Last updated: [●]
Effective date: [●]
Version: [●]
Summary
This summary is for convenience only. The full Policy below governs.
Who we are Scientific Steps for Programming LLC, a limited liability company registered in the Hashemite Kingdom of Jordan, which operates the Peerline platform ("we", "us", the "Provider"). What Peerline does A hosted platform that universities, research centres and academic institutions ("Institutions") use to run their own peer-reviewed journals, on their own domains and under their own branding. Who is responsible for your data For journal data (submissions, peer review, editorial correspondence, reader and subscriber data of a journal), the Institution that owns the journal is the data controller and we act only as its data processor. Contact the journal first about that data. For our own data (Institution account and billing contacts, our website, demo and trial requests, support communications, security logs), we are the data controller. What we do not do We do not sell personal data. We do not use advertising cookies. We do not store card numbers. We do not store IP addresses for usage statistics. AI features are optional, switched on or off by each journal, and advisory only — editors always make the decisions. Confidential peer review Reviewer identities are hidden according to the journal's review model (for example, single-blind or double-blind), and the platform includes a server-side safeguard designed to prevent reviewer identities from being disclosed in emails. Public by nature Published articles and their metadata, including author names, affiliations and ORCID iDs, are public because that is what publishing means. Your rights Access, rectification, erasure (subject to the integrity of the scholarly record), restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. We aim to respond within 30 days. Contact Privacy email: [●] · Phone/WhatsApp: +962 79 127 0283
Contents
- Who We Are
- Scope of this Policy
- Our Role: Controller and Processor
- Personal Data We Process
- How We Obtain Personal Data
- Purposes and Legal Bases for Processing
- Confidential Peer Review and the Editorial Record
- Optional AI Assistant
- Payments and Article Processing Charges
- Cookies and Similar Technologies
- Recipients and Sub-processors
- Information that Becomes Public
- International Data Transfers
- Security
- Data Retention
- Your Rights and How to Exercise Them
- Personal Data Breaches
- Children
- Automated Decision-Making
- Changes to this Policy
- Contact Us
1. Who We Are
1.1 The Peerline platform (the "Platform") is provided by Scientific Steps for Programming LLC, a limited liability company registered in the Hashemite Kingdom of Jordan (the "Provider", "we", "us" or "our").
1.2 The Platform is a hosted, multi-tenant software service that enables universities, research centres and other academic institutions (each an "Institution") to operate peer-reviewed journals (each a "Journal"). Its functions include manuscript submission; peer review (including single-blind and double-blind models); editorial decisions; discussions; production (conversion of manuscripts into HTML, PDF and JATS XML); publishing; DOI registration; similarity checking; ORCID sign-in and verification; indexing and metadata dissemination; long-term preservation; newsletters and announcements; certificates; editorial and usage statistics; and an optional AI assistant.
1.3 Each Journal operates on its Institution's own domain and under its Institution's own branding. Institutions own their content, their DOI prefix and their data.
1.4 [If applicable — to be confirmed by the Provider: our representative in the European Union / United Kingdom for the purposes of Article 27 of the GDPR / UK GDPR is [●].]
2. Scope of this Policy
2.1 This Policy explains how personal data is processed in connection with:
(a) the Platform, as used by Institutions, Journals, and their authors, reviewers, editors, editorial board members, staff, readers and subscribers ("Users");
(b) our own website at [●] (the "Website");
(c) requests for demonstrations or trials, sales enquiries, contracts with Institutions, billing, and customer support; and
(d) the security and operation of our systems.
2.2 Each Journal may publish its own privacy notice, editorial policies and terms. Where a Journal's own privacy notice applies to journal data, that notice — issued by the Institution as controller — governs the Institution's processing, and this Policy describes how we, as processor, handle that data on the Institution's behalf.
2.3 This Policy does not cover third-party websites or services linked from the Platform or the Website, or tools that an Institution adds to its own Journal (see Sections 10.4 and 11.4).
