1. WHO ARE WE?
1.1 The controller
The following information is communicated to you so that you know the commitments regarding the protection of personal data made by Cybium, an academic journal belonging to Société Française d’Ichtyologie (1901 Association), who acts as the controller for the processing of personal data referred to in this document.
1.2 Our Data Protection Officer
Cybium has designated a Data Protection Officer whose contact details are as follows: Romain causse, firstname.lastname@example.org
2. WHAT PERSONAL DATA DO WE PROCESS?
In the context of processing of personal data, Cybium collects and processes the following data:
- For authors: name, surname, institutional address, email address, IDs;
- For reviewers: name, surname, institutional address, email address, IDs;
- For members: name, surname, institutional address, email address, IDs.
3. WHAT ARE THE PURPOSES AND LEGAL BASES OF OUR DATA PROCESSING?
3.1 The purposes of our data processing
We are processing data for the following purposes:
- The publication of the articles;
- The creation of a database for its authors, reviewers and website users;
- The implementation of the article review process;
- The production of statistics;
- The transmission of the metadata to libraries;
3.2 The legal bases of our data processing
We implement data processing only if at least one of the following conditions is met:
- your consent to the processing operations has been obtained;
- the existence of our legitimate interest, or that of a third party, which justifies that we implement this processing of personal data;
- the execution of a contract binding us to you requires that we implement this processing of personal data;
- we are subject to statutory and regulatory obligations which require this processing of personal data.
3.3 The legitimate interests pursued
The legitimate interests pursued by Cybium may consist in particular of:
- Peer-review of papers
4. WHO ARE THE RECIPIENTS OF YOUR DATA?
The personal data we collect, and those we obtained subsequently, are intended for us in our capacity as controller.
We ensure that only authorised persons have access to this data. Our service providers can be recipients of this data to perform the services we entrust to them. Some personal data may be sent to third parties or to legally authorised authorities in order to meet our legal, regulatory or contractual obligations.
5. DO WE TRANSFER YOUR DATA?
We do not transfer your personal data to partners.
6. HOW LONG ARE WE KEEPING YOUR DATA?
The periods for which we keep your personal data are proportionate to the purposes for which your data were collected. Our data storage policy is organized as follows:
- For data concerning authors: as long as the article is published;
- For data concerning reviewers: as long as necessary: due to potential scientific fraud cases, the data might be saved for 25 years after the publication or rejection of a paper.
7. WHAT ARE YOUR RIGHTS?
7.1 Your right of information
In addition to this information and with the aim of ensuring fair and transparent processing of your data, you further acknowledge that you have received additional information concerning:
- the period for which your personal data will be kept;
If we decide to process data for purposes other than those indicated, all information relating to those new purposes will be communicated to you.
7.2 Your right of access to and rectification of your data
You have the right to access and rectify your personal data, which you can exercise with Romain Causse at the following address: email@example.com
In this respect, you have the confirmation as to whether or not your personal data are being processed and where this is the case, access to your data and the following information:
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipient as well as the international organisations to whom the personal data have been or will be disclosed, in particular recipients in third countries;
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the personal data are not collected from the data subjects, any available information as to their source;
- the existence of automated decision-making, including profiling, and in this case, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You can ask us to, as the case may be, rectify or complete your personal data that are inaccurate, incomplete, equivocal or expired.
7.3 Your right to erasure of your data
You can ask us to erase your personal data where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you withdraw the consent you have previously given;
- you object to the processing of your personal data and there is no legal reason for such processing;
- the processing of personal data does not comply with the provisions of the applicable legislation and regulations;
- your personal data have been collected in relation to the offer of information society services to children under 16 years of age.
Nevertheless, the exercise of this right will not be possible when the retention of your personal data is necessary for compliance with statutory or regulatory provisions and in particular for example for the establishment, exercise or defence of legal claims.
7.4 Your right to restriction of processing
You may request restriction of processing of your personal data in the cases provided for by law and regulation.
7.5 Your right to object to data processing
You have the right to object to the processing of personal data concerning you when the processing is based on the legitimate interest of the controller.
7.6 Your right to data portability
From 25 May 2018, you will have the right to portability of your personal data.
The data on which this right can be exercised are:
- only your personal data, which excludes anonymized personal data or data that does not concern you;
- declarative personal data and personal data relating to our functioning, as mentioned above;
- personal data which do not adversely affect the rights and freedoms of others such as those protected by trade secrets.
This right is limited to processing based on consent or contract as well as to personal data that you have personally generated.
This right does not include derived or inferred data, which are personal data created by the European Journal of Taxonomy.
7.7 Your right to withdraw your consent
When the data processing we carry out is based on your consent, you may withdraw it at any time. We will then stop processing your personal data but this will have no impact on the previous transactions to which you have consented.
7.8 Your right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with the French data protection authority (the CNIL) on the French territory without prejudice to any administrative or judicial remedy.
7.9 Your right to define post-mortem directives
You can give instructions in relation to the storage, erasure and communication of your personal data after your death to a certified trusted third party in charge of enforcing the wishes of the deceased in compliance with the applicable legal framework.
7.10 How to exercise your rights?
All the rights enumerated above can be exercised by sending a request, together with a copy of an ID document, to Romain Causse [by email to the following e-mail address firstname.lastname@example.org | or by mail to the following address [SFI – 43 rue Cuvier – CP 26 – 75231 Paris cedex 05, France].
Regarding the exercise of your right of information, we are not required to provide you with information where:
- you already possess the information;
- the recording or disclosure of your personal data is expressly laid down by law;
- the provision of information to you proves to be impossible;
- the provision of information to you would involve a disproportionate effort.