Privacy Policy
Introduction
Welcome to GULF LEGACY PUBLICATIONS (hereinafter referred to as “we,” “us,” or “our”). We are committed to protecting the privacy, confidentiality, and security of personal data collected from authors, reviewers, researchers, and visitors across the Middle East and worldwide.
This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal data in compliance with:
- UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data (UAE PDPL)
- Kingdom of Saudi Arabia Personal Data Protection Law (KSA PDPL) and its implementing regulations
- Applicable data protection laws in other Middle Eastern jurisdictions
- For users in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) additionally applies where relevant
Gulf Legacy Publications acts as the Data Controller for all personal data collected through our platforms, meaning we determine the purposes and means of processing your personal data.
1. Information We Collect
We collect personal data necessary to facilitate academic publishing, peer review, and platform operations:
a. Account & Profile Data
- Full name, academic title, institutional affiliation, contact email, phone number, ORCID ID, and account credentials (username and hashed password).
b. Manuscripts & Editorial Data
- Research papers, abstracts, submission metadata, co-author disclosures, referee nominations, conflict-of-interest declarations, and peer-review evaluations (including reviewer identity where applicable).
c. Transactional & Payment Data
- Billing names, addresses, institution purchase order details, and transaction history for Author Processing Charges (APCs) or subscription services.
- All financial transactions are handled via external, PCI-DSS compliant payment gateways; we do not store full credit card numbers, CVV codes, or bank account details.
d. Technical & Usage Information
- Web server logs, IP address, browser type and version, operating system, referring URLs, timestamps, and standard cookie data collected automatically to maintain platform security, improve user experience, and analyse aggregate trends.
2. How We Use Your Information
We process personal data for the following legitimate academic and administrative purposes:
a. Peer Review & Publication Workflows
- Managing manuscript submissions, organizing double-blind or single-blind peer reviews, communicating editorial decisions, facilitating revisions, and publishing accepted papers in the permanent scholarly record.
b. Indexing & Global Academic Reach
- Distributing metadata (author names, affiliations, abstracts, and ORCID IDs) to international scholarly databases and indexing services (e.g., Crossref, Scopus, PubMed, Web of Science) to ensure global discoverability, accurate citation tracking, and compliance with academic publishing standards.
c. Platform Communications
- Sending transactional status updates (e.g., submission acknowledgment, review completion, editorial decision), editorial announcements, call-for-papers invitations, and journal newsletters (which you may opt out of at any time via the “unsubscribe” link or by contacting us).
d. Legal & Regulatory Compliance
- Fulfilling reporting, auditing, financial recordkeeping, anti-fraud, and dispute resolution requirements under applicable regional and international laws.
e. Platform Improvement & Security
- Monitoring system performance, detecting and preventing security incidents, conducting analytics, and enhancing our platforms based on user behavior patterns (aggregated and anonymized where possible).
3. Legal Basis for Processing (For GDPR and Similar Frameworks)
Where required by applicable law, we rely on the following legal bases for processing your personal data:
| Processing Activity | Legal Basis |
|---|---|
| Submitting and reviewing manuscripts | Contractual necessity (to facilitate the peer-review and publication process) |
| Indexing metadata | Legitimate interest (to ensure global academic discoverability) |
| Platform communications | Legitimate interest / Consent (where required for marketing) |
| Payment processing | Contractual necessity and legal obligation |
| Security and fraud prevention | Legitimate interest and legal obligation |
| Cookies and analytics | Consent (for non-essential cookies) |
4. Public Availability of Author Information
Academic publishing relies on transparency and proper attribution. When an article is accepted and published, standard metadata (including author names, institutional affiliations, contact emails, and ORCID identifiers) will be made publicly available worldwide as part of the permanent scholarly record.
Please note: Once published, metadata is distributed to multiple indexing services and cannot be fully retracted from all third-party platforms. Any request for removal of published metadata will be assessed on a case-by-case basis but cannot be guaranteed due to the nature of academic archiving.
5. Third-Party Service Providers & Cross-Border Data Transfers
a. Service Providers (Data Processors)
We share data only with trusted vendors essential to our operations, under strict Data Processing Agreements (DPAs) that require them to protect your data to the same standard as Gulf Legacy Publications. These include:
- Cloud hosting infrastructure (e.g., AWS, Google Cloud, or regional data centers)
- Plagiarism detection systems (e.g., Turnitin, iThenticate)
- Secure payment processors (e.g., Stripe, PayPal)
- Email delivery and communication platforms
- Academic indexing and metadata distribution services
b. Cross-Border Transfers
Due to the global nature of academic indexing and cloud infrastructure, your data may be transferred to and stored on servers located outside your country of residence, including but not limited to the United States, the European Union, and Singapore.