3. Our Role: Controller and Processor
Data protection laws distinguish between the controller (who decides why and how personal data is processed) and the processor (who processes personal data on the controller's behalf and on its instructions). This distinction determines who you should contact and who is responsible to you.
3.1 Where the Institution is the controller and we are the processor
For all personal data processed for a Journal ("Journal Data"), the Institution that owns the Journal is the controller, and the Provider acts as a processor on the Institution's documented instructions under a data processing agreement with that Institution. Journal Data includes:
- accounts and profiles of authors, reviewers, editors, editorial board members, journal staff and readers registered with a Journal;
- manuscripts, files, metadata, declarations, peer-review reports, recommendations and editorial decisions;
- editorial correspondence, the email log, discussion messages and audit logs relating to a Journal;
- certificates, and signatures uploaded by journal managers;
- article processing charge (APC) records of a Journal;
- newsletter and announcement subscriptions to a Journal; and
- usage and editorial statistics of a Journal.
The Institution decides, among other things, which review model to use, which features and integrations to enable, who has access, what is published, and how long data is kept. We do not use Journal Data for our own purposes, except as strictly necessary to provide, secure, maintain and support the Platform, or where required by law.
If your question or request concerns Journal Data, please contact the Journal or its Institution first. Their contact details appear on the Journal's website. If you contact us about Journal Data, we will, where we can identify the Journal concerned, forward your request to the relevant Institution and assist it in responding, but we may not act on the request ourselves without the Institution's instructions unless the law requires otherwise.
3.2 Where we are the controller
The Provider is the controller of the following personal data ("Provider Data"):
- account and contact details of Institution representatives and administrators who contract with us or manage the Institution's subscription;
- billing and invoicing data relating to the Institution's subscription to the Platform (but not APC payments, which are made to the Journal/Institution — see Section 9);
- data collected through our own Website;
- demonstration, trial and sales enquiry requests;
- support requests and communications with us;
- our own marketing communications (where applicable); and
- security, access and system logs we keep to protect the Platform and our infrastructure.
For Provider Data, you may contact us directly using the details in Section 21.
3.3 Laws referred to in this Policy
3.3.1 The Provider is established in Jordan and processes personal data in accordance with the Jordanian Personal Data Protection Law No. 24 of 2023 and its implementing instructions (the "Jordanian PDPL").
3.3.2 Where the EU General Data Protection Regulation (EU) 2016/679 (the "GDPR") or the UK GDPR and the UK Data Protection Act 2018 apply — for example, to Users in the European Economic Area or the United Kingdom — we process personal data in accordance with those laws.
3.3.3 Users in other jurisdictions may have rights under their local laws, for example the Saudi Personal Data Protection Law (issued by Royal Decree No. M/19 of 1443H, as amended) or the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Nothing in this Policy limits rights that cannot be limited under applicable law.
3.3.4 In this Policy, "applicable data protection law" means whichever of the above laws (and any other law) applies to the processing concerned.
4. Personal Data We Process
Depending on how you use the Platform, the following categories of personal data may be processed. Unless stated otherwise, data relating to a Journal is Journal Data (Institution as controller).
