Privacy notice
XII Tabulae platform, Laboratory of Foundations of European Law and Unification of Law
Notice provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Effective date: 7 November 2026. Last updated: 10 November 2026.
This notice describes how the personal data of the people (the «Data Subjects») who request registration and use the XII Tabulae platform, available at www.xii-tabulae.com and at the domain xii-tabulae.it (the «Site»), are collected, stored and processed. The Site offers interactive consultation of the text of the XII Tabulae, its bibliography and search and analysis tools, and is reserved to users whose registration request has been approved by the administrators.
1. Joint controllers and contact details
Processing is managed jointly by the four administrators of the platform, who together determine the purposes and means of processing and act as joint controllers under Article 26 GDPR: Francesco Fasolino, Giovanbattista Greco, Felice Addeo and Francesco Notari (jointly, the «Controllers»). The Controllers can be reached at the University of Salerno, via Giovanni Paolo II n. 132, 84084 Fisciano (SA), Italy. The common contact point for any request concerning the protection of personal data is socialsciencessoftware@gmail.com.
Under Article 26(2), the essence of the joint-controllership arrangement is as follows. Requests from Data Subjects are received at the contact address and handled jointly, with a reply within the legal time limits. Approval of registrations, access management and data administration are carried out by the four administrators, each with their own personal account. Personal data breaches are assessed jointly and, where necessary, notified to the Italian Data Protection Authority within 72 hours of becoming aware of them (Article 33). Data Subjects may exercise their rights against each of the Controllers (Article 26(3)). No Data Protection Officer has been appointed, as the conditions of Article 37 GDPR are not met.
2. Categories of personal data processed
Data provided by the Data Subject. Registration requires first name, last name, email address and password, and the institution of affiliation may optionally be indicated (university, research body, professional firm, association or other organisation). The password is protected by cryptographic hashing in the authentication service and is not known to the Controllers. Those who choose to sign in with Google do not enter a password: name, email address and the technical identifier of the account are received from Google, which is the source of these data (Article 14).
Profile and contribution data. The profile picture, if any, the preferred interface language, and the bibliographic proposals or other contributions sent through the Site. For scientific directors and curators who have consented to it, the Site publishes a page with affiliation, curriculum and publications.
Usage data and access log. Date and time of sign-ins and of the main actions performed (consulting the tables, opening notes, searches, exports), the IP address stored in truncated form, and the browser type.
Minerva assistant data. Text of questions and answers, conversation history saved in the user's area, and a technical log with date and user identifier used to apply the daily question limit.
Technical data and cookies. The Site uses only strictly necessary technical cookies: the session cookie and the cookie that stores the chosen language. The light or dark theme preference stays in the browser and is not sent to the Controllers. To suggest the initial language, the hosting provider detects the country the connection comes from, without the Controllers storing the IP address for this purpose. The Site does not use Google Analytics, Meta Pixel or any other profiling, third-party analytics or advertising tracking tools and, for this reason, does not show a cookie consent banner. No special categories of data under Article 9 GDPR are requested or processed.
