Privacy Information: Processing of Personal Data
By consenting to the processing of your personal data, you accept that Foresight Laboratories may store the information you provide at sign-up and during use of the platform, and may send you the e-mail messages necessary to handle you as a participant in our forecasting research. The degree of personal data processing depends on the data you submit and the specific consents you have given. You also consent to Foresight Laboratories processing your data in other relevant internal systems used to operate the research platform, and to anonymised data being used for statistical and scientific purposes.
1. Basic requirements for the processing of personal data
Foresight Laboratories is responsible for the storage and use of your personal data (Data Controller).
Data is processed in accordance with the requirements of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and applicable national data-protection legislation. These rules give you a number of rights, the most important of which are described in section 6 below. The rules also require that your consent be given at the same time as data about you are collected.
2. Purpose of the processing
- Allow you to register and sign in to the Foresight Laboratories platform.
- Record and attribute the forecasts you submit so that accuracy, calibration, consistency and rank can be calculated for you over time.
- Evaluate forecast accuracy across different participant groups (for example by education, sector or employment status) for research and statistical purposes.
- Send you the operational e-mail messages required to handle you as a participant (account confirmation, password reset, round lock-out reminders, release notifications, and similar service messages you have opted into).
- Improve the platform and develop new research outputs based on aggregated and anonymised data.
- With your separate optional consent, measure broad website-usage trends and real-user performance so that we can understand and improve how the site performs across browsers and devices.
3. Personal data categories
3.1 Data that are obligatory for sign-up
- First name and surname
- E-mail address
- Password (stored only as a salted hash; the plaintext password is never stored or transmitted after authentication)
3.2 Demographic data collected at sign-up
For each of these fields you may select “Prefer not to say”:
- Gender
- Age
- Highest completed education
- Country/region of residency
- Employment status
- Profession
- Sector of work
3.3 Data generated through use of the platform
- Forecast submissions (indicator, target period, forecast value, forecast horizon, submission timestamp and, where applicable, the blockchain transaction hash used to attest the submission).
- Per-indicator surveys captured on your first forecast for each indicator (your role as decision-maker, perceived exposure to the indicator and forecast confidence).
- Forecast statistics derived from your submissions (total forecasts, accuracy, score, rank, streaks and per-indicator performance).
- Optional profile information you choose to provide (biography, affiliation, website and ORCID identifier).
- Notification and privacy preferences you have set.
- A timestamped record of when you gave consent, and the version of the consent statement shown to you.
3.4 Website analytics
With your separate optional consent, Foresight Laboratories uses Cloudflare Web Analytics to measure broad website-usage trends and real-user page performance. Cloudflare, Inc. acts as our processor for this purpose. The legal basis is your consent under GDPR Article 6(1)(a); the beacon does not load before you select Allow analytics, and refusing does not affect registration or any feature.
When enabled, the beacon may send Cloudflare:
- The website host and page path, landing path and referrer (Cloudflare does not log URL query strings).
- Approximate country, device type, browser, operating system and navigation type.
- Navigation, resource and paint timings, Core Web Vitals and a page-load identifier.
The beacon sets no cookies or persistent browser identifiers and does not read cookies or persistent browser storage. Cloudflare receives the source IP address as part of normal HTTP delivery, discards it at the nearest Cloudflare data centre, and does not store it in the analytics records, core databases or logs.
Cloudflare retains received beacon data unsampled for about seven days. It then aggregates and samples the data to around 10% for longer-term storage; the dashboard and API provide access to approximately the previous six months.
Consent preference (separate from analytics). For a signed-out
visitor, we store a first-party localStorage receipt containing the
choice, decision time, analytics-consent text version/hash and notice revision. This
strictly necessary storage exists only to honour the choice, keep analytics off after
refusal or withdrawal and avoid repeated prompts; it contains no user or random
identifier, does not measure activity and is not sent to Cloudflare. For a signed-in
user, the current choice and consent evidence are stored with the account instead.
You may withdraw consent at any time under GDPR Article 7(3) through the persistent Analytics settings control; signed-in users may also use Profile → Settings → Privacy → Website analytics. Withdrawal suppresses the beacon no later than the next page load and does not affect the lawfulness of processing before withdrawal.
Cloudflare may process analytics data in the United States or other countries. For relevant U.S. transfers, Cloudflare participates in the EU-U.S. Data Privacy Framework. If that framework cannot be used, the Cloudflare Data Processing Addendum provides the 2021 EU Standard Contractual Clauses (controller-to-processor Module 2) and applicable additional safeguards as the fallback transfer mechanism.
3.5 Technical data
- IP address and request path, used transiently for rate-limiting. These are not retained as part of your user record and are deleted after the rate-limit window expires.
- Authentication tokens (access and refresh JWTs) issued to your browser to keep you signed in.
- A bot-protection check (Cloudflare Turnstile) on the sign-up, sign-in, password-reset and contact forms. It is strictly necessary to protect these forms from automated abuse, processes technical browser signals transiently for that sole purpose, and does not track you across sites. The resulting proof token is verified server-side and is not stored with your user record.
4. Information security
Foresight Laboratories complies with the information-security requirements of the GDPR. Passwords are stored only as salted hashes. Communication between your browser and the platform is encrypted in transit (HTTPS). Access to the production database is restricted to authorised members of the Foresight Laboratories team.
Foresight Laboratories uses third-party processors to operate the platform (for example, cloud infrastructure providers used to host the database and application servers, and an e-mail provider used to send service messages). These processors act only on documented instructions from Foresight Laboratories and are bound by data-processing agreements.
5. Storage period
Your data are stored in accordance with your consent. If you withdraw your consent, your account and the personal data linked to it will be deleted within 30 days. Forecasts you have submitted may be retained in anonymised form for research and statistical purposes after deletion of your account.
Where data are required to be retained under applicable law (for example, accounting legislation in connection with any participation fee or financial transaction), such data will be retained for the period required by that legislation (typically up to 5 years) and processed only for those legal purposes, with access strongly restricted.
6. Your rights
- Be informed about how your personal data are processed (this document).
- Access the personal data we hold about you.
- Have inaccurate or incomplete data corrected.
- Have your data erased, subject to legal retention obligations.
- Restrict or object to certain processing.
- Receive your data in a structured, commonly used and machine-readable format (data portability).
- Withdraw your consent at any time, with effect for future processing.
- Lodge a complaint with the supervisory data-protection authority in your country of residence.
To exercise any of these rights, or for additional information about how your data are processed, contact Foresight Laboratories at [email protected].
7. Consent statement (shown at sign-up)
At the end of the sign-up form, the following consent statement is presented and must be actively accepted before an account can be created:
GDPR consent: I consent that Foresight Laboratories may process my personal information to manage analysis and research. I am aware that consent is voluntary and that I can withdraw my consent at any time after the event has ended.
I consent to:
- Foresight Laboratories storing my personal information — see consent for processing personal data.
- Receiving e-mails/SMS needed to handle me as a participant.
- My personal data being processed in other relevant internal systems used by the organiser.
- Anonymised data being used for statistical purposes.
The consent statement version shown to the participant, together with the date and time of acceptance, is stored with the participant’s account record. The privacy notice revision identifies changes to this transparency information and is maintained separately from the consent statement version.