Privacy notice

Version 2 1. Who we are 1.1. The "Digital Gateway to Saudi Cultural Journals" is operated by [name of the owning entity, its legal status, and its unified number], which is responsible for processing your personal data on the gateway. 1.2. This statement applies to all gateway sites: saudijournals.org and its subdomains, including the gateway, the unified search engine, the journal sites, and single sign-on. 1.3. We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations. 2. Data we collect 2.1. Account data: name, email address, username, preferred language, ORCID iD if you add it, and your two-factor authentication methods (we cannot see their codes). 2.2. Organization data: the organization's name, type, unified number, and address, the names of its representatives and signatories, and instruments of authority. 2.3. Service and contract data: requests, contracts and amendments, signatures with their time and document fingerprint, dues, and proofs of payment. 2.4. What you send us: contact messages, support requests, reports, and attached files. 2.5. Reviewer and author data: specialties, academic degree, affiliation, and anything you add to your profile. 2.6. Technical data and logs: IP address, browser type, sign-in times, and significant operations in the audit log. 2.7. Visit statistics: measured without cookies and without personal tracking, and shown only in aggregate. 3. Why we process it Purpose Legal basis Creating and securing your account and enabling single sign-on Providing the service you requested Registering organizations, providing services, and concluding and signing contracts Performance of a contract Keeping contracts, signatures, and the audit log Legal obligation Protecting the gateway against fraud and intrusion Legitimate interest Responding to your messages and reports Your request Improving the gateway using aggregate statistics Legitimate interest Anything beyond the above Your explicit consent, which you may withdraw [The legal bases are to be reviewed legally against the Personal Data Protection Law and its regulations.] 4. Who we share it with 4.1. We do not sell your personal data or use it for advertising. 4.2. We share only what is necessary with: The organization you act for: data on its requests and contracts. Journals: the approved reviewer details shown to them (specialties, languages, and availability), without your email or documents unless you agree. Service providers: our hosting provider and email delivery provider, under contracts that require them to protect the data. [Provider names and server locations.] Competent authorities: when legally required. 4.3. Transfers outside the Kingdom: [State here whether servers or service providers are outside the Kingdom, and the safeguards applied, in line with the Law's transfer provisions.] 5. Retention 5.1. We keep account data for as long as the account exists. 5.2. When an account is closed, we delete or anonymize your personal data within [period], except what must be retained by law. 5.3. Contracts, signatures, and the audit log are kept for [period] as official records. 5.4. Contact messages and reports are kept for [period] after they are closed. 6. Your rights Under the Personal Data Protection Law, you have the right to: be informed of how and why your data is processed; access your data and obtain a copy in a readable format; correct and update your data; request deletion of your data when it is no longer needed, subject to clause 5.3; withdraw your consent to processing based on consent. Submit your request from "My account" or to [data protection officer's email]; we respond within [period]. You may also file a complaint with the competent personal data protection authority in the Kingdom. 7. How we protect data Encrypted connections to all gateway sites. Mandatory two-factor authentication for all accounts. Privileges granted by scoped assignment, with every significant operation recorded in the audit log. Regular, encrypted backups. If a breach affects your data, we notify you and the competent authority as the Law requires. 8. Children The gateway is not directed at people under [age], and we do not knowingly collect their data. 9. Updates to this statement Each update is published with a new version number and effective date, and we notify you of material updates before they take effect. 10. Contact Data protection officer: info@saudijournals.org General email: info@saudijournals.org

For data subject requests (access, correction, deletion) and any privacy question: info@saudijournals.org

Privacy Statement — Saudi Cultural Journals