delete: Publish the result as a page of your installation and link it from the footer and from the place where people join and subscribe. Where the template says [link], insert the full web address of the LeraLink document on hub.lera.link, so that the link works on your own domain. Use "Privacy Statement of [Installation name]" as the title of the published page and everything below it as its body. Then enter the page's address in Tenant Admin, in the installation's general settings, as its privacy statement: new members are then shown it and accept it when they create an account, and the platform records which version they accepted.
Privacy Statement of [Installation name]
Version [number] · Effective [date]
1. Who we are
This privacy statement explains how [Organisation legal name] ("we", "us") processes personal data in [Installation name], our knowledge site at [web address].
| Controller | [Organisation legal name] |
|---|---|
| Address | [Address] |
| Chamber of Commerce (KvK) | [KvK number] |
| Contact for privacy questions | [privacy contact email address] |
We are the controller for the personal data processed in our installation. That means we decide why and how it is processed, and we are responsible for it.
2. Data protection officer
[Option A: We have appointed a data protection officer. You can contact them at [DPO name or role], [DPO email address].]
[Option B: We have not appointed a data protection officer, because we are not required to. For privacy questions, contact [privacy contact email address].]
Guidance — delete: A data protection officer is required for public authorities and bodies, and for organisations whose core activities consist of large-scale regular and systematic monitoring of people, or large-scale processing of special categories of data (GDPR art. 37). A political party, trade union, religious community or similar organisation that processes its members' data on a large scale should check whether this applies to it. If you have a DPO, register them with the Autoriteit Persoonsgegevens.
3. How our installation works
Our installation runs on LeraLink, a knowledge publishing platform provided by SSStudio, trading as LeraLink, in the Netherlands. SSStudio processes personal data for us as our processor, under a data processing agreement, and may only use it on our instructions.
Your LeraLink account is platform-wide: you can use the same account to join other installations on LeraLink. For a limited set of activities, SSStudio is itself the controller, and LeraLink's own Privacy Statement applies ([link to LeraLink's Privacy Statement]). These are:
- creating and securing your account, and signing you in;
- the security of the platform as a whole;
- handling reports of illegal content under the Digital Services Act; and
- LeraLink's own record of public concepts and entities used for discovery across installations.
We never see which other installations you belong to.
Some processing involving people who appear in more than one installation, such as an author's shared identity and public discovery of their work across LeraLink, may be decided by us and SSStudio together or separately. Where we are joint controllers under article 26 of the GDPR, we explain the essence of that arrangement here: [describe the arrangement, or delete this sentence].
Guidance — delete: Check the current version of LeraLink's Privacy Statement and the Data Processing Agreement, and keep this section consistent with them. If you have agreed a joint controller arrangement with SSStudio, summarise its essence here, as article 26(2) of the GDPR requires.
4. What we process and why
The table below lists the personal data processed in our installation, the purpose, and the legal basis under article 6(1) of the GDPR. Section 5 explains the legal bases.
