1. Controller and contact
Delvierre Publisher is the trading name used for this service. The operator is established in Romania and acts as controller for personal data processed through delvierre.com and the associated journal, submission, peer-review, editorial, account, payment-status, and support functions. Privacy and data-rights requests may be sent to support@delvierre.com. The legally required publisher/operator identity is also made publicly accessible on the website for transparency and serial-publication identification; private financial credentials and customer billing records are not public.
2. Data we process
- Account and identity data, such as name, email, affiliation, role, ORCID, biography, profile image, and email-verification status. When an authentication provider is permitted to return a verified email address, Delvierre may synchronize that verified address to the account while retaining a previous verified address privately as an account-history alias so earlier submissions remain attributable.
- Submission and publication data, including manuscripts, figures, supplementary files, author responses, metadata, licences, declarations, and correspondence.
- Peer-review and editorial data, including invitations, acceptance records, reviewer acknowledgements, reports, decisions, conflict information, and workflow history.
- Service, invoice-profile, and payment-status data, including service requests, customer type, invoice name/email, billing address, country, postcode, tax/VAT/registration ID where applicable, invoice language, agreed routes, invoice or coverage status, and limited transaction references. Payment-card or bank credentials are handled by the relevant payment provider and should not be uploaded to Delvierre.
- Technical and security data, such as session identifiers, timestamps, IP-derived security hashes, browser/request information, failed-login and rate-limit events, and audit records.
- Optional communications preferences for newsletters and non-essential announcements.
3. Purposes and legal bases
We process personal data to create and secure accounts; verify identities and email addresses; administer submissions, review, revision, decisions, production, publication, corrections, and the scholarly record; respond to requests; operate subscriptions or agreed services; prevent abuse; meet accounting, legal, and research-integrity obligations; and establish, exercise, or defend legal claims. Depending on the activity, the legal basis is performance of a contract or requested pre-contract steps, compliance with legal obligations, legitimate interests in operating a secure and trustworthy publishing service, or consent for optional communications and other specifically consent-based processing.
4. Who receives data
Data is available only to people and providers who need it for the relevant purpose. This may include authorised publisher personnel, assigned editors, invited reviewers, authors and co-authors, production or technical providers, Cloudflare hosting/storage services, email-delivery providers, authentication providers such as ORCID or Google when used, payment providers such as Wise when selected, and identifier, preservation, indexing, similarity-checking, legal, accounting, or integrity services when actually engaged. Reviewers receive only the files selected for review; confidential editor-only material is not intended for authors or reviewers.
5. International transfers
Some service providers may process data outside Romania or the European Economic Area. Where GDPR transfer rules apply, Delvierre relies on an adequacy decision, Standard Contractual Clauses, or another lawful safeguard, together with supplementary measures where appropriate. Provider locations and safeguards may change as services are configured.
6. Retention
Data is retained only as long as reasonably necessary for the relevant purpose, legal obligations, security, dispute handling, research integrity, and the continuity of the scholarly record. Sessions expire according to account settings; verification and reset tokens expire; short-term rate-limit records are deleted automatically; security audit records are periodically pruned; inactive or unverified accounts may be removed; rejected or withdrawn submission files may be retained for a limited integrity and claims period; and published article metadata, licences, corrections, and essential publication-history records may be retained permanently. Retention may be extended where litigation, investigation, law, or preservation obligations require it.
7. Optional emails and mandatory workflow messages
Newsletters and non-essential platform announcements are optional and may be disabled in Account settings or through the unsubscribe method provided. Security notices, verification messages, invitation responses, submission confirmations, editorial decisions, review communications, contractual notices, and other messages necessary to provide a requested service are operational communications and are not treated as marketing.
8. Cookies and browser storage
The platform uses strictly necessary cookies and browser storage for secure login, session continuity, role-based access, and saving in-progress forms. These functions are required to provide the service. Optional tracking or advertising technologies are not activated merely by this notice; if introduced, they will be disclosed and consent will be obtained where required.
9. Security
Delvierre uses role-based access, server-side authorisation, secure session cookies, password hashing, email verification, rate limiting, restricted file delivery, audit logging, security headers, encrypted Cloudflare transport/storage services, and operational controls intended to reduce risk. No internet service can guarantee absolute security. Users should use unique passwords, protect invitation and review links, and report suspected compromise promptly. Details for responsible vulnerability reporting are in the Security Policy.
10. Your rights
Subject to applicable law, you may request access, correction, erasure, restriction, portability, or objection and may withdraw consent where processing relies on consent. Some information cannot be erased where it is necessary for legal obligations, security, research-integrity investigations, defence of claims, or the permanent scholarly record. You may complain to the Romanian National Supervisory Authority for Personal Data Processing or another competent supervisory authority.
11. Automated decisions and children
Delvierre does not make solely automated decisions producing legal or similarly significant effects about manuscript acceptance or editorial appointments. The general account service is not directed to children under 16. Where a lawful educational or institutional workflow involves a younger person, appropriate authorisation and safeguards must be established before personal data is submitted.
12. Data incidents and changes
Suspected personal-data incidents are assessed, contained, documented, and notified to affected persons or authorities where applicable law requires it. This notice may be updated when processing, providers, or legal requirements change. Material changes will be communicated where appropriate.
Website feedback and bug reports
If you use the Delvierre feedback form, we process the feedback category, the message you submit, the Delvierre page path being reported, and any contact email you choose to provide. If you are signed in, the report may be associated internally with your account so we can investigate the issue. This information is used to operate, secure, troubleshoot, and improve the platform and to respond when contact details are provided. Do not submit passwords, review tokens, unpublished manuscript text, or unnecessary sensitive personal information through the feedback form.
13. Contact
Send privacy requests, security concerns, or questions to support@delvierre.com. Editorial confidentiality or research-integrity matters may also be sent to editorial@delvierre.com.