GDPR Compliance and Personal Data Protection Statement

1. Introduction

This statement describes the principles and procedures followed by this journal in relation to the protection and processing of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, commonly known as the General Data Protection Regulation (GDPR), and other applicable data-protection legislation. The journal recognizes the importance of protecting the privacy, confidentiality, and personal information of authors, reviewers, editors, editorial board members, registered readers, and other individuals who interact with its website and publishing services. Personal data are processed in a transparent, fair, and responsible manner and only for specified, explicit, and legitimate purposes associated with the journal's academic, editorial, administrative, and publishing activities. The journal is committed to respecting the rights of individuals and implementing appropriate measures to protect personal information against unauthorized access, unlawful processing, accidental loss, destruction, alteration, or disclosure. This statement should be read together with the journal's Privacy Notice, which provides additional information about the collection, use, storage, and disclosure of personal information.

 

2. Data Controller Identification

For the purposes of the GDPR, the data controller is the individual or legal entity that determines the purposes and means of processing personal data. The identity and contact details of the controller responsible for this journal are:

Organization: Open Access Publishing Group,

Registered Address: Moinesti Street, No. 40, Bucharest, Romania,

Country: Romania,

Email Address: contact@oapub.org.

Where a publishing organization operates several journals, the identity of the controller must be determined for the relevant processing activities. The organization operating the journal website, the publisher, and the editorial team should not automatically be treated as the same legal entity. Questions, requests, and complaints concerning the processing of personal data may be submitted to the data controller using the contact details provided above.

 

3. Scope of Application

This statement applies to personal data processed in connection with the operation and administration of the journal, including information collected through its online publishing platform. It covers, where applicable:

- Authors submitting manuscripts for consideration or publication.

- Reviewers participating in the peer-review process.

- Editors, associate editors, and editorial board members.

- Registered users and readers.

- Individuals contacting the editorial office.

- Contributors whose names and professional details appear in published articles.

- Other individuals whose personal information is processed in connection with the journal's activities.

The statement applies to personal data collected through account registration, manuscript submission, editorial correspondence, peer review, publication, website administration, and related publishing operations.

 

4. Categories of Personal Data

The journal processes only personal data that are reasonably necessary for the relevant academic, editorial, administrative, and publishing purposes. Depending on an individual's relationship with the journal, the information processed may include:

- Identification and professional information: Name, academic title, institutional affiliation, professional position, and ORCID identifier, where provided.

- Contact information: Email address, institutional contact details, and other contact information voluntarily supplied by the individual.

- Account information: Username, account settings, user role, and information necessary to authenticate and administer a registered account.

- Manuscript information: Author details, article title, abstract, keywords, acknowledgements, author contributions, and other information supplied as part of a manuscript submission.

- Editorial and peer-review information: Reviewer assignments, review reports, editorial correspondence, manuscript status, revision history, and editorial decisions.

- Publication information: Author names, affiliations, bibliographic metadata, and other information associated with articles published by the journal.

- Technical information: Information generated through the use of the website, such as IP addresses, access logs, browser information, session identifiers, and security-related records, where collected by the publishing platform or hosting infrastructure.

The journal does not intentionally collect special categories of personal data, as defined in Article 9 of the GDPR, unless their processing is necessary and an applicable legal condition permits it. Individuals should avoid submitting sensitive personal information that is unrelated to the manuscript, editorial process, or legitimate activities of the journal.

 

5. Purposes of Personal Data Processing

Personal data may be processed for the following purposes:

- Creating, maintaining, and administering user accounts

- Receiving, registering, and managing manuscript submissions.

- Communicating with authors concerning editorial decisions, revisions, and publication.

- Selecting reviewers and administering peer-review procedures.

- Managing editorial assignments and correspondence.

- Preparing accepted manuscripts for publication.

- Publishing articles and associated scholarly metadata.

- Maintaining bibliographic records and preserving the scholarly record.

- Responding to inquiries and requests submitted to the editorial office.

- Maintaining website functionality, security, and technical reliability.

- Preventing unauthorized access, misuse, fraudulent submissions, and other activities that may compromise the journal.

- Meeting applicable legal, regulatory, contractual, and administrative obligations.

- Protecting the rights and legitimate interests of the journal, its publisher, authors, and other relevant parties, where legally justified.