| Data | What it includes | Purpose | Legal basis |
|---|---|---|---|
| Account and profile | Your email address, name, profile picture, biography, public profile address, interface and content languages, and the identifiers you choose to add (such as ORCID or ISNI). | To let you sign in, take part, and be recognised as the author of your work. | [Contract (b)] |
| Membership and roles | When you joined, your status, your roles (for example reader, author, editor, reviewer, administrator), access you were given, and when it ends. | To give you the access that fits your role, and to manage our community. | [Contract (b)] [or legitimate interests (f)] |
| Contributions | Pieces you write, translate, edit or publish, in every language and version; your credits and roles on works; sources and references you add; rights and licence information; drafts. | To publish knowledge, to credit authors correctly, and to keep a reliable record of who contributed what. | [Contract (b)] and, for keeping the record of published works, [legitimate interests (f)] |
| Comments, annotations and reactions | What you write in comments and annotations, your reactions, and reports you make about comments or annotations. | To let readers and members take part in discussion and to keep that discussion orderly. | [Contract (b)] |
| Editorial submissions and reviews | Submissions, manuscripts, rounds, decisions, your responses, reviews you write, acknowledgements you accept, and editors' notes. | To run editorial review and publication decisions. | [Contract (b)] and, for keeping the editorial record, [legitimate interests (f)] |
| Newsletters and publication emails | Whether you receive new publications by email and the newsletter, the language you want them in, how and when this setting was made or changed (by you, or by default when you joined), which newsletters were sent to you, and whether you opened a newsletter and which links in it you clicked. | To send you new publications and the newsletter, and to measure the newsletters' reach. | [Legal basis: see the guidance below this table] |
| Event registrations | Events you register for, your language and your registration status. Depending on the setting of each event, your picture and a link to your public profile may be shown to visitors of the event page, or your name to other registered participants. | To organise events and, where an event shows its participants, to let people see who attends. | [Contract (b)]; showing participants: [legitimate interests (f)] |
| Reading history | Which Pieces you marked or finished reading, and where you stopped in audio. | To let you continue where you left off. | [Contract (b)] |
| Access to restricted content | Which restricted Pieces or projects were shared with you, and requests you made for access to the writing Studio. | To make sure that restricted work is readable only by the people it is shared with. | [Contract (b)] and [legitimate interests (f)] |
| Sign-in and session data | When you signed in, on which address of our installation, when your session was last used and when it ended, and keyed hashes of your IP address and browser description. | To keep your account secure and to let you see and end your sessions. | Legitimate interests (f) |
| Security and audit record | A record of changes to people, roles and access, and of sensitive actions such as exports and domain changes. | To secure our installation and to account for who changed what. | Legitimate interests (f) [and legal obligation (c), where a law requires it] |
| Messages you send us | Your name, email address and message when you use a contact form, and the consent you gave if you asked to be kept informed. | To answer you. | Legitimate interests (f), or consent (a) where you asked to be kept informed |
| [People named in published works] | [Names of, and statements about, people that our published works are about or that they mention, including people who are not members.] | [To publish and make findable the works in which they appear; where AI features for concepts and people are switched on, to show what our works say about them (section 7).] | [Legitimate interests (f)] |
| [Add any other processing] | [ ] | [ ] | [ ] |
You do not have to give us personal data. Without an email address we cannot give you an account; without an account you can still read our public pages.
Guidance — delete: Delete rows for features you do not use (for example events, newsletters or editorial review). If your organisation is a public authority, replace "legitimate interests (f)" with "public task (e)" for processing in the performance of your tasks, and name the legal basis in law (GDPR art. 6(1), last sentence, and art. 6(3)). If people join on terms you set (for example membership terms), contract (b) usually fits; for an open reading community, legitimate interests (f) may fit better. Choose one basis per purpose and do not switch later.
Guidance — delete: Newsletters and publication emails. On LeraLink, every new member, including people you invite to your team, receives publication email and the newsletter by default and can switch them off at any time in their settings or with the link in every message; when the newsletter is enabled for an installation, its existing members are subscribed. A switch that is on by default is not consent under the GDPR (article 4(11) and recital 32). Under article 11.7 of the Dutch Telecommunications Act (Telecommunicatiewet), electronic messages sent for commercial, idealistic or charitable purposes need prior consent unless an exception applies. Decide your legal basis with advice before you send newsletters, enter it in the table, and do not write "consent" unless each person actively agreed.
Guidance — delete: Event participants. Each event has a setting for who sees its participants: nobody, everyone who sees the event (count and pictures), or registered participants (names). People are not asked individually. Choose the setting with this statement in mind, and tell people on the registration form if participants are shown.