3. Purposes, legal bases and retention periods
| Purpose | Data used | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Registration request, review by the administrators, account management and sending of confirmations and service messages | First name, last name, email, institution, password (hashed) or Google sign-in identifier, preferred language | Performance of the requested service or pre-contractual measures (Art. 6(1)(b)) | Until the account is closed, with deletion within 30 days of the request. Rejected requests are deleted within 30 days of the decision. |
| Password recovery | Email address | Performance of the requested service (Art. 6(1)(b)) | For the duration of the reset procedure. |
| Consultation, exports, bibliographic proposals and other contributions | Account data, content of contributions, profile picture if uploaded | Performance of the requested service (Art. 6(1)(b)); consent for the picture (Art. 6(1)(a)) | Until the account is closed. Approved bibliographic content, which contains no user data, remains in the database. |
| Minerva assistant | Questions, answers, data of the fragment or chart the question starts from, user identifier, date | Performance of an optional feature requested by the user (Art. 6(1)(b)) | Conversation history until deleted by the user or until the account is closed; technical question log for 12 months. |
| IT security, access log, abuse prevention and reporting on platform use | Date and time of sign-ins and actions, truncated IP address, browser type, system logs | Legitimate interest of the Controllers (Art. 6(1)(f)) | Access log for 12 months, then automatic deletion. Technical logs of the hosting providers according to their settings, normally no longer than 30 days. |
| Technical operation of the Site (session, language) | Technical session and language cookies | Legitimate interest of the Controllers (Art. 6(1)(f)); technical cookies exempt from consent | Session for the sign-in cookie; language cookie until deleted from the browser. |
| Public page of scientific directors and curators | Name, affiliation, curriculum, publications, picture | Consent of the data subject (Art. 6(1)(a)) | Until consent is withdrawn or the role ends. |
| Legal obligations and protection of the Controllers' rights | Strictly necessary data | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | For the periods required by law or by limitation periods. |
4. Whether providing data is mandatory
Providing first name, last name, email address and password, or using Google sign-in, is necessary: without them it is not possible to request registration or to access the reserved areas. Indicating an institution, uploading a profile picture and using Minerva are optional, and declining them does not affect the use of the rest of the platform. Registration requests are assessed by the administrators case by case and may be rejected; the decision is not automated. Since no third-party analytics or profiling cookies are used, browsing requires no consent.
5. Recipients of the data and service providers
Data are neither disclosed to the public nor sold. They are processed by the Controllers and by persons authorised by them, with role-based access. They may also be processed on behalf of the Controllers by providers appointed as processors under Article 28 GDPR: Supabase Inc., for the database and authentication service, with data hosted on servers in the European Union (Frankfurt am Main); Vercel Inc., for hosting and publishing the Site; Google, for the email service through which the Site sends confirmations, notices and password recovery messages; the provider of the artificial intelligence service on which Minerva is based. Google also acts as an independent controller of the Google sign-in service, which the Data Subject chooses freely and to which Google's terms and privacy notice apply. The up-to-date list of processors is available on request. Data may be disclosed to public authorities only when required by law.
6. Transfers of data outside the EU
Data are hosted in the European Union, but some providers are US companies or belong to US groups, and Minerva's provider may process questions outside the European Economic Area. This may result in a transfer of data to the United States. Such transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for providers that participate in it, or on the basis of the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), supplemented by the necessary additional safeguards. A copy of the safeguards adopted may be requested at the contact address.
7. Minerva assistant and absence of automated decisions
Minerva is an assistant based on a language model. Its use is optional and each user has a limited number of questions per day. To answer, the Site sends the provider the text of the question, the current conversation and the data of the fragment or chart the question starts from; neither the email address nor the password are sent. Conversations are saved in the user's area and can be deleted at any time. Please do not include personal data of third parties or special categories of data in your questions. Answers are generated automatically, may contain errors and do not replace a critical reading of the edition and the sources. No decision based solely on automated processing producing legal effects or similarly significantly affecting the Data Subject is made, and no profiling takes place (Article 22 GDPR).
8. Security measures
The Controllers adopt technical and organisational measures appropriate to the risk (Article 32 GDPR): encrypted connections, passwords stored only in hashed form, role-based access to data with database-level security rules, security headers and controls against unauthorised requests, rate limits, verification of uploaded files, a log of access and administrative actions, and storage of IP addresses in truncated form.
9. Rights of the Data Subject and withdrawal of consent
At any time the Data Subject may exercise the rights under Articles 15 to 22 GDPR (access, rectification, erasure, restriction, portability and objection) by writing to socialsciencessoftware@gmail.com. They may also object, on grounds relating to their particular situation, to processing based on legitimate interest (Article 21) and, where processing is based on consent, as for the public page and the profile picture, withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3)). Closure of the account may be requested at the same address. The Controllers reply within one month of receiving the request, extendable by two months in particularly complex cases (Article 12(3)). If they consider that the processing infringes the law, the Data Subject may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
10. Changes to this notice
Changes are published on this page with the new update date and, where they substantially affect processing, are communicated to registered users by email. Should the Site adopt third-party analytics or marketing tools in the future, this notice would be updated before their activation and the related processing would be subject to the user's prior consent through a dedicated banner.