We ensure appropriate technical safeguards and legal mechanisms are in place to comply with regional cross-border transfer laws, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Data localization measures where mandated by Middle Eastern regulations (e.g., KSA PDPL requirements for sensitive data)
You may request a copy of the safeguards we use for international transfers by contacting our Data Protection Officer.
6. Data Retention & Security
a. Retention Periods
- Account information, draft submissions, and operational records: Retained for as long as your account remains active or as required by applicable law (typically 5–10 years for financial and audit records).
- Published scholarly articles and their metadata: Form part of the permanent academic record and are archived indefinitely for scholarly integrity and citation purposes.
- Peer-review reports and editorial correspondence: Retained for a minimum of 5 years post-publication to defend against post-publication disputes or integrity investigations.
- Cookies and analytics data: Retained as per our cookie policy, typically up to 12 months.
b. Security Measures
We employ industry-standard technical and organizational measures to protect your information from unauthorized access, loss, or alteration, including:
- SSL/TLS encryption for all data in transit
- Role-based access controls limiting internal access to personal data
- Regular security audits and vulnerability assessments
- Data pseudonymization and anonymization where feasible
- Employee training on data protection and confidentiality
c. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify you and the relevant supervisory authority (e.g., UAE DPA, KSA SDAIA) within 72 hours of becoming aware of the breach, where mandated by law.
- Provide clear information about the nature of the breach, likely consequences, and mitigation measures taken.
7. Data Subject Rights (Your Privacy Rights)
Depending on your country of residence, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right to Access | Request a copy of the personal data we hold about you. |
| Right to Rectification | Request correction of inaccurate or incomplete profile details. |
| Right to Erasure (“Right to be Forgotten”) | Request deletion of non-published personal data (e.g., closing your account or removing unsubmitted draft manuscripts). Please note: Manuscripts already distributed to external reviewers during the active peer-review process may not be erasable from reviewers’ local systems. |
| Right to Restriction | Request restrictions on certain processing activities (e.g., while we verify data accuracy). |
| Right to Object | Object to processing based on legitimate interests or direct marketing. |
| Right to Data Portability | Request transfer of your data to another service provider in a structured, machine-readable format. |
| Right to Withdraw Consent | Withdraw consent at any time where we rely on your consent for processing (e.g., marketing communications). |
| Right to Lodge a Complaint | Lodge a complaint with your local data protection supervisory authority. |
How to Exercise Your Rights:
To submit a request, contact our Data Protection Officer (DPO) at info@gulflegacypublications.com or support@gulflegacypublications.com.
We will respond to all legitimate requests within 30 calendar days. We may request verification of your identity before processing your request.
8. Children’s Privacy
We do not knowingly collect personal data from individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). If you are a parent or guardian and believe we have inadvertently collected data from a minor, please contact us immediately for deletion.
9. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience, analyse platform usage, and support security.
- Essential Cookies: Required for platform functionality (e.g., login sessions, submission workflows).
- Performance/Analytics Cookies: Help us understand how users interact with our platform (e.g., Google Analytics).
- Functionality Cookies: Remember your preferences and settings.
10. Governing Law and Dispute Resolution
a. For Users Residing in the United Arab Emirates
This Privacy Policy shall be governed by and construed in accordance with the laws of the Emirate of Dubai and the United Arab Emirates, including:
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
- Federal Law No. 5 of 1985 (UAE Civil Transactions Law)
- Federal Law No. 11 of 1992 (UAE Civil Procedure Law)
Any dispute shall be subject to the exclusive jurisdiction of the Dubai International Financial Centre (DIFC) Courts.
b. For Users Residing in the Kingdom of Saudi Arabia
Governed by the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (Royal Decree No. M/19 of 1443H / 2021) and regulations issued by SDAIA. Disputes are subject to the exclusive jurisdiction of the competent courts of Riyadh.
c. For Users Residing in Qatar, Oman, Bahrain, Kuwait, and Jordan
Governed by respective national personal data protection laws and civil codes of each country, with disputes submitted to their competent national courts.
d. For Users Residing in the European Union / United Kingdom
Governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) or UK GDPR.
11. Changes to This Privacy Policy
We reserve the right to modify this Privacy Policy periodically. Revisions will be published on this page with an updated “Effective Date.” Significant changes will be communicated via email or a prominent notice on our website at least 30 days before taking effect.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, please
contact us:
Gulf Legacy Publications
Email: info@gulflegacypublications.com | support@gulflegacypublications.com
Phone: +441665529344
WhatsApp: +44 7961 339473
Website: https://gulflegacypublications.com