Guidance — delete: The "people named in published works" row applies to everyone your works are about, not only members. Article 14 of the GDPR requires you to inform them; publishing this statement is the usual way, and article 14(5) may exempt you where informing each person individually is impossible or would take disproportionate effort, or where article 85 and article 43 of the Dutch GDPR Implementation Act (Uitvoeringswet AVG) apply to journalistic, academic, artistic or literary expression.
5. Legal bases explained
- Contract (art. 6(1)(b)): the processing is necessary to provide what you signed up for when you created an account or joined our installation.
- Consent (art. 6(1)(a)): you agreed to it, and you can withdraw your consent at any time, without affecting processing before you withdrew it. You can unsubscribe with the link in every email, or in your account under Notifications.
- Legitimate interests (art. 6(1)(f)): the processing is necessary for our legitimate interests, and we have weighed them against your interests and rights. Our interests are: [keeping our installation and your account secure; keeping a reliable record of published works and of who contributed to them; publishing knowledge and making it findable]. You can object (section 10).
- [Legal obligation (art. 6(1)(c)): we must process the data to comply with a law, namely [name the law].]
- [Public task (art. 6(1)(e)): the processing is necessary to perform our task in the public interest under [name the legal basis in law].]
Sensitive data
[Option A: We do not ask for special categories of personal data, such as data revealing health, religion, political opinions or sexual orientation. Please do not include such data about yourself or others in comments or profiles unless it is needed.]
[Option B: Because [Organisation legal name] is a [foundation / association / other not-for-profit body] with a [political / philosophical / religious / trade union] aim, your membership of our installation may reveal your [political opinions / beliefs / religion / trade union membership]. We process this data under article 9(2)(d) of the GDPR, only for our members and former members or people in regular contact with us, and we do not disclose it outside [Organisation legal name] without your consent.]
Guidance — delete: Choose option A or B. If your installation is run by an organisation such as a political party, a religious community, a trade union or an advocacy group, the fact that someone is a member may itself be special category data. Consider making member lists, participant lists and author pages visible only to members, and do not let membership become visible to the public without consent.
6. Who receives your data
| Recipient | What they receive | Why |
|---|---|---|
| SSStudio (LeraLink), our processor | All data in our installation | To host and run our installation on our instructions |
| SSStudio's subprocessors | The data needed for their service, for example hosting, email delivery and AI services | To provide the service. The current list is published in LeraLink's Subprocessors and Recipients register ([link]). |
| Other members of our installation | What our installation's settings make visible: for example your public profile, credits, comments, annotations and, depending on an event's settings, your name or picture in a list of its participants | To take part in the community |
| Editors and reviewers | Submissions and the editorial record they are assigned to. In blind review, the author's identity and the reviewers' identities are not shown to each other. | Editorial review |
| Readers of our public pages | Published works, credits under the name you publish with, and public comments | Publication |
| Sources you look up | When you look up or cite a source while writing, only the search terms you type, or the web address you cite, are sent to the bibliographic services listed in LeraLink's Subprocessors and Recipients register; no account information is sent. | To find the source |
| Authorities | Data that we are legally required to provide | Legal obligation |
| [Add others, for example your own payment provider or accountant] | [ ] | [ ] |
We do not sell personal data and we do not share it with advertisers.
7. Artificial intelligence in our installation
Our installation uses the following AI features of LeraLink:
| Feature | Switched on? | What it does with personal data |
|---|---|---|
| Translation | [Yes / No] | Text sent for translation may include names and other personal data in that text. |
| Suggested search-engine (SEO) fields | [Yes / No] | Uses the text of a Piece to suggest a search title, description and keywords. |
| Generated feature image | [Yes / No] | Uses a description derived from the Piece and our image instructions. It is never used to identify people. Machine-readable marking of generated images is being introduced. |
| Search index | [Yes / No] | Turns published text into numerical representations so that it can be found by meaning. |
| Concepts and people in published works | [Yes / No] | Names the concepts and people that our published works are about, and writes a short description of them based on what our works say. |
| Composition assistant | [Yes / No] | A composition assistant that makes proposals only, where it is enabled for an installation. |
What stays true for all of them:
- AI output is a proposal, marked as machine-made, until a person accepts it. Machine translations can be shown to readers before a person has reviewed them; they are then labelled 'AI translation · Not yet human-reviewed'. AI does not write, title, summarise or evaluate works for their authors, does not change published text, and does not decide who gets access or which role.