Personal information will not be used for unrelated commercial purposes or disclosed to third parties for their independent marketing activities.

Any proposed use of personal data for a new purpose will be assessed against the requirements of the GDPR, including the principles of purpose limitation, transparency, and lawful processing.

 

6. Legal Bases for Processing

The journal processes personal data only where an applicable legal basis under Article 6 of the GDPR exists. Depending on the circumstances and the specific processing activity, the relevant legal bases may include the following.

6.1. Performance of a Contract or Steps Taken at the Individual's Request

Article 6(1)(b) may apply where processing is necessary to perform a contract with the individual or to take steps requested by the individual before entering into a contract. For example, this legal basis may be relevant to processing necessary to provide a publishing service under an applicable agreement. It should not automatically be applied to every author, reviewer, or registered user. Its applicability depends on the actual contractual relationship and the necessity of the processing.

6.2. Compliance with a Legal Obligation

Article 6(1)(c) may apply where the journal or its controller must process personal data to comply with a legal obligation imposed by applicable law. This may include processing necessary to satisfy relevant accounting, tax, regulatory, or other legal requirements, where applicable.

6.3. Legitimate Interests

Article 6(1)(f) may apply where processing is necessary for the legitimate interests pursued by the controller or a third party, provided that those interests are not overridden by the individual's interests or fundamental rights and freedoms. Depending on the circumstances, legitimate interests may include administering the journal, coordinating peer review, maintaining editorial records, protecting website security, preventing misuse, and preserving the reliability of the publishing process. Where this legal basis is used, the controller must assess whether the processing is necessary and whether the individual's rights and interests prevail.

6.4. Consent

Article 6(1)(a) may apply where the individual has given valid consent to a specific processing activity. Consent will be requested where required by law and will be freely given, specific, informed, and unambiguous. Individuals will be informed of their right to withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Consent will not be treated as the automatic legal basis for every activity performed by the journal. Where another legal basis applies, the relevant processing will be assessed and documented accordingly.

6.5. Public Interest or Other Applicable Legal Grounds

Where applicable, Article 6(1)(e) or another legally available basis may be used only where its specific requirements are satisfied. The journal will identify the appropriate legal basis for each relevant processing activity rather than relying on a single legal basis for all personal data.

 

7. Data Minimization and Accuracy

The journal seeks to collect and process only the personal data necessary for the purposes for which they are required. Users are encouraged to provide accurate and up-to-date information when registering accounts, submitting manuscripts, accepting review invitations, or communicating with the editorial office. Where personal data are inaccurate or incomplete, individuals may request correction or updating, subject to applicable legal requirements and the need to preserve the integrity of published scholarly records. The journal will not retain or collect additional personal information merely because it is technically possible to do so.

 

8. Confidentiality and Access Restrictions

Personal data are accessible only to individuals who require access for legitimate editorial, administrative, publishing, or technical purposes. Access permissions should reflect the responsibilities of each user role within the journal's publishing platform. Authors' contact details, reviewers' identities, editorial correspondence, and unpublished manuscripts will be handled in accordance with the journal's editorial policies and applicable confidentiality requirements. Reviewers must not disclose or misuse confidential information obtained through manuscript evaluation. Editorial personnel are expected to exercise appropriate discretion when accessing or handling personal information. Where the journal uses a confidential or anonymous peer-review model, reasonable measures will be taken to protect reviewer identities and other confidential information in accordance with that model. Confidentiality requirements do not prevent disclosures that are legally required or otherwise lawfully justified.

 

9. Disclosure to Service Providers and Other Recipients

The journal does not sell personal data or provide personal information to third parties for unrelated commercial purposes. Where necessary for its operation, personal data may be processed by authorized service providers, including website hosting providers, technical support personnel, email service providers, and other organizations supplying services required for the publishing process. Depending on the journal's actual arrangements, relevant recipients may also include DOI registration agencies, scholarly indexing services, repositories, archiving services, and bibliographic databases. The information shared with each recipient must be limited to what is necessary for the relevant purpose. Where a service provider processes personal data on behalf of the controller, the applicable contractual and data-protection requirements must be observed, including Article 28 of the GDPR where relevant. Where another organization determines its own purposes and means of processing, its role must be assessed separately rather than automatically treating it as a processor.

