This privacy notice concerns the "Open Research Europe publishing platform", referred to as "ORE" in the following.
This privacy notice explains how ORE uses the personal data that is collected from you when you use our website (either as a registered user or as a viewer). In particular, it explains the reason for the processing, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you may exercise in relation to your data (the right to access, rectify, block etc.).
ORE hosted and operated at CERN (the Data Controller or DC). The ORE platform is subject to CERN's special legal status as an Intergovernmental Organization (IGO) and thus enjoys certain privileges and immunities under international law. Processing of personal data at CERN is governed by CERN's Operational Circular 11 (OC11) that offers data protection at the same high standards and is comparable to EU's General Data Protection Regulation (GDPR).
If you have any questions about ORE's privacy notice, please don't hesitate to contact us.
How is your data used
Each service at CERN is responsible for compiling its own privacy notice regarding the data it processes.
This privacy notice is part of CERN's Layered Privacy Notice and details the processing that is unique to CERN. It does not address processing by other services on which this service may rely and which have their own privacy notice.
Which data do we collect and process?
The personal data we have, and how it's used:
| Category | Personal Data | Purpose | Basis | Source |
|---|---|---|---|---|
| User | Your account name and email address | To identify you as an ORE user; To provide you with the service; For technical support and troubleshooting; To communicate with you; To display publicly on ORE; To prevent spam and misuse of the ORE platform | Contract | Your input |
| User | Your full name | To identify you as an ORE user; Pre-filling your information in forms when logged in; To display publicly on ORE; To prevent spam and misuse of the ORE platform; For auto-completion of personal names in the record metadata | Contract | Your input or derived from your login provider (ORCID/MyAccessID/eduGAIN) |
| User | Your institutional affiliation and country | To verify your account; To generate summary statistics; To prevent spam and misuse of the ORE platform | Contract | Your input |
| User | Your private profile information (notification preferences, reviewing interests) | To allow the ORE platform to communicate with you and invite you as reviewer for articles | Contract | Your input |
| User | Your public profile information (profile picture, bio, homepage) | Improving your experience while using ORE; To allow others to identify and connect with you (providing this information is optional) | Consent | Your input |
| User | Your account status (e.g. blocked, verified, unverified) | To prevent spam and misuse of the ORE platform | Contract | ORE platform; Inferred from your institutional affiliation; Inferred by spam classifier |
| User | Your historic login information (last login timestamp and login count) | For account security and debugging; To generate summary statistics; To prevent spam and misuse of the ORE platform | Contract | Automatically recorded when you authenticate on ORE |
| User | Which records you have been granted access to | To allow you to access restricted content from other users | Contract | Access granted by another user to records they own |
| User | Your submitted peer reviews, approvals, and article comments | To allow you to provide peer-review for on other's research; To allow other users read the peer-review comments (incl. previous review rounds) | Contract | Your input |
| User | Your API keys | To allow you to programmatically access the REST API | Consent | Generated upon your request |
| Support | Your support requests (including name, affiliation and email address) | To provide you with the requested service; To manage the handling of your request; To investigate complaints | Legitimate interest of CERN | Your input |
| Linked Accounts | Your linked accounts (ORCID, MyAccessID, eduGAIN) | To allow you to use your institutional account to signup and authenticate with ORE; To generate summary statistics; To prevent spam and misuse of the ORE platform | Contract | From ORCID, MyAccessID or eduGAIN when you use them to sign up, authenticate or link your external account |
| Newsletter | Your subscription to our newsletters (email address) | To send you email newsletters about ORE | Consent | Your input |
| Logs | Your IP address, visited URLs on the ORE platform, actions performed on the ORE platform, any errors you experienced, and corresponding timestamp | To provide you with user support for website debugging, security auditing and to produce anonymous aggregated statistics; To prevent spam and misuse of the ORE platform | Legitimate interest of CERN | Automatically detected when you are browsing on ORE web sites |
| Research outputs | Your names, affiliations, persistent person identifiers (e.g. ORCID, ISNI or GND) and role as part of the record metadata, record files and references/citations | For the scientific justification of published records and cited/citing sources; To curate metadata of records | Legitimate interest of CERN | Your and other users input; Automatically through deduplication and enrichment of record metadata |
Description of legal basis for processing of Personal Data by ORE (explanation):
- Contract: To fulfill a contractual relationship with the individual, or in preparation for a contract with the individual
- Legal Obligation: To comply with a legal obligation of CERN.
- Consent: By having received and recorded consent from the individual.
- Legitimate interest of CERN: In the legitimate interests of CERN supporting the professional activities of the individual or their security and safety.
How long do we keep your data?
