Governance & Compliance
Privacy Policy
This policy explains what personal data IORO Publications collects, why, how it is protected, and how you can exercise your rights.
Last updated: July 2026
Data controller
The data controller for personal information processed through this platform is IORO Publications, operated from Texas, United States. For privacy-related enquiries, contact us at support@ioro.org.
This policy applies to ioro.org and all journal sub-domains operated under the IORO Publications platform, including public pages, author and reviewer portals, submission and editorial workflows, and support communications.
Data we collect
Account and identity data
Names, email addresses, institutional affiliations, roles, profile information, and optional identifiers such as ORCID iD.
Submission and review data
Manuscripts, metadata, revision files, reviewer reports, editorial notes, correspondence, and workflow history.
Operational and security data
Login timestamps, audit trails, IP addresses, browser or device signals, and service integrity logs.
Payment data
For fee-bearing services, payment reference numbers processed via our payment provider. We do not store card numbers or full payment credentials.
Support and communication data
Messages submitted through platform forms, email correspondence, and notifications sent by the platform.
Analytics data
Aggregated, anonymised page-view and navigation data collected via Google Analytics 4 and Microsoft Clarity, only with your consent.
Legal basis for processing
For users in the EU, EEA, or UK, our processing relies on the following lawful bases under GDPR Article 6.
| Processing activity | Legal basis | Notes |
|---|---|---|
| Account creation and management | Contract (Art. 6(1)(b)) | Necessary to provide the service you registered for. |
| Submission and peer-review workflow | Contract (Art. 6(1)(b)) | Necessary to process and publish your manuscript. |
| Security logging and fraud prevention | Legitimate interests (Art. 6(1)(f)) | We have a legitimate interest in keeping the platform secure. |
| Support communications | Contract (Art. 6(1)(b)) | Necessary to respond to your requests. |
| Analytics and usage tracking | Consent (Art. 6(1)(a)) | Only collected after you accept analytics cookies via the consent banner. |
| Legal and compliance obligations | Legal obligation (Art. 6(1)(c)) | Where required by applicable law or regulatory authority. |
Third-party processors
We use the following sub-processors. Each operates under contractual data-processing terms and their own published privacy policies.
| Processor | Purpose | Location |
|---|---|---|
| Google LLC | Analytics (GA4), Tag Manager | USA (SCCs apply) |
| Microsoft Corporation | Session recording & heatmaps (Clarity) | USA (SCCs apply) |
| Zoho Corporation (ZeptoMail) | Transactional email delivery | USA / India |
| Razorpay Software Pvt. Ltd. | Payment processing | India |
| Oracle Corporation | Cloud hosting infrastructure | USA |
We do not sell your personal data to any third party.
Cookies & analytics
Essential cookies
Session cookies, CSRF tokens, and login-state cookies required for the platform to function. These are always active and cannot be disabled without breaking core functionality.
Analytics cookies
Google Analytics 4 and Microsoft Clarity collect aggregated, anonymised data about page views, navigation patterns, and session behaviour. These are only set after you give consent via the cookie banner. You can change your preference at any time via the Cookie Preferences link in the footer.
We implement Google Consent Mode v2. Before consent is given, GA4 sends only cookieless, aggregate pings with no personal identifiers.
Sharing & disclosure
- Editorial board members and peer reviewers may access submission data necessary to assess manuscripts under confidentiality obligations.
- Sub-processors listed above receive only the data they need to deliver their specific service.
- Published article metadata (author names, abstracts, DOIs) is transmitted to indexing services, DOI registries, and archiving platforms as part of open-access publication.
- We may disclose data where required by law, court order, or to protect the rights and safety of the platform and its users.
- We do not share personal data with advertisers, data brokers, or any party for commercial profiling purposes.
Retention & security
Published articles, peer-review records, and editorial correspondence are retained indefinitely for scholarly integrity and archival continuity. Account data is retained for as long as your account is active. Security and audit logs are retained for up to 12 months. Analytics data is governed by Google and Microsoft retention settings (default 14 months for GA4).
We apply encryption in transit (TLS), access controls, and server-side security hardening. Passwords are hashed and never stored in plaintext.
International transfers
IORO Publications is based in the United States. When personal data originating from the EU, EEA, or UK is transferred to processors in the US (Google, Microsoft, Oracle), those transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards.
For transfers to India (Razorpay, Zoho), we rely on contractual safeguards and proportionate access controls. We aim to ensure that all processors maintain data protection standards consistent with this policy regardless of jurisdiction.
Your rights
Access
Request a copy of the personal data we hold about you.
Correction
Request correction of inaccurate or incomplete information.
Deletion
Request deletion of your personal data where editorial and legal obligations permit.
Restriction
Request that we limit how we use your data in certain circumstances.
Objection
Object to processing based on legitimate interests.
Portability
Request your data in a structured, machine-readable format (where technically feasible).
Withdraw consent
Withdraw analytics consent at any time via the Cookie Preferences link in the footer.
Non-discrimination
Exercise any of the above rights without receiving inferior service or being penalised.
These rights apply regardless of your location. Residents of California, Virginia, Colorado, Texas, and other US states with applicable privacy laws (CCPA/CPRA and equivalents) are covered. We do not sell personal data.
EU and UK residents also have the right to lodge a complaint with their national data protection authority. UK residents may contact the Information Commissioner's Office (ICO). EU residents may contact their national supervisory authority.
To exercise any right, email support@ioro.org. We will respond within 30 days.
Contact
For questions about this policy, data access requests, or any privacy concern, contact us at support@ioro.org.
We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 days. For complex requests we may extend this by a further 30 days with notice.