Data Protection and Privacy Notice and Consent
What personal data Reports holds, why, for how long, who is responsible, and your rights to access, export and erasure.
- Version0.1.0
- StatusDraft pending owner and counsel review
- EffectiveOn adoption by the owner through nexus-governance
- Applies toall on all networks
- Text hash (sha256)e8837ba985749646…
- JurisdictionProposal: PIPEDA (federal), Quebec Law 25, and the GDPR where it applies; Canadian law as the base; Ontario governing law.
Reports · the Global Centre for Risk and Innovation (GCRI Canada), publisher of record
Draft. Not in force.
This document is a draft. It is not legal advice and it is not in force. It becomes required only when the owner adopts it by a recorded decision in nexus-governance. Until then nothing here blocks anyone’s work.
Who is responsible
GCRI Canada, publisher of record, is the organisation responsible for personal information in Reports. Privacy Officer: as named in the legal entity profile (a PIPEDA role, not a GDPR data protection officer). Contact: the contact form. Each network site runs on its own account database; GCRI Canada is the responsible organisation for all of them unless a network page says otherwise.
What we hold and why
| Data | Purpose | Basis (proposal) |
|---|---|---|
| Account: name, email, account access data | run your account | contract and consent |
| Submissions, reviews, decisions, declarations | run peer review, keep the editorial record | legitimate interest and contract |
| Acceptance records: document, version, hash, time, typed name, method | prove which text you accepted | legitimate interest, legal claims |
| Public record: author names, ORCID, affiliation, CRediT, reviewer names if signed | publish and credit work | consent and contract |
| Refusal and security logs: action, time, document ids | operate the gate and secure the service | legitimate interest |
We do not record your IP address or browser details in the acceptance ledger. We do not sell personal data. We do not use it for advertising.
Who sees it
Editors see what their role needs. Reviewers see the anonymised manuscript where the model is anonymous and see declared conflicts only as the process needs. The public sees what is published. Zenodo, ORCID and ROR receive public identifiers of consenting authors only. Service providers are listed in the legal register.
Retention (proposal, counsel to confirm)
- Account data: while the account is active, then removed on closure except what the rows below keep.
- Acceptance records: the account’s life plus 6 years, then anonymised. The record of document, version, hash and time can stay without any name.
- Review records: reviews of published work are kept in the public review log as the Peer Review Policy states. Reviews of work not published are kept 6 years, then deleted.
- Complaints and misconduct files: 7 years from closure.
- Refusal logs: 24 months.
Your rights
Where the law gives them: access, correction, withdrawal of consent, a copy in a structured, commonly used format, erasure, and a complaint to the regulator. In Canada: the Office of the Privacy Commissioner of Canada, and the Commission d’accès à l’information du Québec for Quebec. In the EU: your supervisory authority. Use the WordPress privacy tools on your profile or write to the Privacy Officer.
Export and erasure
Export includes your acceptance records as JSON and your receipts. Erasure removes your name and account link from acceptance records and from what is not part of the public record. The hash chain keeps document id, version, hash and time, so the ledger stays verifiable. Published works and the open review log are part of the scholarly record and are corrected under the Corrections, Retractions and Appeals Policy, not erased, except where the law requires otherwise. If a legal claim or duty needs a record, we keep it for that purpose only and tell you.
Transfers
Data may be processed in Canada and in other countries where our providers operate. Safeguards are listed in the legal register. Quebec: a privacy impact assessment applies before transfer outside Quebec. Counsel to confirm.
Children
Accounts are for people 16 and over. Counsel to confirm the age.
Record and consent
Your acceptance is recorded in the acceptance ledger. It is an acceptance record by your signed-in account, not a qualified electronic signature. Optional consents (for example listing your name as a reviewer) are separate and withdrawable at any time in the consent centre.
Governing law (proposal)
Canadian law as the base, with Quebec Law 25 and the GDPR where they apply. Ontario governing law. Counsel to confirm.
Other charters of Reports.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.
CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.