Privacy Statement

This notice explains how personal data are processed in connection with the Physical Activity Review (PAR) website, accounts, manuscript submission, peer review, editorial work and publication.

1. Controller

The controller is PPHU Projack, Jacek Wąsik.

2. Contact

Privacy enquiries and requests may be sent to editor@physactiv.eu. The privacy contact person is Jacek Wąsik.

3. Data Protection Officer

The controller has not appointed a Data Protection Officer (DPO/IOD). Privacy enquiries should be directed to the contact above.

4. Scope of this notice

This notice applies to visitors, registered users, authors and co-authors, reviewers, editors and other persons whose data are processed through the PAR editorial and publication workflow. Open Journal Systems (OJS) is software used by PAR to operate that workflow; OJS itself is not described as a company or data processor.

5. Categories of personal data

Depending on the person's role and activity, PAR may process:

  • identity data, including first and last name;
  • contact data, including email address and editorial correspondence;
  • professional data, including affiliation and, if supplied, ORCID;
  • account and role data used to provide access to the journal service;
  • manuscript, authorship, declaration and publication metadata;
  • reviewer assignments, review reports, recommendations and reviewer files;
  • editorial decisions, workflow history and authorised internal notes;
  • optional data supplied voluntarily, such as telephone number or additional biographical information; and
  • technical and security data, such as IP address, request time, requested resource, browser/user-agent information, session identifiers and server/security logs.

6. Purposes of processing

PAR processes personal data to:

  • create and administer user accounts;
  • authenticate users and maintain secure sessions;
  • receive, assess, peer review, edit and manage manuscripts;
  • communicate with authors, reviewers and editors;
  • attribute authorship and maintain accurate scholarly metadata;
  • publish, disseminate, index and preserve the scholarly record;
  • protect the security, integrity and availability of the service; and
  • comply with applicable legal obligations and establish, exercise or defend legal claims where necessary.

7. Legal bases

The legal basis depends on the purpose:

  • Article 6(1)(b) GDPR applies where processing is necessary to provide a requested account or editorial service, to handle a submission, or to take steps requested by the user;
  • Article 6(1)(f) GDPR applies where processing is necessary for the controller's legitimate interests in operating the journal, organising scientific peer review, preserving publication quality, protecting the service and maintaining the integrity of the scholarly record;
  • Article 6(1)(c) GDPR applies only where a specific legal obligation requires processing; and
  • Article 6(1)(a) GDPR applies only to genuinely optional processing based on consent, if such processing is introduced or expressly offered.

Consent is not treated as a universal legal basis for account registration, manuscript submission, peer review or ordinary editorial correspondence. Where processing relies on legitimate interests, a person may object as described below; the controller will assess the objection under the GDPR.

8. Recipients and categories of recipients

Access is limited according to role and purpose. Recipients may include authorised PAR editors and staff, assigned reviewers, hosting/infrastructure providers, email/communication providers and necessary technical service providers. Published scholarly content and approved publication metadata are made available to the public and may be received by indexing, citation, preservation and metadata services.

The confirmed service environment includes SEOHOST as the hosting/infrastructure provider and Google/Gmail as an email/communication provider. Providers process data under their own applicable contractual and legal arrangements. Software used to operate the service is not itself classified as a legal recipient or processor.

9. International transfers

Some service providers may process personal data outside the European Economic Area. Where such a transfer occurs, it must use a mechanism permitted by Chapter V GDPR, such as an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism. This notice does not claim a particular mechanism, data-centre location or certification for a provider unless that arrangement has been separately verified.

10. Retention

PAR applies the following periods or criteria:

  • user accounts: for the active lifetime of the account and up to 2 years after inactivity, unless another documented legal or editorial reason requires longer retention;
  • rejected manuscripts: 5 years after completion of the editorial process;
  • peer-review documentation: 5 years after completion of the relevant editorial/review process;
  • editorial correspondence: 5 years after closure of the relevant matter;
  • published scholarly record: indefinitely where necessary to preserve its integrity, traceability and continuity; and
  • server and security logs: for the period necessary for security, technical diagnostics and incident response under the hosting/runtime configuration, after which they are deleted or overwritten unless an incident, claim or legal obligation requires longer retention.

Where records overlap, the longest applicable documented period or criterion may apply. Backups may retain data temporarily under the provider's rotation and recovery schedule.

