Tinted detail of a photo: White disc-shaped GPS antenna on a pole with a yellow cable, beside white sacks on a rocky summit, overlooking a vast brown high plain and distant snow-dusted mountains.
G
Geodesy

Privacy notice

This notice explains what personal data the EGU blogs collect when you read them, comment, subscribe to a blog by email or write for one, why we collect it, how long we keep it, who receives it and the rights you have over it. The EGU blogs are the blog network of the European Geosciences Union (EGU): GeoLog, the blogs of its scientific divisions and the network blogs.

Last updated: 10 November 2026.

In short

The short version. The details follow below.

  • The blogs are run by the European Geosciences Union (EGU) in Munich. Contact: privacy@egu.eu.
  • Reading needs no account and sets no cookie. Our visitor statistics run on our own servers and do not identify you.
  • To comment, we need your name and email address, and only your name is shown.
  • To subscribe to a blog, we need your email address, and every mail carries a link that ends the subscription.
  • Videos, maps and posts from other websites load only after you click on them.
  • We do not sell your data. Our servers are in Germany and Finland.
  • You can ask us at any time for a copy of your data, or to correct or delete it: email privacy@egu.eu.

Who is responsible for your data

The data controller responsible for the processing described here is:

EGU - European Geosciences Union e.V.
Kastenbauerstr. 2
81677 Munich
Germany
Email: privacy@egu.eu

When you read the blogs

You can read every post without an account, and reading sets no cookie.

Server logs. Our web servers keep a log of each request: the address of the page, the time, your browser and operating system, the page you came from and your IP address. We use these logs to keep the blogs running securely, to detect and prevent abuse, and to investigate failures. They are deleted after no more than 14 days; records of attacks and abuse attempts are kept for no more than 30 days.

Visitor statistics. To see how the blogs are used overall, we run our own statistics software, Matomo, on EGU servers. It sets no cookie and stores nothing in your browser. It records the pages you view and for how long, the links you follow, your browser, operating system, device type and language, your country, and whether you came from a search engine, a social network or a link on another website. It shortens your IP address before storing anything, so it never keeps your full address, and it cannot recognise you from one day to the next. If your browser sends a Do Not Track signal, it records nothing about your visit. Visit records are deleted after 90 days; the statistics made from them identify no one and are kept longer.

Your display choice. Your light or dark theme preference is stored in your browser's local storage, not in a cookie. It is never sent to us.

Content from other websites. A post may embed a video, a map or a post from another website, such as YouTube or Google Maps. Nothing is loaded from that website until you click on the embed. Then your browser fetches it from there, and that website receives your IP address and browser details and may set its own cookies; its own privacy notice applies. If you tick "Always display content from" a website, your browser keeps a cookie with that choice for one year; deleting this site's cookies in your browser undoes it.

When you comment

To comment on a post, you give your name and email address and write your comment. We email you a link to confirm it. The comment reaches the blog's moderators once you have confirmed it, and is published once a moderator has approved it; a comment not confirmed within seven days is deleted.

Your name and your comment are published with the post. Your email address is not published: we keep it with the comment so that we can contact you about it, and the blog's editors can see it. We store no IP address, browser details or website with a comment.

A notification email with your name, email address and comment goes to the blog's own address and is forwarded to its editors. Your comment stays with its post for as long as the post is online; one refused as spam is deleted after 30 days.

When you subscribe to a blog by email

GeoLog and the division blogs can email you each new post. To subscribe, you give your email address, and we email you a link to confirm. We store the address with the date and time of your request and of your confirmation, which is our proof that you asked for the mails; we store no IP address. We use the address for nothing but mailing you that blog's new posts, and we pass it to no one.

A request not confirmed within seven days is deleted. Every mail carries a link that ends the subscription, and so does the form on the blog's Subscribe page; ending it deletes the address and everything stored with it.

When you write for the blogs

Authors and editors have an account, created for them by EGU staff. We store your username, email address, name and a securely hashed password, your role on each blog, when you last logged in, and the profile details you add yourself: a short biography, a picture and a website. If you sign in with an authenticator app, we store the secret the app uses and your recovery codes.

Your posts are published with your name as the author, and your biography and picture under them; your author page lists your posts. A blog's About page lists its editors by name, with their biography and picture, and egu.eu lists the editors of each division blog by name. Mail to a blog's own address is forwarded to its editors. Your email address is never published.

Guest authors have no account: the blog's editors create a profile with the name, biography, picture and email address the guest gives them. The name, biography and picture appear with the post; the email address is kept so that the editors can contact the guest, and is shown nowhere. A guest profile that is not used on any post is deleted after 30 days.

A picture uploaded without a description for screen readers gets one written by software on our own servers; you can change it in the picture's details.

We keep a log of what each account does on a blog: posts written and edited, comments moderated, settings changed and logins, with the account's name, a shortened IP address and browser details. A blog's editors and administrators can see its log, and entries are deleted after 60 days. Earlier versions of a post are kept as its history for as long as the post exists, and anyone who can edit the post can see them.

