Privacy Policy

• 1.1 The Privacy Officer is an accountability designation under Canadian law; no data protection officer under Article 37 GDPR is designated.
• 1.2 GCRI Canada is the controller of the personal information described in this Policy: it decides why and how the information is handled. Hosting, email and similar providers are processors acting on its instructions. No joint controllership is established with any other institution for the Site.
• 1.3 GCRI Canada (The Global Centre for Risk and Innovation) is the lead contracting organization for Nexortium Foundry and the Nexus Consortium. It is the contracting party for Nexortium Foundry accounts, services and consortium participation in every country and region, and runs the service under a strict not-for-profit mandate. Another organization, such as a national consortium host or a commercial licensor, is a party only where a separately executed agreement names it.
• 1.4 GCRI Canada leads the public-good Nexus Consortium as Lead Institution, Consortium Secretariat and lead contracting organization. GRF and GRA retain independent institutional mandates as consortium stewards. Technology, infrastructure and service providers act at arm's length and have no control over institutional governance, research, publications, national priorities or customer, sovereign and community data.
• 1.5 The Nexus Reports sites appear under the addresses of several institutions. GCRI Canada is the publisher of record and controller for every Nexus Reports site; the rest of each institution's site has its own publisher and its own notice.

Please do not send health, security-sensitive or other special-category information, or personal information about other people, in a first message. The pages of the Site have no user accounts and ask for no password; a feature that needs an account has its own notice. The Site does not use personal information for advertising, profiling or automated decisions.

• 3.1 Personal information comes from you, when you write to the Site or contribute, and from your browser, when it requests a page. The Site does not buy personal information or combine it with data from other sources.

• 4.1 Where Canadian law applies, personal information is collected with your knowledge and consent for the purposes stated when it is collected, and is used only for those purposes unless you agree otherwise or the law permits or requires it.
• 4.2 You choose what to send. A contribution can be credited by name, with an ORCID iD if you wish, and no account is needed. You may withdraw consent at any time; the consequences, such as an enquiry that can no longer be answered, are explained when you do.

• 5.1 GCRI Canada does not sell personal information or share it for advertising.
• 5.2 Providers that host the Site and its mailboxes process personal information on GCRI Canada's instructions under contract, for no purpose of their own. The providers and their locations are given on request to contact@therisk.global.
• 5.3 Services that maps and tools call from your browser, such as satellite imagery and open data services, receive your IP address and browser details directly from your browser and handle them under their own terms. They are listed in the Cookie Policy.
• 5.4 Personal information is otherwise disclosed only where the law requires it, or to protect the rights, safety or security of people or the Site.
• 5.5 A contribution accepted for publication becomes public with the credit you chose. Material you send is never published with your contact details.

• 6.1 Personal information may be processed outside the country where you live, including in Canada, the United States and the other countries in which the publisher's providers operate.
• 6.2 Where the GDPR, the UK GDPR or the Swiss Act applies, a transfer to a country without an adequacy decision uses a safeguard the law recognises, such as standard contractual clauses. Information processed in another country is subject to its laws, including lawful access by its authorities.

• 7.1 Personal information is kept only as long as needed for the purpose for which it was collected and as the law requires, then deleted or anonymised.
• 7.2 Server and security logs are kept for a short operational period and longer only while a security incident is investigated. Correspondence is kept for as long as needed to answer it and to keep an accurate record of the exchange, and then deleted or anonymised. Records of rights requests, complaints and legal notices are kept for the period in which a claim could arise.
• 7.3 Published contributions and the credit attached to them stay on the public record, because open publication is permanent; a correction or a withdrawal notice is added where needed.

• 8.1 GCRI Canada applies administrative, technical and physical safeguards appropriate to the sensitivity of the information: encrypted connections, restricted access to the systems that publish the Site, and processors bound by contract. No system is free of risk.
• 8.2 Where a breach creates a real risk of significant harm, or a risk to rights and freedoms, affected people and the competent authorities are notified as the applicable law requires, and the breach is recorded.

Send a request to contact@therisk.global and say which request you are making. Your identity may be verified before a request is acted on, and you are told of any legal reason a request cannot be met. The acknowledgement gives a reference and names the next step.

• 10.1 Please raise a concern with the publisher first, at contact@therisk.global; it will answer in writing and say what it has done.
• 10.2 You may always complain to a data protection authority. You may complain to the Office of the Privacy Commissioner of Canada where PIPEDA applies, and the provincial privacy authority where substantially similar provincial law applies (the Commission d’accès à l’information du Québec, and the Information and Privacy Commissioners of Alberta and British Columbia). Residents of the European Union and the United Kingdom may complain to the authority where they live or work, and residents of other places to the authority that applies the law there.

• 11.1 The Site is not directed to children under 16 and does not knowingly collect their personal information. Information found to have been sent by a child is deleted. A parent or guardian who believes a child has written to the Site may ask for its deletion at contact@therisk.global.

• 12.1 The Site does not track you across other sites, so a Do Not Track signal changes nothing about how it operates. A Global Privacy Control signal is treated as described above.
• 12.2 Cookies and browser storage are explained in the Cookie Policy.
• 12.3 Changes to this Policy are published on this page with a new version and effective date.

• GatewayGW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
• ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Nexus Reports community. Curators review it there; the DOI stays yours.
• Nexus ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.