 

10. International Transfers of Personal Data

The journal may use technical services or scholarly platforms that operate in, or provide services from, countries outside the European Economic Area. Where personal data are transferred to a third country or an international organization, the controller will assess whether the transfer complies with Chapter V of the GDPR. Depending on the circumstances, a transfer may rely on an applicable adequacy decision, appropriate safeguards such as standard contractual clauses, or another transfer mechanism permitted by the GDPR. Where required, individuals will be informed about the relevant transfer arrangements and how to obtain information about the safeguards used. The journal will not assume that every international service provider offers an adequate level of protection without assessing the applicable transfer requirements.

 

11. Data Retention and Preservation

Personal data will be retained only for as long as necessary for the purposes for which they are processed, subject to applicable legal obligations and legitimate requirements for maintaining editorial and publication records. Retention periods will depend on the type of information and the purpose of its processing. User account information may be retained while an account remains active and for a reasonable period thereafter where necessary for administration, security, dispute resolution, or compliance with applicable obligations. Manuscript submissions, peer-review reports, editorial correspondence, and related records may be retained for as long as necessary to document editorial decisions, maintain publication integrity, address disputes, and satisfy applicable legal or administrative requirements. Published articles and their essential bibliographic metadata may be preserved indefinitely as part of the scholarly record, subject to applicable law and the journal's publication and archiving policies. Technical logs and security records should be retained for a period appropriate to their operational and security purposes. The controller will establish and periodically review retention periods or criteria for determining them. Personal data that are no longer required will be deleted, anonymized, or otherwise handled in accordance with applicable law.

 

12. Rights of Data Subjects

Under the GDPR, individuals may have the following rights in relation to their personal data, subject to the conditions and exceptions established by applicable law:

- Right of access: The right to obtain confirmation of whether personal data concerning them are being processed and, where applicable, to access those data and receive relevant information about the processing.

- Right to rectification: The right to request correction of inaccurate personal data and completion of incomplete personal data, where applicable.

- Right to erasure: The right to request deletion of personal data where the conditions for erasure under the GDPR are satisfied.

- Right to restriction of processing: The right to request restriction of processing in circumstances specified by the GDPR.

- Right to data portability: Where the legal conditions are met, the right to receive certain personal data in a structured, commonly used, machine-readable format and to transmit those data to another controller.

- Right to object: The right to object to processing based on Article 6(1)(e) or Article 6(1)(f) on grounds relating to the individual's particular situation, subject to the conditions and exceptions provided by law.

- Right to withdraw consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

- Right to lodge a complaint: The right to lodge a complaint with the competent data-protection supervisory authority.

These rights are not absolute in every circumstance. Their application depends on the relevant legal provisions and the nature of the processing. For example, a request to delete personal information does not automatically require the removal of a published article, the alteration of an accurate historical publication record, or the destruction of records that must lawfully be retained. Each request will be considered individually and in accordance with the GDPR.

 

13. Exercising Data Protection Rights

Individuals who wish to exercise their rights may contact the data controller using the contact details provided in Section 2. Requests should identify the nature of the request and provide sufficient information to enable the controller to locate the relevant personal data and, where necessary, verify the identity of the requester. Additional information may be requested where there are reasonable doubts about the identity of the individual making the request. Such information will be limited to what is necessary for verification. Requests will be handled within the time limits established by the GDPR. Under Article 12(3), the controller generally must provide information about action taken on a request without undue delay and within one month of receipt. This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, provided that the individual is informed of the extension and the reasons for it within the applicable initial period. The exercise of data-protection rights will be facilitated in accordance with applicable law. Where a request cannot be fulfilled, the individual will be informed of the reasons and of the applicable right to lodge a complaint or seek a judicial remedy.

 

14. Personal Data Breaches and Security

The journal seeks to maintain appropriate technical and organizational measures to protect personal information. Depending on the technical environment and the risks involved, these measures may include access controls, secure authentication, software maintenance, backups, system monitoring, appropriate staff permissions, and procedures for responding to security incidents. No online system can be guaranteed to be completely secure. Nevertheless, the controller will take reasonable and legally appropriate measures to reduce risks and respond to incidents affecting personal data. Where a personal data breach occurs, the controller will assess the incident and comply with the applicable notification obligations under Articles 33 and 34 of the GDPR, including notifying the competent supervisory authority within the legally prescribed period where required and informing affected individuals where the applicable conditions are met.

