Privacy Policy

2. Who This Policy Applies To

This Privacy Policy applies to personal data we process about:

• website visitors;
• authors and submitting contributors;
• peer reviewers;
• editors, Review Board members, advisors, and contributors;
• newsletter subscribers;
• people who contact us or communicate with us;
• individuals whose personal data appears in submitted research materials; and
• any other person who interacts with The Hinksey Review.

3. What Information We Collect

The personal data we collect depends on how you interact with The Hinksey Review.

3.1 Website and Contact Information

When you visit our website, contact us, or sign up for updates, we may collect:

• name;
• email address;
• message contents;
• newsletter preferences;
• communication history;
• technical information, such as IP address, browser type, device type, operating system, pages visited, referring pages, and approximate location derived from technical data; and
• cookie and tracking data, as described in the Cookies and Tracking Technologies section below.

3.2 Author and Submission Information

When you submit work to The Hinksey Review, we may collect:

• author name;
• email address;
• age, date of birth, or confirmation of eligibility;
• student status or researcher category;
• school, university, employer, organisation, or other affiliation;
• city, country, and general location information;
• LinkedIn URL or other professional/profile link you choose to provide;
• short biography;
• paper title;
• abstract;
• keywords;
• area of publication;
• manuscript files, including PDF and DOCX versions where applicable;
• tables, figures, appendices, datasets, references, citations, and supporting materials;
• AI usage disclosures;
• conflicts of interest disclosures;
• prior publication, republication, preprint, competition, repository, or simultaneous submission disclosures;
• author contribution information;
• consent confirmations, including parent or guardian consent where applicable;
• editorial correspondence; and
• any other information you provide as part of the submission, revision, or publication process.

3.3 Parent or Guardian Information

If an author or contributor is under 18, we may collect limited parent or guardian information, such as:

• parent or guardian name;
• parent or guardian email address;
• confirmation of consent;
• consent records; and
• related communications.

We use this information to verify that appropriate consent has been obtained and to comply with legal, safeguarding, and administrative requirements.

3.4 Peer Review and Editorial Information

If you participate in peer review, editorial review, or Review Board activities, we may collect:

• reviewer or editor name;
• email address;
• affiliation;
• area of expertise or publication area;
• review assignments;
• reviewer comments;
• editorial notes;
• conflicts of interest;
• decision records;
• revision history;
• communications with authors, reviewers, editors, and administrators; and
• records needed to maintain the integrity and confidentiality of the review process.

3.5 Published Author Information

If your work is accepted for publication, we may publish certain information as part of the public scholarly record, including:

• author name;
• affiliation;
• city, country, or general location, where provided for publication;
• short biography;
• profile photograph or headshot, if provided and approved for publication;
• article title;
• abstract;
• keywords;
• publication area;
• issue information;
• article text;
• citation information;
• author acknowledgements; and
• related publication metadata.

Published information may remain publicly available as part of the Review's archive, scholarly record, citation record, and open-access publication model, unless an author asks us to remove the publication and we agree, or removal is required by law or our editorial policies.

3.6 Payment Information

The Hinksey Review does not currently charge submission fees or publication fees.

If fees are introduced in the future, we may collect limited billing and transaction information, such as payer name, billing email, billing address, payment status, invoice information, transaction identifiers, and records needed for accounting and compliance.

Payments may be processed through third-party payment providers. We do not intend to store full payment card numbers or sensitive payment credentials on our own systems.

4. How We Collect Information

We may collect personal data directly from you when you:

• visit our website;
• complete a submission form;
• upload a manuscript or supporting file;
• provide author, reviewer, or editor information;
• participate in peer review;
• subscribe to a newsletter or mailing list;
• respond to a call for papers;
• contact us by email or through a website form;
• provide consent or parent/guardian consent; or
• interact with our content, forms, emails, or platforms.

We may also collect personal data through third-party tools and service providers used to operate the Review, including website forms, hosting providers, email platforms, analytics tools, plagiarism or AI screening tools, payment processors, document management tools, and publication or workflow platforms.

In some cases, we may receive information from co-authors, reviewers, editors, institutions, publicly available sources, or third-party platforms where relevant to submission, review, publication, integrity checks, or communication.

Where a work has more than one author, the submitting author provides their co-authors' names, email addresses, institutions, locations, and biographies. The submitting author confirms that every listed author has approved the submission and the details given for them.