- No decision that produces legal effects for you or similarly significantly affects you is taken by automated means only (GDPR art. 22).
- Restricted Pieces are never sent to any AI model.
- Under their published terms for the paid services used, the external AI providers do not train their models on the data sent, and may keep it for a limited period to detect abuse. Details are in LeraLink's How LeraLink Uses AI ([link]).
Our AI policy. Our installation has the AI policy [Standard / EU only / Open models only / No external AI] for our installation. This means: [choose the matching sentence below].
- Standard: each task tries its models in a fixed order set by the platform; an installation's administrators can see that order, with each provider, on the page 'AI in this installation'. Under this policy, providers outside the EU, including in the United States, may process the data sent.
- EU only: only models hosted in the EU that are recorded as not training on inputs are used, and our texts are left out of the search index.
- Open models only: only models with published weights are used.
- No external AI: only models running on Cloudflare's network are used.
If an AI description of you is wrong. If the concepts and people feature describes you, you can ask us for a correction or removal from your account in our installation. We decide on your request and tell you the outcome. If we remove the description, it is removed in every language and automatic processes will not write it again. A correction by a person is kept beside the machine-made text and is never overwritten.
Guidance — delete: Our administrators can see the AI features, the models that would run and their provider country, hosting region, training and retention facts on the read-only page "AI in this installation" in Tenant Admin. Use that page to fill in this section. Note: under the EU only policy, an AI feature runs only if the platform has recorded the required facts about a model; until then the features are not available. Do not state that a feature is switched on if it is not.
8. Where your data is stored and transfers outside the EU
Our installation's data is stored in the European Union. It is processed on Cloudflare's global network, usually in the data centre nearest to the reader.
Some processing takes place outside the European Union, and for some recipients in the United States: the search index, temporary caches of public pages and configuration, AI processing (depending on our AI policy, section 7), and email delivery records. The recipients and their locations are listed in LeraLink's Subprocessors and Recipients register ([link]), and LeraLink's Where Your Data Is Stored ([link]) explains this in more detail. Details of the safeguards for transfers outside the EEA are available on request ([privacy contact email address]).
Guidance — delete: Check LeraLink's Where Your Data Is Stored and the Subprocessors and Recipients register when you publish, and update this section if they change. If your installation has the EU only policy, you can say that AI processing for your installation takes place only with EU-hosted models and that your texts are not in the search index.
9. How long we keep your data
| Data | Retention |
|---|---|
| Account and profile in our installation | As long as you are a member. When you leave our installation, your profile, email preferences, contact record and sessions in our installation are removed and your access ends. |
| Published works and credits | As long as the work is published, and after that as part of our record of published works [period or "permanently"]. Published works stay under the name they were published with even if you delete your account, because they are also other people's record. |
| Comments and margin notes | As long as the discussion exists. If you delete your account, your comments stay without your name; your margin notes and reactions are deleted. |
| Unpublished drafts that are yours alone | Until you delete them or your account. |
| Editorial records | [period] |
| Newsletter and publication email preferences and their history | As long as you are a member, and the record of your choices for [period] after you switch them off. |
| Event registrations | [period after the event] |
| Reading history | Until you leave our installation or delete your account. |
| Sign-in codes | 1 day |
| Ended sessions | 30 days |
| Rate-limiting counters (hashed IP address) | 7 days |
| Data packages you download about yourself | 7 days |
| Backups | 30 days |
| Anonymous reading statistics | Up to 3 months, then totals only |
| Security and audit record | Kept as evidence for the life of the installation and after, under legal hold |
| [Add others] | [ ] |
Guidance — delete: The fixed periods in this table are set by the LeraLink platform. Fill in the bracketed periods with your own decisions. Keep data no longer than you need it for the purpose.