| Category | Examples | Typical data subjects |
|---|---|---|
| Account data | Name, email address, affiliation, country, ORCID iD, roles held in a Journal, password (stored only as a cryptographic hash), language and display preferences; for staff accounts, two-factor authentication (2FA) secrets and recovery codes (stored encrypted). | Authors, reviewers, editors, staff, registered readers |
| Manuscripts and files | Submitted manuscripts, figures, datasets, supplementary files, revisions and production files (all uploads are scanned for malware). | Authors and persons named in submissions |
| Metadata | Titles, abstracts, keywords, author lists and order, affiliations, funding information, contributor roles (CRediT), references. | Authors, contributors, funders' contacts |
| Peer-review data | Review reports, recommendations, scores, reviewer invitations and responses, conflict-of-interest declarations. These are confidential (see Section 7). | Reviewers, authors |
| Editorial correspondence (email log) | For each email sent through the Platform: sender, recipients (including CC and BCC), subject, body, attachments and delivery status. | All Users who send or receive editorial email |
| Discussions | Messages exchanged in submission discussions between authors, editors and reviewers, according to their permissions. | Participants |
| Audit logs | Records of actions taken within a Journal (for example, who changed a status, made a decision or accessed a file, and when). | Users with access to a Journal |
| Author declarations | Authorship, originality, ethics, consent, competing-interest and funding declarations, and licence agreements. | Authors |
| Certificates | Certificates of review, acceptance, publication or editorial board membership, including the holder's name, the certificate type, the Journal, the date and a verification code. | Reviewers, authors, board members |
| Signatures | Images of signatures uploaded by journal managers, with the signer's consent, for use on certificates. | Editors and officers of the Journal |
| Payment records (APCs) | Invoice details, amount, currency, payment status, payer name and billing details, and transaction references returned by the payment gateway. We do not store payment card data (see Section 9). | Authors, payers |
| Newsletter subscriptions | Email address, subscription preferences, date and evidence of opt-in, unsubscribe records. | Subscribers |
| Technical and usage data | Server and security logs, device and browser type, session identifiers, timestamps, error reports. [Owner to confirm whether security logs record IP addresses and for how long: [●].] Usage statistics (including COUNTER-compliant statistics) are aggregated and compiled without storing IP addresses. | All visitors and Users |
| Provider Data | Names, job titles, institutional email and phone numbers of Institution contacts; contract and billing details; demo/trial requests; support tickets and communications. | Institution representatives, prospective customers |
4.2 Special categories of data. The Platform is not designed to collect special categories of personal data (such as health data). However, manuscripts, declarations or correspondence may contain such data (for example, in clinical research or ethics declarations). Institutions and authors are responsible for ensuring that any such data is lawfully included, appropriately anonymised where required, and supported by any necessary consent or ethics approval.
4.3 Data about third parties. If you provide personal data about another person (for example, co-authors, suggested reviewers or participants named in a manuscript), you should ensure you are entitled to do so.
5. How We Obtain Personal Data
5.1 Directly from you, when you register, submit a manuscript, review, edit, correspond, subscribe, request a demo or contact support.
5.2 From other Users, for example when an author lists co-authors, an editor invites a reviewer, or a journal manager creates an account or uploads a signature (with the signer's consent).
5.3 From ORCID, when you choose to sign in with or link your ORCID iD (via OAuth). We receive your ORCID iD and the information you authorise ORCID to share; we do not receive your ORCID password.
5.4 From integrated services enabled by a Journal, for example similarity reports from the Journal's iThenticate/Crossref Similarity Check account, DOI registration responses from Crossref, and payment status from the Journal's payment gateway.
5.5 Automatically, through strictly necessary cookies and system logs when you use the Platform or the Website (see Section 10).
6. Purposes and Legal Bases for Processing
6.1 Journal Data (Institution as controller)
We process Journal Data only on the Institution's instructions in order to provide the Platform's functions to that Institution, including: managing accounts and roles; receiving and handling submissions; running peer review; recording editorial decisions; sending editorial emails; production; publishing; registering DOIs; similarity checking; disseminating metadata and exports to indexes; preservation; newsletters; certificates; statistics; the optional AI assistant; and providing support, backups and security.
The legal basis for the Institution's processing of Journal Data is determined by the Institution as controller and is typically one or more of: performance of a contract or steps at the data subject's request (for example, handling an author's submission); the Institution's legitimate interests or public-interest/academic functions (for example, conducting peer review and maintaining the integrity of the scholarly record); compliance with legal obligations; and consent (for example, for newsletters, signature images or optional features where the Institution relies on consent). Please consult the Journal's own privacy notice.
