I. General Provisions

1. This Privacy Policy applies to the personal data of users of the University of Opole Journals Platform, operating at https://czasopisma.uni.opole.pl, hereinafter referred to as the “Platform.”
2. The controller of personal data is the University of Opole, with its registered office in Opole, at pl. Kopernika 11A, 45-040 Opole, hereinafter referred to as the “Controller.”
3. The Controller has appointed a Data Protection Officer overseeing the lawfulness of personal data processing, who can be contacted by email at iod@uni.opole.pl, via the form available at http://iod.uni.opole.pl/kontakt/, or in writing at the address indicated in item 2.
4. Personal data will be processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, on the basis of Article 6(1)(a), (b) and (c), the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2018, item 1000), as well as generally applicable requirements.

II. Purpose, scope and duration of personal data processing

1. Personal data of Platform users will be processed to the extent necessary for the efficient functioning of the scientific electronic journals platform, in particular for the following specific purposes:
   1. efficient communication in the editorial process;
   2. editing of content;
   3. creation of internal reports and analyses (including statistics on subpage traffic and readership of publications);
   4. sending, with users’ consent, notifications and information regarding the journal;
   5. possible fees for access to publications;
   6. informing readers about the authorship of texts published on the Platform;
   7. indexing published texts and data in databases, catalogues and services, in accordance with the journals’ publishing policy;
   8. for scientific and statistical purposes throughout the period during which electronic versions of the journal are made available.
2. Users registered on the Platform may provide the Controller with the following data:

• First name*
• Middle name
• Surname*
• Login
• Gender
• Password (encrypted)
• Email*
• ORCID iD
• Website
• Country
• Telephone
• Fax
• Affiliation
• Biography
• Registration date
• Last login date
• Location
• Research interests
• Function (role) on the Platform

Persons registering as readers are required to provide the following data:

• First name
• Surname
• Email
• Login
• Password
• Function (role) on the Platform

3. Persons registering as authors, in addition to the data specified in point II.2, are required to provide information regarding their affiliation and country of origin.
4. If the Platform enables the sale of electronic versions of publications, persons wishing to use this service may provide the Controller with additional data concerning the selected payment channel and bank account number.

III. General rules for personal data processing

1. The provision of personal data is:
   1. voluntary in the case of using open-access journal content deposited on the Platform;
   2. a necessary condition if one wishes to participate in the electronic publishing process, including:
      • depositing texts for publication as an author,
      • performing tasks connected with the following functions: editor, section editor, technical editor, reviewer, DTP specialist, indexer, proofreader, journal manager, subscription manager, marketing manager,
      • creating a reader account in order to receive information from the publisher and editorial offices about newly published issues and articles.
2. Personal data of prospective authors whose texts have not been accepted for publication may be deleted by the administrator two years after the editorial decision not to publish.
3. Personal data of users registered as readers may be deleted by the Controller at any time upon the user’s prior request.

IV. Users’ rights

1. Every user registered on the Platform has the right to access their data, the right to receive a copy of their data provided this does not infringe the rights of other persons and subject to legal provisions (including those set out in Articles 15–21 GDPR), the right to rectification, the right to erasure, restriction of processing, the right to data portability, and the right to object.
2. If a user identifies any irregularities in the processing of personal data, they have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
3. A user may exercise the right of access and the right to rectification by editing their account and changing the data previously provided, except for the system login. From within the application, the user may withdraw consent to receive information from the publisher and editorial offices of journals hosted on the Platform at any time.
4. Exercising the rights specified in point IV.1 takes place upon prior notification to the Controller or via the Data Protection Officer.

V. Controller’s rights

1. The Controller reserves the right to process users’ data after consent has been withdrawn solely for the purposes of establishing, exercising or defending potential legal claims before a court, or where national, EU or international law obliges the Controller to retain the data.
2. The Controller has the right to disclose users’ personal data to entities or authorities authorised under the law.
3. The Controller may use the services of other processors on the basis of a data processing agreement or another legal instrument in accordance with the rules and conditions laid down in Article 28 GDPR.
4. Data may also be transferred to:
   1. processors in connection with contracted Platform administration and technical support services;
   2. publishers of analytical systems: Google Analytics, AddThis;
   3. publishers of indexing databases and catalogues:
      • SCOPUS
      • Pol-index
      • WorldCat
      • Google Scholar
      • CEJSH
      • Crossref Metadata Search

VI. Personal data security

1. Every connection to https://czasopisma.uni.opole.pl is encrypted using SSL keys.
2. Users’ passwords in the database are stored in hashed form.
3. Access to the database is limited to specific IP addresses and requires a username and password.
4. Administrative access is granted only to trusted system administrators.
5. The server is protected by a local firewall.
6. Application data are subject to periodic backups covering files and the database, in accordance with the backup schedule.

VII. Cookies

1. The Platform uses cookies that serve to identify visitors’ browsers. Based on the information collected, the Controller seeks to learn how frequently the Platform is visited and to identify its most interesting elements. The data obtained will enable the Controller to better tailor the Platform to users’ needs, improve its functioning, and for statistical purposes. These files cannot be used to infect a device with viruses or other malicious software.