RQC privacy statement

This document is still being worked on. Expect improvements soon.

Data controller and data processor

The present privacy statement concerns the Review Quality Collector (RQC) service. RQC is itself not a legal entity.
The data controller and data processor (GDPR article 4) for RQC is Freie Universität Berlin.
See the imprint for contact information.

RQC data is stored in the Europen Union only. Data privacy is governed by the EU GDPR.

Definitions

The present document uses the following terms in the sense defined in the RQC glossary: Author, Conference, Editor, Grader, Grading, Journal, Manuscript Handling System, MHS, Organizer, Publisher, Publisherperson, Receipt, Receiptreceiver, Research Institution, Review, Review Case, Reviewer, RQGuardian, User, and Visitor.

Overall purposes of data collection and use

• The main purpose of RQC is providing Reviewers with Receipts that each certify the amount and quality of reviewing work the Reviewer has performed for a Journal or Conference in a certain year.
• Receipts are based on Gradings supplied by Graders, which RQC must manage.
• Reviewers can assign their Receipts to a Research Institution, which can then download tabular data about Receipts.
• RQC also informs the public about some aspects of reviewing activity.

What personal data does RQC collect and process? For what specific purposes?

For Graders (whether in the Editor, RQGuardian, Reviewer, Organizer, or Author role):
RQC stores your grading inputs according to the respective Review Quality Definition used, in order to be able to produce the Receipt for the Reviewer of the graded Review. It also stores your comments, if any, provided during the grading for providing it as direct feedback to the Reviewer.

For registered Users (i.e. Users that have an RQC account):
RQC stores identity information (name, ORCID, one or more email adresses) for various purposes: Connecting Review Cases and Gradings to your account, connecting Receipts to your account, sending notifications about the status of your review grading queue, sending notifications about your Receipts, allowing other RQC Users to refer to you so you can become a Publisherperson, RQGuardian, or Receiptreceiver.
RQC stores a password for authentication.
RQC stores to which Research Instituion you assigned which of your Receipts.
RQC stores additional profile information which you can control is user profile dialogs, such as subscription settings for several types of email information, public/private flags of your Receipts, etc.

For Reviewers at Journals:
With every Review case we receive from the Manuscript Handling System of a Journal for which you have reviewed and where you opted into using RQC, we collect your identity (name, email, ORCID), the text of your Review, reviewing timestamps, ditto for your co-reviewers, plus accompanying metadata such as submission title, authors, editors. See the API description for details.
The data are used to drive the review grading process for this submission, which is required to produce your Receipt.
If you opted out of using RQC, RQC will only receive a pseudonym of your identity, but neither your identity nor the text of your review.
The pseudonym is required so RQC can determine the overall number of reviewers at a journal in the given year.

For Reviewers at Conferences:
A similar set of data is retrieved by RQC from the Conference's Manuscript Handling System for all submissions to that one Conference at once.
Unless you opt out of using RQC, the data are used to drive the review grading process for your reviews at this Conference, which is required to produce your Receipt.

For corresponding Authors at journals:
With every Review case we receive from the Manuscript Handling System of a journal to which you have submitted, RQC receives and stores your identity (name, email, ORCID), so that it can request a review grading from you via email if the journal decides to include author grading in their grading scheme.

For Authors at conferences:
Your name and email are retrieved from the Conference's Manuscript Handling System, so that RQC can request a review grading from you via email if the Organizers decide to include author grading in their grading scheme.

For Editors:
With every Review Case RQC receives from the manuscript handling system of a journal in which you are mentioned as an editor, RQC stores your name, email, ORCID, and the editor level in which you participate in that Review Case. The data are used to invite you to RQC if you do not have an account yet or to add the Review Case to your grading queue if you do.

For RQGuardians:
RQC uses your RQGuardian status for assigning you the corresponding privileges and for sending you notifications about your Journal's overall grading status and the resulting Receipts. Your RQGuardian status (name, email) is shown publicly.

For Publisherpersons:
RQC uses your Publisherperson status for assigning you the corresponding privileges and for sending you notifications about your Journals' grading activities and the resulting Receipts. Your Publisherperson status (name, email) is shown publicly.

For Receiptcollectors:
RQC uses your Receiptcollector status for assigning you the corresponding privileges and for sending you notifications about available Receipts.

To which third parties may RQC transmit personal data?

• Unless required by law, users' personally identifiable information is not transmitted to third parties except as required for executing the RQC grading and receipt-handling processes, as follows:
• Review data are shown to the Graders of that Review.
• Receipt data is transfered to a Research Institution if a Reviewer assigns a Receipt to that Research Institution.
• Some User profile data is public if the User decides to make it public.

How long is the data stored?

• Receipts are stored indefinitely, because RQC is meant to serve as an archive of review quality information, so that a recipient of a Receipt can validate the authenticity of that Receipt.
• General User data that is part of an account is stored until a User deletes their account.
• Data about the execution of a grading process (as opposed to the Grading outcome that results from that process) is stored until the end of the year in which the resulting Receipt is issued, initially in order to manage the grading process, then in order to resolve possible questions regarding the correctness of the Receipt.
• Data regarding User roles is stored as long as the User has that role (for Publisherpersons, Receiptreceivers, RQGuardians) or until the corresponding grading process data is deleted to which the role pertains (for Authors, Editors, Organizers).
• Demo mode data is stored until the end of the year in which it was created.
• Any personal data may also appear in log files, which are used to ensure the proper working of the service and resolve problems with it. Log data will be deleted 100 days after its creation.

User rights

As per the EU GDPR, Users have the following additional rights:

• Rectification of incorrect personal data (article 16).
• Erasure (article 17) or restriction of processing (article 18). of personal data in certain cases. RQC shall notify prior recipients of erased or rectified data if possible (article 19).
• Receiving a copy of your personal data in machine-readable format (article 20).
• Objecting against the use of your personal data in certain cases (article 21).