The record of your survey responses does not contain any identifying information about you, unless a specific survey question explicitly asked for it.

If you used an identifying access code to access this survey, please rest assured that this code will not be stored together with your responses. It is managed in a separate database and will only be updated to indicate whether you did (or did not) complete this survey. There is no way of matching identification access codes with survey responses.

Study Information and Declaration of Consent

Welcome to our user study on how people engage with and learn from websites that promote privacy-enhancing technologies (PETs)!

Shirin Shams is conducting this study at the Institute of Computer Science at the University of Göttingen. It is a project funded by the German Research Foundation (DFG). This study aims to gain a deeper understanding of the factors that influence users' decisions to adopt privacy-protecting technologies.

In this study, you will explore websites offering tools to protect users' online privacy. The session will begin with a short onboarding. You will then be asked to review three websites, one at a time. After exploring each website, you will complete a brief questionnaire about your experience. At the end of the session, you will participate in a brief interview, followed by a final questionnaire and a few demographic questions. Your input will help us better understand how users seek information, assess, and make decisions about privacy-enhancing technologies online. No preparation is needed to participate.

The computer screen you interact with will be recorded, along with your voice, as you engage with the specified websites. Additionally, your voice will be recorded throughout the session to ensure accurate transcription and subsequent evaluation. Your eye movements will be captured through wearable glasses during your interaction with the websites. At every step of the interaction, you can remove the glasses independently. This in-person study is scheduled to last approximately 1.5 hours. To participate in the study, you must be at least 18 years old and legally competent.

We would like to thank you for your participation with a payment of 30 euros. Please note that the payment can only be made upon full participation in the study. The reward will not be given if you withdraw your involvement during the study. Please also note that payment can only be made via bank transfer. Cash payments will not be possible. Therefore, we will require your bank information to complete the bank transfer. Please note that employees of the University of Göttingen are not eligible for this payment; however, they are still welcome to participate.

Please note that there are no right or wrong answers during the study. Participation in this study is strictly voluntary, and you may cancel your participation in the study at any time without giving any reason. Cancellation of the study will not have any negative consequences for you. Your data will then be deleted immediately, although the data processing remains lawful up to this point. Please also refer to the information sheet on Art. 13 GDPR (Appendix A).

For any inquiries about the study, please contact Shirin Shams (shirin.shams@uni-goettingen.de), Tel: +49 551 39-26052.

Data Collection and Handling

This study is being conducted as part of a DFG research project of the research group “Computer Security and Privacy” of the University of Göttingen, Wilhelmsplatz 1, 37073 Göttingen, Germany (represented by the president, responsible person in the sense of Art. 4 No. 7 EU-DS-GVO). Your contact person is Shirin Shams, shirin.shams@uni-goettingen.de. Your responses collected during this study will be anonymised and used only in the context of this study.

• We use the GWDG[1] LimeSurvey service as our survey platform, which stores data in the EU and thus complies with European regulations.
• The computer's screen and your voice will be recorded via OBS and QuickTime player to ensure the proper transcription of the interaction.
• An Eyetracker named Tobii Pro Glasses 3 will track your eye movement, which will be analysed using Tobii Pro Lab software. More information available at: https://www.tobii.com/products/eye-trackers/wearables/tobii-pro-glasses-3
• The recorded screen videos, voices, provided answers, and eyetracking files will be held on the GWDG cloud, which stores the data in the EU and thus follows European regulations.
• The recorded sessions will be transcribed via Voice AI, which the GWDG provides. The privacy policy of Voice AI can be found here: https://docs.hpc.gwdg.de/services/voice-ai/data-privacy/index.html
• To analyse the transcription, we use MAXQDA software. The privacy policy of MAXQDA can be found here: https://www.maxqda.com/privacy

In order to compensate you for participating in our study with a payment of 30 euros, we require your bank information. Your bank information will be transferred to the University of Göttingen's accounting department, which will issue the payment to you and retain your bank information in accordance with the usual retention period for financial records. We will not keep your bank information after transferring it to the accounting department. 

Your anonymised data will be analysed and evaluated by research group members and students of the University of Göttingen. The results of the study may be published as scientific publications at a later date. As recommended by the DFG, your answers will be stored for 10 years to prove compliance with the guidelines of good scientific practice upon request. Even if your data is anonymous, for legal reasons, we must inform you that you have the following rights, as far as they are purely logical, in relation to your personal data processed by us: 

• The right to access personal data processed by us
• In certain cases, rectification, erasure, restriction of the processing of your personal data or opposition to the processing

To do so, please contact Mrs. Shirin Shams, shirin.shams@uni-goettingen.de, Tel: +49 551 39-26052

For questions regarding data protection, the Data Protection Officer of the University of Göttingen, Prof. Wiebe, can be reached as follows: datenschutz@uni-goettingen.de, Postal address: Platz der Göttinger Sieben 6,37073 Göttingen. More at https://www.uni-goettingen.de/de/576209.html

You may also contact the State Commissioner for Data Protection, Lower Saxony, Prinzenstraße 5, 30159 Hannover, e-mail: poststelle@lfd.niedersachsen.de, directly at any time.