6.2 Provider Data (Provider as controller)
| Purpose | Legal basis |
|---|---|
| Entering into and performing our contract with an Institution; account administration; invoicing and collection of subscription fees | Performance of a contract; our legitimate interests in managing our business relationship with the Institution (where the individual is not personally a party to the contract) |
| Responding to demo, trial and sales enquiries | Steps taken at the request of the data subject prior to entering into a contract; legitimate interests |
| Providing customer support and communicating about the service (including service and security notices) | Performance of a contract; legitimate interests |
| Securing the Platform, detecting and preventing fraud, abuse and security incidents; maintaining security and access logs | Legitimate interests in protecting our systems, our customers and Users; legal obligations |
| Preserving the integrity of the scholarly record maintained on the Platform (including the immutable email log and audit logs) on behalf of Institutions | Legitimate interests (and those of the Institution and the scholarly community) in reliable, verifiable editorial records |
| Sending our own marketing communications (where applicable) | Consent, or legitimate interests where permitted by law, with an easy way to opt out at any time |
| Complying with legal, tax, accounting and regulatory obligations; responding to lawful requests from authorities; establishing, exercising or defending legal claims | Legal obligation; legitimate interests |
6.3 Legitimate interests. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may request more information about this assessment and you have the right to object (Section 16).
6.4 Consent. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
6.5 No sale or advertising. We do not sell personal data and do not use it for advertising or behavioural profiling.
7. Confidential Peer Review and the Editorial Record
7.1 Confidentiality of reviews. Peer-review reports, recommendations and editorial deliberations are treated as confidential and are accessible only to Users whose role in the Journal permits access.
7.2 Reviewer anonymity. Reviewer and author identities are shown or hidden according to the review model chosen by the Journal (for example, single-blind or double-blind). In addition to role-based access controls, the Platform includes a server-side safeguard designed to prevent reviewer identities from being disclosed in emails sent through the Platform where the review model requires anonymity. Authors are responsible for removing identifying information from manuscripts submitted to double-blind journals, as instructed by the Journal.
7.3 Open review. Reviewer identities and/or review reports are published only where the Journal operates an open review model and the reviewer has agreed.
7.4 Immutable email log. Emails sent through the Platform for a Journal are recorded in a log that cannot be edited or deleted by Users, including sender, recipients (including CC and BCC), subject, body, attachments and delivery status. This log forms part of the Journal's editorial record and supports accountability, dispute resolution, research-integrity investigations and the integrity of the scholarly record. Because of this purpose, requests to erase or amend entries in the log may be limited (see Section 16.3).
7.5 Audit logs. Actions within a Journal are recorded in audit logs for the same purposes and for security.
8. Optional AI Assistant
8.1 The Platform offers an optional AI assistant that can support, for example, initial manuscript screening, reference checks, reviewer suggestions and summaries of review reports. Each Journal decides whether to switch these features on or off. If a Journal has not enabled them, no data from that Journal is sent to the AI provider.
8.2 When enabled, the relevant content (such as parts of a manuscript, its metadata or review reports) is sent to a third-party AI application programming interface (API) provider, [●] (the "AI Provider"), acting as our sub-processor, solely to generate the requested output.
8.3 We apply data minimisation: we send only the data reasonably necessary for the requested task. We select AI Provider services and settings under which, according to the AI Provider's contractual commitments, customer data submitted through the API is not used to train its models [owner to confirm the AI Provider's specific commitments and data-retention period: [●]]. We cannot give assurances beyond the commitments the AI Provider actually offers.
8.4 AI outputs are advisory only. They do not constitute editorial decisions. Editors always review and make all editorial decisions, and they remain responsible for them. AI outputs may be inaccurate and should be verified.
9. Payments and Article Processing Charges
9.1 APCs are paid to the Journal/Institution, not to the Provider. Each Institution configures its own payment methods — such as Stripe, PayPal, bank transfer or local methods (for example, Sham Cash) — using its own merchant or bank accounts. The Institution is the controller of APC payment data, and each payment gateway processes payment data under its own terms and privacy policy.