Your posts are published under the Creative Commons Attribution 4.0 licence (CC BY 4.0) with your name as the author, as the licence requires; see the Copyright page. A post cannot easily be removed once it has been published: the licence is irrevocable, and after you stop writing for a blog, or your account is deleted, we keep your posts online with your name, so that the blogs stay complete and the links and credits of everyone reusing them keep working. We do this based on our legitimate interests (Article 6(1)(f) GDPR). When an account is deleted, its email address, password and sign-in data go; the name, biography and picture stay with its posts.

If a post names or shows you

Posts may mention people or show them in pictures: colleagues, interviewees or people at an event. Their authors are responsible for what they publish, and we hold no contact details for the people named or shown, so we cannot inform each of them individually (Article 14(5)(b) GDPR); this notice is our public information to them. Our hosting of such posts rests on our legitimate interest in scientific communication (Article 6(1)(f) GDPR). If a post names or shows you and you object, email privacy@egu.eu and we will look into it.

Who receives your data

We do not sell your personal data. In running the blogs, it reaches the following:

  • EGU staff and the blogs' editors. EGU staff administer the blogs and can see account, comment and subscriber data where that is needed to run them. A blog's editors and administrators see the comments and subscribers of their blog, and the editors receive the mail about a held comment at their own email addresses.
  • EGU's website. egu.eu reads the blogs' public feeds to show their posts, and the list of each blog's editors to name them and to forward mail to them.
  • Hosting. Our servers, database and files run on infrastructure rented from Hetzner Online GmbH in Germany and Finland. Hetzner provides and operates the hardware; it does not decide what happens to your data.
  • Email. EGU's mailboxes, privacy@egu.eu and the blogs' own addresses among them, are hosted by mailbox.org (Heinlein Hosting GmbH) in Germany. The mails the blogs send leave through EGU's own mail server.
  • Other websites whose content a post embeds, only once you click on it, as described above.

Every provider EGU engages is within the European Economic Area. Content you choose to load from another website is fetched by your browser from that website, which may be outside it.

How long we keep your data

  • A comment stays with its post for as long as the post is online; one not confirmed within seven days is deleted, and one refused as spam after 30 days.
  • A subscription lasts until you end it; a request not confirmed within seven days is deleted.
  • An account is kept until it is deleted, which you can ask for at any time; published posts stay online with the author's name, as described above. A guest profile that is not used on any post is deleted after 30 days.
  • Earlier versions of a post are kept as its history for as long as the post exists.
  • The log of what each account does is deleted after 60 days.
  • Server logs are kept for no longer than 14 days, records of attacks and abuse attempts for no longer than 30 days, and the anonymised visit records of our statistics for 90 days.
  • We keep regular, encrypted backups in data centres within the European Economic Area, only so that we can restore the blogs after a failure. They are rotated on a fixed schedule, and data deleted from the blogs leaves the backups as they rotate out. If we ever have to restore from a backup taken before your data was deleted, we re-apply the deletion as soon as we become aware of it.

Legal bases

  • Consent (Article 6(1)(a) GDPR): mailing you a blog's new posts after you subscribed. You can withdraw it at any time with the link in every mail; withdrawing does not affect what was done before.
  • Performance of a contract (Article 6(1)(b) GDPR): publishing the comment you asked us to publish, and running the account under which you write for or edit a blog, with your name as the author of your posts.
  • Legitimate interests (Article 6(1)(f) GDPR): keeping the blogs secure and free of spam and abuse, which is why a comment needs a confirmed email address and waits for a moderator; keeping server logs and the log of what accounts do; seeing how the blogs are used overall, without identifying visitors; describing pictures for screen readers; keeping published posts online with their authors' names after the authors leave; hosting posts that name or show people, as part of scientific communication; and keeping backups.

You are under no legal obligation to give us any of this data. Without a name and email address we cannot publish a comment, and without an email address we cannot mail you a blog's posts; an account needs a username, a name, an email address and a password.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting the lawfulness of processing carried out on that basis before you withdrew it. No decision about you is made solely by automated means.

Right to object. Where we rely on our legitimate interests, you can object at any time on grounds relating to your particular situation. Email privacy@egu.eu and we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests.

Published posts. Because keeping them online serves freedom of expression and information, the right to erasure is limited for published posts (Article 17(3)(a) GDPR). You can still ask us to remove or change a post, and we assess each request individually.

To exercise any of these rights, email privacy@egu.eu. We answer within one month; if a request is complex, we may extend this by up to two further months, and we will tell you why.

Complaints. You have the right to lodge a complaint with a data protection supervisory authority. As EGU is based in Munich, the competent authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA). You may also contact the supervisory authority in your country of residence.

Changes to this notice

When we change this notice, we update the date at the top.