Privacy Policy & Data Protection

The data controller responsible for the operation of the Mary Ward Archive digital exhibition is:

The Mary Ward Archive is an educational and cultural resource designed with the principle of Privacy by Design.

• No Public Registration: Visitors can access all gallery content, quizzes, and narratives anonymously without providing a name, email address, or contact details.
• No Profiling: We do not build user behavioral profiles or correlate visitor actions across visits or websites.
• Quizzes & Hotspot State: Quiz progression and hotspot discovery run entirely in transient memory during your interactive session and are not permanently recorded or tied to your personal identity.

When you visit the exhibition, our web server automatically processes connection information transmitted by your browser (including IP address, browser user-agent, operating system, and request timestamp).

Legal Basis (GDPR Art. 6(1)(f)): Processing this data is necessary for our legitimate interest in maintaining network resilience, mitigating automated attacks (such as DDoS), ensuring server stability, and debugging technical faults.

Retention Period: Standard server access logs are retained only as long as necessary for technical security (typically up to 30 days) and are subsequently deleted or anonymized.

In accordance with Directive 2002/58/EC (ePrivacy Directive) and the GDPR, only strictly necessary and functional storage mechanisms are used. Because no advertising or tracking cookies are employed, no consent banner is required.

To host and deliver the digital exhibition reliably, we partner with specialized cloud infrastructure providers acting as data processors under GDPR Article 28:

• Fly.io, Inc.: Application hosting and container deployment.
• Cloudflare, Inc.: High-resolution artwork image delivery via object storage (R2).

All font families (Material Symbols, Playfair Display, Arimo, Inter) and animation libraries are hosted directly on our servers, ensuring no external requests to third-party font networks (such as Google Fonts) occur during your visit.

If you reside in the European Union or United Kingdom, you hold specific statutory rights under Articles 15 through 22 of the GDPR regarding your personal data:

• Right of Access (Art. 15): Request confirmation on whether your data is processed and obtain a copy.
• Right to Rectification (Art. 16) & Erasure (Art. 17): Request correction or deletion of personal data.
• Right to Restriction of Processing (Art. 18): Restrict the processing of your personal data under certain conditions.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Lodge a Complaint (Art. 77): Lodge a complaint with a competent supervisory authority in your EU member state of residence.

To exercise any of these rights, please contact Loreto Australia & South East Asia at archives@loreto.org.au.