11. Account data

Account data are used to provide and secure the requested OJS account and role-based functions. Account information is not automatically public. A person may request account closure, subject to retention that remains necessary for legal, editorial or scholarly-record purposes.

12. Author and co-author data

PAR processes author names, affiliations, email addresses, author order, ORCID where supplied, contribution/declaration information and manuscript metadata. The submitting author should provide co-author data only where authorised and should ensure that co-authors receive this notice.

13. Reviewer data

Reviewer identity and contact data, assignments, review responses, recommendations, files and correspondence are used to organise scientific peer review and preserve its audit trail. They are accessible only to authorised persons under the journal's review model and OJS permissions. Reviewer names, emails, reports and files are not intended for public Article View unless a separate journal policy and lawful process expressly provide otherwise.

14. Editorial correspondence

PAR may process emails, OJS notifications and messages concerning accounts, submissions, peer review, editorial decisions, revisions, production, security and support. Messages may contain names, contact details, manuscript identifiers and workflow information.

15. Public publication of author metadata

After publication, PAR intends to make public the author's first and last name, affiliation, ORCID if provided, and the corresponding-author email where applicable. Article and citation metadata are also public. Telephone numbers, private account emails of non-corresponding authors, internal notes, reviewer identity and other private profile information are not intended for publication.

Because scholarly publications form a persistent public record, erasure or alteration requests concerning published metadata may be limited where continued retention is necessary for accuracy, integrity, traceability, freedom of expression/information or other lawful grounds.

16. Cookies and technical data

The current site uses the first-party OJSSID identifier to maintain application/session continuity and security. The audited cookie is Secure, HttpOnly, SameSite=Lax and has Max-Age=604800 (7 days). Details are provided in Cookie Information.

PAR currently uses no analytics, advertising, marketing or profiling cookies. Technical request and security data may be recorded by the journal and hosting environment as described above.

17. Automated decision-making and profiling

PAR does not use automated decision-making or profiling that produces legal effects or similarly significantly affects users. Editorial and peer-review decisions are made through the journal's human editorial process.

18. Data-subject rights

Subject to the GDPR's conditions and exceptions, a person may request:

  • access to personal data;
  • rectification of inaccurate or incomplete data;
  • erasure;
  • restriction of processing;
  • objection where processing is based on Article 6(1)(f) GDPR;
  • data portability where applicable; and
  • withdrawal of consent at any time where processing is based on consent, without affecting processing already carried out lawfully.

These rights do not apply absolutely in every situation. Their exercise may be limited by legal obligations, the rights of others, freedom of expression and information, legal claims, or the integrity and continuity of the scholarly record. Requests should be sent to editor@physactiv.eu.

19. Complaint to the supervisory authority

A person who considers that personal data are processed contrary to the GDPR may lodge a complaint with the competent supervisory authority. In Poland this is the Prezes Urzędu Ochrony Danych Osobowych. Information about rights and complaints is available from the Polish supervisory authority.

20. Required and optional data

Data necessary to provide the requested account/editorial service may include first name, last name, email address, affiliation and information needed to handle the manuscript and editorial process. Optional data may include ORCID, telephone number, additional biographical information and other information not required for editorial processing. Optional fields should be identified as such at collection.

21. Consequences of not providing required data

If required data are not provided, PAR may be unable to create or administer the account, identify the contributor, communicate about the manuscript, conduct peer review or complete the editorial/publication process. Not providing optional data does not prevent use of the requested core service unless the information later becomes necessary for a clearly explained purpose.

22. Security and technical logs

PAR and its hosting provider use role-based access, secure transport and technical/security logging to operate, diagnose and protect the service. No online service can guarantee absolute security. Access to non-public editorial and reviewer data is limited by OJS roles and permissions.

23. Future changes

This notice may be updated when the service, providers, legal requirements or processing practices change. Material changes should be dated and communicated through the journal website or another appropriate channel.

Before PAR introduces analytics, marketing cookies, advertising tools, profiling or similar non-essential technologies, privacy, cookie and consent requirements must be reassessed. A consent-management mechanism may then become necessary.

Reference framework

This draft follows the transparency and lawful-processing framework in the General Data Protection Regulation and the terminal-storage framework in the ePrivacy Directive. It is a project privacy document, not a substitute for case-specific legal advice.