9.2 Card data. Payment card details are entered into and handled by the payment gateway. The Platform does not store payment card numbers or security codes. The Platform records only the information necessary to manage the APC, such as amount, currency, status, invoice details and the transaction reference returned by the gateway.
9.3 Payments by Institutions for their subscription to the Platform are Provider Data and are handled as described in Section 6.2.
10. Cookies and Similar Technologies
10.1 We use only cookies and similar technologies (such as local storage) that are strictly necessary for the Platform to function securely, and preference cookies that remember your choices.
10.2 We do not use advertising cookies, and we do not use third-party analytics cookies on the Platform or the Website [owner to confirm for the Website: [●]].
10.3 Cookie table
| Name | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
| [●] (session) | Strictly necessary | Keeps you signed in and maintains your session | [●] (session / [●]) | Platform (first party) |
| [●] (CSRF token) | Strictly necessary | Protects forms against cross-site request forgery | [●] | Platform (first party) |
| [●] (login / authentication, including 2FA state) | Strictly necessary | Authenticates you and supports two-factor authentication | [●] | Platform (first party) |
| [●] (language) | Preference | Remembers your chosen interface language | [●] | Platform (first party) |
| [●] (theme) | Preference | Remembers your display theme (for example, light or dark) | [●] | Platform (first party) |
Strictly necessary cookies cannot be switched off because the Platform cannot work without them. You can block or delete preference cookies through your browser settings; the Platform will then use default settings.
10.4 Tools added by Institutions. An Institution may add its own analytics, embedded content or other third-party tools to its Journal. The Institution is responsible for those tools, for obtaining any consent they require, and for disclosing them in its own privacy and cookie notices.
11. Recipients and Sub-processors
11.1 Within the Provider. Our personnel access personal data only on a need-to-know basis — for example, to provide support requested by an Institution, to maintain and secure the Platform, or where required by law — and are bound by confidentiality obligations.
11.2 Sub-processors engaged by the Provider. We use the following service providers to operate the Platform. They process personal data only on our instructions and under written agreements that require appropriate data protection and security.
| Sub-processor | Service | Location | Data |
|---|---|---|---|
| Hostinger | Virtual private server (VPS) hosting | Data centre: [●] | All Platform data |
| [●] (for example, Amazon SES) | Email delivery | [●] | Email addresses, email content and attachments, delivery status |
| [●] | AI API provider — only when a Journal enables the AI assistant (Section 8) | [●] | Minimised content needed for the requested task |
| [●] | Off-site backup storage | [●] | Encrypted backups |
| [●] | Support partner(s), under confidentiality obligations | [●] | Data necessary to handle a support request |
An up-to-date list of sub-processors is available [at [●] / on request]. We will inform Institutions of intended changes to sub-processors in accordance with our agreements with them.
11.3 Services enabled by a Journal under its own accounts. The following services are used only if the Journal enables them, and under the Journal's own accounts and agreements. When enabled, the Institution directs that the relevant data be shared with them, and they process it under their own terms and privacy policies:
- Crossref — DOI registration and metadata deposit, using the Journal's own Crossref membership and DOI prefix;
- iThenticate / Turnitin (Crossref Similarity Check) — similarity checking of manuscripts, using the Journal's own account;
- ORCID — sign-in, iD verification and (where authorised) updating ORCID records via OAuth;
- DOAJ and NLM / PubMed / PubMed Central — metadata and content exports, where the Journal participates;
- LOCKSS, CLOCKSS, Portico — long-term preservation packages, where the Journal participates;
- Payment gateways chosen by the Institution (Section 9).
11.4 Public metadata services. Where a Journal publishes content, its public metadata is made available through OAI-PMH and Google Scholar meta-tags so that indexing services can harvest it.