10. Your rights
You have the right to:
- access the personal data we hold about you (art. 15);
- rectification of data that is incorrect (art. 16);
- erasure of your data, where the law gives that right (art. 17);
- restriction of processing (art. 18);
- data portability: to receive data you gave us in a structured, commonly used, machine-readable format (art. 20);
- object to processing based on legitimate interests [or public task], at any time, on grounds relating to your particular situation (art. 21);
- withdraw your consent at any time, where we rely on consent; and
- not to be subject to a decision based solely on automated processing that significantly affects you (art. 22).
Many of these you can do yourself, in your LeraLink account:
| What you want | How |
|---|---|
| A copy of your data in our installation | Download my data, choosing "My data in this community". You confirm with a typed word and a code sent to your email; a download link is sent to your inbox and works for 7 days. |
| A copy of your account data | Download my data, choosing "My account across LeraLink". |
| Correct your profile | Edit your profile in your account. |
| Stop emails | The unsubscribe link in every email, or Notifications in your account. |
| Leave our installation | Leave community, in your account. Your account and other memberships remain. |
| Delete your account | Delete my account everywhere, under Advanced in your account. This takes effect after 7 days and can be cancelled until then. |
| Correct or remove an AI description of you | Ask from your account in our installation (section 7). |
A data package contains only what is yours alone. Works with other people on them are not included, but your own credit on them is. In blind review, a reviewer receives their own words and an author receives the decisions addressed to them, never who reviewed. Editors' internal notes are not included; you can ask us for them separately.
For anything else, or if you cannot use the self-service tools, write to [privacy contact email address]. We answer within one month. If a request is complex or we receive many requests, we may extend this by two further months; we will tell you within the first month. We may ask you to confirm your identity, for example by writing from the email address of your account.
11. Complaints
If you are not satisfied with how we handle your personal data, please contact us first at [privacy contact email address]. You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place.
12. Cookies and local storage
LeraLink uses only the cookies needed to keep you signed in and to remember your languages, and no analytics or advertising cookies. Content from other services, such as embedded videos or posts, loads only after you allow it; you can change that choice under Cookie settings at the foot of every page. This is explained in LeraLink's Cookie and Local Storage Statement ([link to LeraLink's Cookie and Local Storage Statement]).
Our newsletters contain a small image and personalised links that record whether you opened a newsletter and which links you followed, to measure their reach. [Legal basis and how to refuse this measurement: see the guidance below.] If your email program blocks images, opens are not recorded. You can stop all of it by unsubscribing.
[Add anything your installation adds, for example content from other services that you embed in pages: name the service and what it does.]
Guidance — delete: Under article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet), reading or storing information on a person's device, including through a tracking image in an email, requires prior consent unless it is strictly necessary. The text people see when they join does not mention that opens and clicks are measured, and the measurement cannot be switched off per person. Contact LeraLink support before you send newsletters, so that this sentence can be completed truthfully. If you embed content from other services yourself, list each service here.
13. Children
Our installation is not intended for children under 16. If you are under 16, do not create an account.
Guidance — delete: In the Netherlands, consent to an information society service by a child under 16 requires the consent of a parent or guardian (article 5 of the Dutch GDPR Implementation Act). LeraLink does not yet offer a way to obtain and verify that consent, and its Terms of Service do not allow installations to enable independent accounts for children under 16. If your installation is meant for children, for example a school, contact LeraLink and seek advice before you admit them.
14. Changes to this statement
We may change this privacy statement. The version number and effective date are at the top. If a change affects your rights, we will tell you in advance by email or on our site. [Previous versions are available at [web address].]
15. Contact
[Organisation legal name] [Address] [privacy contact email address]