Last updated: July 2026

This notice explains what personal data Quorum Press collects, how and why we use it, where it is stored, how long we keep it, how it can be deleted, and the rights you have. It is written to be clear for institutions and their data-protection officers, and to support compliance with laws such as the EU/UK GDPR, Kenya’s Data Protection Act 2019, Nigeria’s NDPA 2023, South Africa’s POPIA, and comparable regimes.

Our roles: who controls your data

Data protection turns on who decides how data is used. We are clear about our two roles:

• You are the controller of your conference or journal. When an institution or community runs a conference, journal, or call on Quorum Press, that organization decides how the personal data of its authors, reviewers, and participants is used. Quorum Press acts as a processor on its behalf, handling that data only to run the service and only on its instructions. A written data processing agreement (DPA) is available on request.
• We are the controller of your account. For the account you create with us (your name, email, sign-in, and the platform-wide profile), and for keeping the service secure, Quorum Press is the controller.

Information we collect

• Account and profile details you provide: name, email, affiliation, ORCID, and optional expertise or biography.
• Content you create or submit: manuscripts, abstracts, figures, reviews, decisions, messages, and, for conferences, participant and attendance records.
• Operational data needed to run the service securely: log, session, and device information, and audit records of key actions (who did what, and when).
• Device type, when you are signed in: whether it is a phone, tablet or computer, its operating system and browser family, whether you use the installed app, and whether alerts are on. We use it, only as totals, to decide what to improve. We do not record your browser’s full details or your location for this.

We do not seek special-category data (such as health or religion), and you should not submit it unless a conference or journal specifically requires it and has a lawful basis.

Why we use it (lawful bases)

We use personal data to operate authoring, peer review, publishing, and conference tools; to notify you about activity that concerns you; to keep the service secure; and to provide support. Depending on the activity, our lawful bases are performance of a contract (running the service you signed up for), legitimate interests (security, preventing abuse, and improving the service), consent (where we ask for it, such as optional communications), and, for the published scholarly record, the public interest in scholarship and archiving.

How we share it

We do not sell personal data and we do not use it for advertising. We share it only as needed to run the service:

• with the editors and reviewers involved in your submission (peer review can be blinded so identities are withheld where the conference or journal requires it);
• with a small set of sub-processors that operate parts of the service under contract and appropriate safeguards, and only for that purpose; and
• where we are required to by law.

Where your data is hosted, and international transfers

Your account data and manuscripts are hosted on dedicated servers in the European Union, which maintains a strong data-protection regime. A small number of vetted sub-processors help run specific parts of the service, such as email delivery and media storage, under contract and appropriate safeguards. We share the current list of sub-processors with institutions on request, for example as part of a data processing agreement.

If you are located outside the EU, using Quorum Press involves a cross-border transfer of your data to the EU. Under laws such as Kenya’s DPA, Nigeria’s NDPA, and POPIA, we rely on your informed agreement to this transfer and on the protection the EU affords; where your institution needs additional transfer safeguards, we will put them in place under our DPA.

How long we keep it (retention)

• Active accounts and publications: for as long as they are in use.
• Unsubmitted drafts in the free community: removed after a retention window (about a year) if never submitted.
• Free trials that never activate a plan: a new self-created organization that does not activate a plan is locked after a short grace period and then deleted after a further window. Activating a plan, or publishing any work, stops this clock for good. We notify the organization’s admins before anything is removed.
• Published scholarly records are intended to be permanent so they remain citable (see below).

Deletion and removal

You are in control, with one important, standard exception for the scholarly record:

• Your account: you can ask us to delete your account and personal profile at any time.
• Your organization and its data: an institution can have its organization, its unpublished submissions, reviews, participant records, and other data removed. This is destructive and permanent.
• Published papers are the exception. Once a paper is published open access, it becomes part of the permanent scholarly record and is not deleted on request, because doing so would break citations and the integrity of the record. This mirrors how the right to erasure works for scholarly and archiving purposes under the GDPR and similar laws. Where a published work must be withdrawn, it is retracted (marked and kept for the record with a reason), not erased. Genuine errors in author names or affiliations can be corrected.

To exercise any of these, contact us; we will verify the request and act on it promptly.

Your rights

Subject to the exception for the published record above, you can: access the personal data we hold about you; correct it; request its deletion; export your content; object to or restrict certain processing; and withdraw consent where processing is based on it. You also have the right to complain to your data-protection authority, for example the Office of the Data Protection Commissioner (Kenya), the Nigeria Data Protection Commission, the Information Regulator (South Africa), or your national authority.

Security

We protect data in transit with TLS, restrict access on a need-to-use basis, keep audit records of sensitive actions, and take regular backups. No system is perfectly secure, so we also encourage a strong, unique password. If a breach ever affects your personal data, we will notify the relevant parties and authorities as required by law and without undue delay.

Children

The service is intended for researchers and professionals and is not directed at children.

Changes

We may update this notice and will revise the date above when we do. Material changes will be communicated where we can.

Contact and data processing agreements

For any privacy question, to exercise a right, or to request a data processing agreement for your institution, contact us.