11.5 Other disclosures. We may disclose personal data: (a) where required by law, court order or a lawful request of a competent authority, after assessing the request and, where permitted, informing the Institution concerned; (b) to protect the rights, safety and security of Users, Institutions, the Provider or others; and (c) to a successor in the event of a merger, acquisition or transfer of all or part of our business, subject to this Policy or equivalent protections.
12. Information that Becomes Public
12.1 Published content. Publishing is, by its nature, public. When a Journal publishes an article, the article and its metadata — including author names, affiliations, ORCID iDs, abstracts, references, funding information and contributor roles — become publicly available on the Journal's website and through Crossref, indexes, OAI-PMH, Google Scholar and preservation services, and may be copied and cited by third parties beyond our or the Institution's control.
12.2 Reviewer identities are not published unless the Journal operates an open review model and the reviewer has agreed.
12.3 Certificate verification. Certificates carry a code that can be checked on a public verification page. Anyone with the code can confirm the certificate's authenticity and see the details shown on the certificate [owner to confirm the exact fields displayed: for example, holder's name, certificate type, Journal and date — [●]].
12.4 Editorial board and staff listings that a Journal chooses to display publicly are published under the Institution's control.
13. International Data Transfers
13.1 Personal data may be processed outside the country in which you are located, including in Jordan (where the Provider is established), in [●] (the location of our hosting data centre), and in the countries where our sub-processors and the services enabled by a Journal operate.
13.2 Where applicable data protection law restricts international transfers, we rely on appropriate safeguards, such as: adequacy decisions or equivalent determinations where available; standard contractual clauses approved by the European Commission (and the UK International Data Transfer Addendum, where relevant) or equivalent contractual safeguards recognised under the Jordanian PDPL or other applicable law; and other lawful transfer mechanisms. You may request further information on the safeguards used, using the contact details in Section 21.
13.3 Transfers of Journal Data are made on the Institution's instructions and in accordance with our agreement with the Institution.
14. Security
14.1 We implement reasonable and appropriate technical and organisational measures, taking into account the nature of the data and the risks involved, including:
- tenant isolation enforced at the database level using PostgreSQL row-level security, so that each Institution's data is logically separated;
- encryption in transit using TLS;
- encrypted storage of secrets and cryptographic keys, including 2FA secrets;
- two-factor authentication for staff accounts;
- role-based access control within each Journal and within the Provider;
- malware scanning of uploaded files (using ClamAV);
- signed, time-limited download links for files;
- daily encrypted off-site backups; and
- access logging and monitoring.
14.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password and authentication factors confidential and for notifying the Journal (or us, for Provider accounts) promptly of any suspected unauthorised use.
15. Data Retention
15.1 Journal Data is retained for as long as the Institution's subscription is active and in accordance with the Institution's instructions.
15.2 Editorial record. Submissions, review records, decisions, the email log and audit logs are retained to preserve the integrity of the scholarly record, in accordance with the Institution's policies.
15.3 Published content is, by its nature, intended to be permanent, subject to the Journal's correction, retraction and removal policies (consistent with recognised publication-ethics practice).
15.4 Backups. Daily backups can be downloaded by the Institution. Backups are retained on a rolling basis and are overwritten or deleted within [●] days.
15.5 On termination of an Institution's subscription: (a) the Institution may obtain a full export of its data during a period of [●] days; (b) thereafter, we delete Journal Data from the live Platform within [●] days; (c) residual copies in backups are deleted as backups roll off within [●] days; and (d) we retain only data we are required to keep by law, and keep it protected.
15.6 Individual accounts. A User may request deletion of their account. Where no legal obligation or legitimate scholarly-record ground prevents it, the account is deleted or anonymised. Contributions that form part of the editorial or published record (for example, authorship of published articles, or submitted reviews) may be retained, de-identified or anonymised where possible, in accordance with the Institution's policies.
15.7 Provider Data is retained for as long as necessary for the purposes described in Section 6.2: contract and billing records for [●] years, or as required by applicable tax and accounting law; support communications for [●]; security logs for [●]; demo and trial requests for [●] if no contract follows; and marketing data until you unsubscribe or withdraw consent.