The personal data we store, for how long and why:
| Personal Data | Retention Period | Purpose |
|---|---|---|
| Data in category User | Lifetime of your ORE account | To provide you with the ORE service |
| Data in category Newsletter and Your email address | Until you unsubscribe or email address bounces twice, whatever comes first | To send you email newsletters about ORE |
| Data in category Linked accounts | Lifetime of your ORE account or if you disconnect the linked account or the link expires, whatever comes first | To allow you to use ORCID, MyAccessID, eduGAIN to signup, authenticate and facilitate integration with these services; To generate summary statistics; To prevent spam and misuse of ORE |
| Data in category Support | 7 years after the closure of your request | To provide you with the requested service; To manage the handling of your request; To investigate complaints and disputes that may arise after the closure of the request; To facilitate the handling of future similar cases |
| Data in category Logs | 13 months from date of action | To provide you with user support for website debugging, security auditing and to produce anonymous aggregated statistics; To prevent spam and misuse |
| Data in category Research outputs | Unlimited | For the scientific justification of published records and cited/citing sources; To curate metadata of records; For quality assurance, for instance to be able to recover your published record in case of technical issues. |
In special circumstances, the retention period may be temporarily extended, in accordance with the provisions of the operation circular governing data privacy.
Who has access to your data and to whom is it disclosed?
In addition to yourself, personal data collected by ORE is accessible by the following services, teams or individuals at CERN:
| Personal Data | Who | Purpose |
|---|---|---|
| All data above | ORE Service | To provide you with the ORE platform; For debugging, security auditing & incident investigation and response; To prevent spam and misuse; For technical support and troubleshooting; To establish anonymous reports and statistics |
| Data in categories User, Support, and Newsletter | Database on Demand Service | To store the data and to provide managed database service for ORE; For technical support and troubleshooting |
| Data in category Logs | OpenSearch Service, Web Application Hosting Service (PaaS) | To store the data; To provide managed search engine service for ORE; For technical support and troubleshooting |
| Data in categories User and Research Outputs | Web Application Hosting Service (PaaS), Ceph Service | To store and access the data (records) uploaded by users; For technical support and troubleshooting |
| Data in category Logs | Web Analytics Service | To provide managed web analytics infrastructure for ORE; For technical support and troubleshooting |
| Data in category Logs | Monitoring Service | To provide long-term storage of log data; For technical support and troubleshooting |
In addition, some data may be shared with entities or individuals outside the Organization:
| Personal Data | 3rd Parties | Purpose |
|---|---|---|
| Data in category Research outputs | PubMed (USA), OpenAIRE (Greece), Portico (USA), Zenodo (Switzerland) | For publishing and indexing other publishing venues (PubMed, OpenAIRE); For archiving and long-term preservation in other archive platforms (Portico, Zenodo) |
| Data in category Research outputs | Crossref (USA) | To register/update Digital Object Identifiers (DOIs) for records submitted by users |
| Data in category Research outputs | General public | For the scientific justification of published records and cited/citing sources; For attribution of the work in published records; For dissemination of research. All information that has been published by you, will be searchable and harvestable through ORE's website and APIs |
| Your full name, affiliation, email address, ORCID identifier | General public | To publicly display article author information on ORE |
| Data in category Research outputs | iThenticate (USA) | To perform automated plagiarism checks on user submitted records |
| Data in category Logs | Sentry (USA) | To provide managed error logging and aggregation service for ORE; For technical support and troubleshooting |
Automated decision making
What automated decision making or profiling is being done by ORE with your personal data:
| Personal Data | Automated decision making or Profiling | Purpose |
|---|---|---|
| Data in categories User and Linked accounts | When you create an account or change your email address, we match your email address domain against our database of institutional email domains to infer your institutional affiliation. We use the institutional affiliation to automatically set your account status to verified; When you submit a record we check the record with an automatic spam classifier which will inactivate your account and delete the record, if found to be spam with a high probability. We train the spam classifier with manually classified records as well as the data of the user who uploaded the given record. | To determine your account status (blocked, verified, or unverified); To prevent spam and misuse of the ORE platform; To monitor compliance with ORE policies; Used to automatically verify an account; Used to automatically flag an account for review by ORE service administrators; Used for training of automatic spam classifier for automatic detection and removal of spam records. You can object to all automatic decisions by contacting us on support. |
For more detailed information about personal data and privacy at CERN, please refer to the Data Privacy web site.
For questions regarding this privacy notice, please contact us.
For general questions regarding personal data and privacy at CERN, please contact the Office of Data Privacy.
To request to exercise data subject rights please fill and submit the following online form.
This privacy notice is subject to revision.
