AITHYRA Identity Provider Privacy Notice

Data Protection & Federation Policy

Privacy Notice for the AITHYRA Identity Provider

This privacy notice explains how personal data is processed when you use the AITHYRA Shibboleth Identity Provider (IdP) to access federated research services in ACOnet eduID.at and eduGAIN.

1. Data Controller & Contact

AITHYRA GmbH – Research Institute for Biomedical Artificial Intelligence of the Austrian Academy of Sciences
Helmut-Qualtinger-Gasse 2, Stiege 2
1030 Vienna, Austria
Company Register: FN 636575s

IT Services & Information Security / Data Protection contact:
Email: itservices@aithyra.at
Data Protection Officer (DPO): Mischa Pilz (mpilz@aithyra.at)
Website: https://aithyra.at
General Privacy Policy: https://aithyra.at/privacy-policy

2. Purpose of Data Processing

The AITHYRA Identity Provider enables secure Single Sign-On (SSO) authentication and authorization for AITHYRA researchers and staff accessing scientific tools, data repositories, high-performance computing centers, and academic services participating in national and international federations.

3. Personal Data Processed & Transferred

Authentication is performed against AITHYRA's institutional Microsoft Entra ID directory. The IdP processes and, where permitted, releases the following attributes to requesting Service Providers:

Attribute SAML / OID Identifier Purpose
eduPersonPrincipalName urn:oid:1.3.6.1.4.1.5923.1.1.1.6 Institutional user identifier (e.g. user@aithyra.ac.at)
eduPersonUniqueId urn:oid:1.3.6.1.4.1.5923.1.1.1.13 Persistent, immutable, non-reassigned unique identifier
subject-id urn:oasis:names:tc:SAML:attribute:subject-id Globally unique pairwise/persistent subject identifier
pairwise-id urn:oasis:names:tc:SAML:attribute:pairwise-id Pseudonymous, per-service unique identifier
cn / displayName urn:oid:2.5.4.3 / urn:oid:2.16.840.1.113730.3.1.241 Common name and full name for user display within the service
givenName / sn urn:oid:2.5.4.42 / urn:oid:2.5.4.4 First name and surname
mail urn:oid:0.9.2342.19200300.100.1.3 Contact email address
eduPersonAffiliation / eduPersonScopedAffiliation urn:oid:1.3.6.1.4.1.5923.1.1.1.1 / urn:oid:1.3.6.1.4.1.5923.1.1.1.9 Affiliation with AITHYRA (e.g. employee, employee@aithyra.ac.at)
eduPersonAssurance urn:oid:1.3.6.1.4.1.5923.1.1.1.11 Identity verification and assurance level (REFEDS RAF)
schacHomeOrganization urn:oid:1.3.6.1.4.1.25178.1.2.9 Organization domain (aithyra.ac.at)

4. Attribute Release Policies (Entity Categories)

Attributes are released strictly on a need-to-know basis according to internationally recognized federation standards:

5. Legal Basis

Processing is carried out in accordance with Art. 6 Abs. 1 lit. b DSGVO (performance of service access requested by the user) and Art. 6 Abs. 1 lit. f DSGVO (legitimate interest of AITHYRA in providing secure, federated research collaboration infrastructure).

6. Data Retention, Security & International Transfers

Authentication sessions in the IdP are stored in encrypted server-side memory/cache and expire automatically. Transaction and security audit logs are retained for up to 180 days for incident response and forensic analysis under the SIRTFI framework, after which they are permanently deleted.

Because this IdP participates in eduGAIN, attributes may be transferred to Service Providers outside the EU/EEA (e.g. CERN in Switzerland, US research institutions, UK). Such transfers occur on the basis of adequacy decisions pursuant to Art. 45 GDPR, or for the performance of the service requested by you pursuant to Art. 49(1)(b) GDPR.

7. Your Rights

Under the GDPR, you have the right to access, rectification, erasure, restriction of processing, and data portability. To exercise your rights regarding federated identity data, contact itservices@aithyra.at.

You also have the right to lodge a complaint with the competent supervisory authority (in Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).