 

15. Cookies and Technical Processing

The journal's publishing platform may use cookies and similar technologies to support authentication, session management, security, navigation, and essential website functions. The hosting provider or technical infrastructure may also generate server logs and other technical records needed to maintain the website, diagnose errors, detect misuse, and protect system availability. The journal will provide any additional information and obtain consent where required for non-essential cookies or other tracking technologies. The use of cookies and similar technologies will be assessed in accordance with applicable data-protection and electronic-communications legislation.

 

16. Automated Decision-Making

The journal does not intend to make decisions producing legal effects or similarly significant effects on individuals solely through automated processing, including profiling, unless a lawful basis and the applicable safeguards are in place. Editorial decisions concerning manuscript acceptance, revision, or rejection are governed by the journal's editorial procedures. Where automated decision-making within the meaning of Article 22 of the GDPR is introduced, the journal will provide the information required by law and implement applicable safeguards.

 

17. Published Articles and the Scholarly Record

The journal's commitment to personal data protection operates alongside its responsibility to preserve the accuracy, accessibility, and integrity of the scholarly record. Articles published by the journal may contain authors' names, institutional affiliations, ORCID identifiers, acknowledgements, and other information intended to identify scholarly contributions. Published articles and bibliographic metadata may be distributed through the journal's website, indexing services, repositories, DOI registration agencies, and academic discovery platforms. Such publication and dissemination must have an appropriate legal basis and comply with applicable data-protection requirements. Requests to correct or remove personal information from published material will be assessed individually. Where appropriate, corrections, updates, or other remedies may be considered in accordance with the journal's editorial policies and applicable law. The publication of an article does not remove the rights individuals may have under the GDPR, but neither does the GDPR automatically require the deletion of an entire scholarly work whenever an author or contributor requests the removal of personal data.

 

18. Children and Other Vulnerable Individuals

The journal's registration and manuscript-submission processes are primarily intended for individuals participating in academic and scholarly publishing. Where the journal processes personal data relating to children or other individuals requiring particular protection, it will apply the safeguards required by the GDPR and other applicable law. Any processing of personal data in such circumstances will be assessed according to its purpose, legal basis, necessity, and the protections required for the individuals concerned.

 

19. Changes to This Statement

This statement may be revised when necessary to reflect changes in applicable legislation, the journal's publishing procedures, its technical infrastructure, or its personal-data processing activities. The current version will be made available on the journal's website. Where a material change requires additional information to be provided to individuals, the controller will take appropriate steps to meet its transparency obligations under applicable law.

 

20. Supervisory Authority and Complaints

Individuals who believe that their personal data have been processed in violation of applicable data-protection law may contact the journal's data controller to raise their concerns. They also have the right to lodge a complaint with the competent data-protection supervisory authority, in accordance with the GDPR. For a controller established in Romania, the relevant supervisory authority is:

- The National Supervisory Authority for Personal Data Processing (ANSPDCP)

- Official website: https://www.dataprotection.ro/

Individuals may consult the authority's official website for information about complaint procedures, contact details, and the exercise of their rights. The right to lodge a complaint does not prevent individuals from pursuing any other administrative or judicial remedies available under applicable law.

 

21. Contact for Privacy and Data Protection Matters

For questions concerning this statement, the processing of personal data, or the exercise of data-protection rights, please contact:

Organization: Open Access Publishing Group,

Registered Address: Moinesti Street, No. 40, Bucharest, Romania,

Country: Romania,

Email Address: contact@oapub.org.

The journal will review privacy-related requests and respond in accordance with applicable data-protection legislation.

 

22. Final Statement

The journal is committed to respecting the privacy and data-protection rights of individuals who interact with its publishing platform. Personal data will be processed fairly, lawfully, transparently, and for specified legitimate purposes. The journal will seek to limit the collection and retention of personal information to what is necessary, protect it through appropriate safeguards, and facilitate the exercise of individuals' rights under applicable law. This statement establishes the journal's intended data-protection principles and must be implemented in accordance with the actual processing activities, responsibilities, technical arrangements, and legal obligations of the relevant data controller.

Last updated: 24 October 2022.