Your Privacy at Lean Library

At Lean Library, we believe in being open and honest about how we use your data. This policy explains our approach to privacy, product by product, so you can easily understand what information we collect, why we collect it, and how we keep it safe.

Understanding Data Roles: Controller vs. Processor

Data protection law means our role can change depending on how your personal data is being used by our products.

Data Controller

When we act as a ‘Data Controller’, it means we determine why and how certain personal data is processed. This typically applies to data related to our direct relationship with you (e.g. managing your account with us, providing direct support, or for our marketing).

Data Processor

When we act as a ‘Data Processor’, it means we process personal data on behalf of another organisation (our customer, such as your library or institution). In this case, your library or institution is the ‘Data Controller’ and decides why and how your data is used. We follow their instructions and process the data in line with our agreement with them. We are a Data Processor where we collect your information in relation to your Lean Library Workspace Account (if you choose to create one).

This privacy policy relates to our use of your data as a Data Controller, not as a Data Processor. If you have questions about how our customer processed your personal data, you can contact them directly.

Lean Library Products

This section explains how your data is handled when you use the Lean Library browser extension and, if applicable, a Lean Library Workspace account.

Information the Lean Library Browser Extension Collects and Why

The Lean Library browser extension guides users to quickly access academic resources their library subscribes to, even when not on campus. It does this by recognising relevant academic and non-academic (such as online book platforms) URLs and article identifiers to offer quick access through the library’s systems.

To provide this service, the Lean Library browser extension may analyse and/or collect the following information:

• Web Browsing Activity: We collect information about relevant websites that you visit in order to access the library’s resources, and look for identifiers such as DOIs, ISBNs, along with other article and publisher metadata. These identifiers are only used momentarily to determine whether a feature is relevant to the user.
  • Why? This allows the extension to show you relevant access options for your library’s licensed content. For example, if you visit a research paper, we can suggest accessing it through your library.
• Event Data: We collect event information (feature activations) about relevant websites you visit to access the library’s resources, including database URLs, articles you’ve accessed, and how you interact with the relevant sites (e.g. Article Link clicked and LibGuide displayed).
  • Why? To help us understand how the extension is being used, provide anonymised statistical data to our customers, and improve its performance and features.
• Cookies and Local Storage: We use functional “cookies” to set user preferences for the setup of the browser extension. We may also use cookies if you provide feedback, to remember your preferences. We do not place tracking cookies.

Lean Library Workspace Accounts

• Lean Library Extension (without a Workspace account). When you use the Lean Library extension without creating a separate Lean Library Workspace account, activity related to the Extension is recorded only against your IP address.
• Lean Library Workspace Account. If you choose to create a Lean Library Workspace account, you will have to submit your name, email address and role to manage that account. The content you actively add or save within your Workspace account (e.g. saved references, notes) is linked to that account.

What Lean Library Does NOT Collect

Your privacy is our top priority. We are only interested in data that helps us improve your academic research experience. Therefore, the Lean Library extension does not store:

• General web browsing activity.
• Data from your bank or credit card accounts.
• Information from your email account.
• Any personal information that you have not directly provided to us or explicitly permitted us to record.

How We Use Your Information

• To provide the Lean Library service and its features.
• To conclude, perform and administer the agreement with the organisation you work for.
• To provide support with respect to our services.
• To improve the extension and your future experience.
• For internal analysis and troubleshooting.
• We may use anonymised, aggregated data (data that cannot be linked back to you personally) for marketing materials, like blog posts, case studies, or white papers.
• To communicate with you, for example to receive your feedback or if you have questions about our services and to send you service messages.
• If you work at one of our customers, we will include your contact details in our customer relations management system to manage and maintain our (commercial) relation.
• To comply with our legal obligations, for example if government authorities notify us of illegal acts through our services and tax related administration obligations.