16. Your Rights and How to Exercise Them
16.1 Your rights. Subject to the conditions and exceptions in applicable data protection law, you may have the right to:
- access your personal data and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data;
- restriction of processing;
- object to processing based on legitimate interests (and, at any time, to direct marketing);
- data portability, to receive data you have provided in a structured, commonly used, machine-readable format;
- withdraw consent at any time, where processing is based on consent (for example, by using the one-click unsubscribe link in any newsletter); and
- lodge a complaint with a supervisory authority — in Jordan, the competent authority under the Jordanian PDPL (the Personal Data Protection Council); in the EEA or the UK, the supervisory authority of your place of residence, work or the alleged infringement; or the competent authority in your own jurisdiction.
16.2 How to exercise them.
- For Journal Data: contact the Journal or its Institution, which is the controller. We will assist the Institution in responding.
- For Provider Data: contact us at [●] or +962 79 127 0283.
16.3 Limitations relating to the scholarly record. Some rights, in particular erasure and rectification, may be limited where the data forms part of the editorial or published record and retention is necessary, for example, to preserve the integrity of the scholarly record, for research-integrity or publication-ethics investigations, for archiving in the public interest, for scientific or historical research purposes, to comply with a legal obligation, or to establish, exercise or defend legal claims. Corrections to published articles are handled under the Journal's correction and retraction policies. Where a request cannot be met in full, we or the Institution will explain why.
16.4 Verification. To protect your data, we may need to verify your identity before acting on a request, and may ask for additional information for that purpose.
16.5 Response time. We aim to respond within 30 days of receiving a verified request. Where permitted by applicable law, this period may be extended when requests are complex or numerous, in which case we will inform you. Requests are normally free of charge, unless they are manifestly unfounded or excessive.
17. Personal Data Breaches
17.1 Journal Data. If we become aware of a personal data breach affecting Journal Data, we will notify the affected Institution(s) without undue delay and, where feasible, within 72 hours of becoming aware of it, and will provide the information reasonably available to help the Institution meet its own obligations, including any notification to authorities or data subjects.
17.2 Provider Data. If a breach affects Provider Data, we will assess it and notify the competent supervisory authority and affected individuals where required by applicable data protection law and within the timeframes it prescribes.
17.3 We will take reasonable steps to contain the breach, mitigate its effects and prevent recurrence, and will document breaches as required by law.
18. Children
The Platform is intended for academic and professional users and is not directed to children under [16] [●] years of age. We do not knowingly collect personal data from children under that age. If you believe that a child has provided personal data through the Platform, please contact the relevant Journal or us so that appropriate action can be taken. Where research involving minors is described in a manuscript, the Institution and authors are responsible for compliance with applicable ethics and consent requirements.
19. Automated Decision-Making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Outputs of the optional AI assistant (Section 8), similarity reports and automated checks are advisory tools only. Editorial decisions are always made by human editors.
20. Changes to this Policy
20.1 We may update this Policy from time to time to reflect changes in the Platform, our practices or the law. The "Last updated" date at the top shows when it was last revised.
20.2 If we make material changes, we will notify Institutions in advance [by email / in-platform notice] [●] and, where appropriate, notify Users through the Platform. Where required by law, we will seek consent to changes.
20.3 Previous versions of this Policy are available [on request / at [●]].
21. Contact Us
Scientific Steps for Programming LLC
Registered in the Hashemite Kingdom of Jordan
Address: [●]
Privacy email: [●]
Phone / WhatsApp: +962 79 127 0283
[Data protection officer / privacy contact (if designated): [●]]
[EU / UK representative (if required): [●]]
For Journal Data, please contact the relevant Journal or its Institution first.
This Policy is published in English and Arabic. In case of any conflict or inconsistency between the two versions, the [English / Arabic] [●] version shall prevail.