On What Legal Grounds We Use Your Information

We use your information on the basis of the following legal grounds:

• To conclude and perform the agreement with you.
• To comply with applicable legal obligations.
• For our legitimate business interests, being in general the operation of our business and commercial business purposes and more specifically as applicable as indicated under the purposes above.
• In specific cases, we may ask your consent. You can withdraw your consent at any time.

Links to Other Websites

The Lean Library extension may link you to other online database websites. Please remember that we are not responsible for the content or privacy practices of these external sites. Always read their privacy policies before using them.

General Privacy Practices (Applicable to All Products)

The following practices apply across all products and services offered by Lean Library.

When We Share Your Information

We may share the information we collect in specific, controlled circumstances:

• As Required by Law: If we are legally required to disclose information, such as in response to a court order or government request.
• For Your Safety and Protection: When we believe in good faith that disclosure is necessary to protect your safety, the safety of others, to investigate fraud, or to protect our rights.
• With Our Trusted Service Providers: We work with third-party service providers (e.g. cloud hosting, analytics, customer support platforms) who assist us in operating and improving our products. These providers are only allowed to use the information for the specific services we hire them for, act on our instructions, and are bound by strict contractual agreements to protect your data. You can find a list of these sub-processors here.
• In Business Changes: If Lean Library (or a product line like Lean Library) is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. You will be notified of any such change in ownership or use of your information.

How Long do We Keep Your Information

We retain your information for as long as necessary to provide the service you are using, for operational purposes, or as required by law:

• Service Provision: We keep data for as long as we have an agreement with the organisation you work for if you work at our customer and, if you are a user, as long as you have our products (like the Lean Library Extension) installed.
• Operational & Compliance Needs: We retain information for a reasonable period thereafter for purposes such as troubleshooting, record-keeping, and meeting legal or regulatory obligations.
• Specific Retention Periods: Log file data and backup data are typically kept for 90 days before deletion.
• Legitimate Interests: We may retain data as necessary for our legitimate business interests, such as managing customer relationships or resolving disputes.

Where Your Data Is Processed and Stored

Your data is stored on external servers:

• Our primary data processing and storage is with ISO27001/SOC2 certified data centres situated within the European Union (EU).
• Our customer relations management system stores data within the European Union (EU).
• In some cases, we may utilise trusted third-party service providers who operate data centres outside the EU, including the United States, for certain auxiliary data or specific processing tasks (e.g. for analytics or global support). In such instances, there are appropriate safeguards, including Data Privacy Framework registrations and Standard Contractual Clauses, to ensure your data remains protected to EU standards. More information about the locations where our service providers process the data can be found here. Please contact us if you want to receive a copy of the relevant appropriate safeguards.

What Are Your Rights

Under the General Data Protection Regulation (GDPR) you have at least the following rights with respect to your data:

• the right to request access to your personal data;
• the right to receive information about the processing of your personal data;
• the right to have incorrect personal data rectified;
• under certain conditions to have your personal data erased;
• under certain conditions to have the processing of your personal data restricted;
• under certain conditions to object to the processing of your personal data; however, when we use your personal data for direct marketing purposes, you can object to this unconditionally;
• if you have given consent for the processing of your personal data, to revoke that consent (this applies to future use of your personal data);
• the right to receive your personal data in a structured, commonly used and machine readable format, where it concerns personal data (i) you have submitted to us and (ii) we process based on your consent or required for the performance of our contract with you and (iii) that is processed by automated means; in that case you may also ask us to transfer your personal data to another processor, where technically feasible;
• the right to lodge a complaint with the supervisory authority.

If you want to exercise your rights, please send a request with respect to your personal data, detailing your request and using the contact details below. We may ask you to provide additional information in order for us to verify that your request relates to your personal data.

Please note that we may be entitled under applicable laws to refuse certain requests, in whole or in part.

How You Can Contact Us

LibraryLink B.V.
Email: daniel@leanlibrary.com

Month of publication: January, 2026