5. Why We Use Your Information

We use personal data for the following purposes:

• to operate and maintain The Hinksey Review;
• to receive, process, screen, and manage submissions;
• to assess author eligibility;
• to verify parent or guardian consent where required;
• to conduct plagiarism, citation, AI-use, and academic integrity checks;
• to anonymise manuscripts for double-blind review;
• to assign reviewers and manage peer review;
• to carry out editorial review and make publication decisions;
• to request revisions, clarifications, source materials, disclosures, or supporting information;
• to publish accepted articles and maintain the Review's archive;
• to produce issue pages, author pages, article pages, metadata, citations, and publication records;
• to communicate with authors, reviewers, editors, subscribers, and website users;
• to send operational messages, such as submission confirmations, review updates, editorial decisions, publication notices, policy updates, and administrative emails;
• to send newsletters, calls for papers, issue announcements, Hinksey Review updates, and related Hinksey Labs opportunities where permitted;
• to promote published work, author achievements, issue launches, and Review activities;
• to improve our website, submission process, editorial workflow, and user experience;
• to analyse website traffic and engagement;
• to protect the security, integrity, confidentiality, and reputation of the Review;
• to enforce our Terms of Use, Research Principles, Peer Review Guidelines, Copyright Policy, and other policies;
• to respond to enquiries, complaints, rights requests, or legal requests;
• to process payments if fees are introduced in the future;
• to comply with legal, regulatory, tax, accounting, and record-keeping obligations; and
• to protect our rights, the rights of authors and reviewers, and the integrity of the scholarly record.

6. Legal Bases for Processing

Where UK GDPR, EU GDPR, or similar laws apply, we rely on one or more of the following legal bases:

6.1 Contractual Necessity

We process personal data where necessary to provide services you request or to take steps before entering into a relationship with you. This includes receiving submissions, managing the review process, communicating with authors and reviewers, administering publication, and operating the Review under our Terms of Use.

6.2 Legitimate Interests

We process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. These interests include operating an academic publication, maintaining editorial standards, conducting integrity checks, protecting the review process, communicating with contributors, promoting published work, improving our website and services, and protecting the Review from misuse, legal risk, or reputational harm.

6.3 Consent

We rely on consent where required, including for certain marketing communications, non-essential cookies, optional profile photographs or headshots, certain uses of personal information for publicity, and parent or guardian consent where applicable.

You may withdraw consent at any time where processing is based on consent. Withdrawal of consent does not affect processing that took place before consent was withdrawn, or processing that continues on another lawful basis.

6.4 Legal Obligations

We process personal data where necessary to comply with legal, regulatory, tax, accounting, data protection, safeguarding, or other obligations.

6.5 Public Interest, Research, or Archival Purposes

Where applicable, certain processing may relate to academic, research, publication, archival, or public-interest purposes, including maintaining the integrity and continuity of the published scholarly record.

7. Children and Under-18 Contributors

The Hinksey Review accepts submissions from upper secondary school students, which means some contributors may be under 18.

If you are under 18, you must have the consent of a parent or legal guardian to submit work, participate in peer review, provide personal information, and agree to our Terms of Use and related policies.

Where a listed co-author is under 18, the submitting author confirms that the co-author's parent or legal guardian has given permission for their information to be submitted, for their participation in review and publication, and for the communications described in section 14.

We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from someone under 13 without appropriate lawful basis or consent, we will take reasonable steps to delete it.

Parents or guardians may contact us at team@hinksey.review to ask questions, review information, or request deletion of their child's personal data, subject to legal, editorial, archival, and publication-integrity considerations.

8. Published Information and the Scholarly Record

The Hinksey Review is an open-access academic publication. If your work is accepted and published, certain personal information connected to the article may become publicly available.

This may include your name, affiliation, city, country or general location, biography, article title, abstract, keywords, issue information, citation information, and related publication metadata.

Published articles and associated metadata may be indexed by search engines, archived, cited, downloaded, copied, shared, adapted, or redistributed by third parties in accordance with applicable copyright terms, including Creative Commons licensing where applicable.

Because publication forms part of the scholarly record, we may retain and continue displaying published articles and related publication metadata even if you later ask us to delete other personal data. However, you may ask us to remove a publication, and we will consider such requests in accordance with applicable law, our Terms of Use, our Copyright Policy, our correction and retraction policies, and the integrity of the scholarly record.

9. Who We Share Information With

We do not sell personal information.

We may share personal data with the following categories of recipients where necessary and appropriate:

9.1 Authorised Hinksey Labs Personnel

Because The Hinksey Review is a publication of Hinksey Labs, Ltd., personal data may be accessed by authorised Hinksey Labs staff, contractors, administrators, and representatives who support the Review.

9.2 Editors, Reviewers, and Review Board Members

We may share submissions, anonymised manuscripts, author metadata, reviewer comments, editorial notes, and related information with editors, peer reviewers, Review Board members, advisors, and contributors involved in the review and publication process.

Where we operate double-blind review, we aim to limit identifying information shared with peer reviewers. However, no anonymisation process can be guaranteed to prevent identification in every case, particularly where manuscripts contain distinctive topics, datasets, writing styles, references, or self-citations.

9.3 Service Providers

We may share data with trusted service providers who help us operate the Review, including providers of:

• website hosting;
• submission forms;
• workflow and document management;
• email and newsletter tools;
• analytics and cookie management;
• plagiarism, AI-use, citation, or integrity screening;
• cloud storage;
• publication platforms;
• security tools;
• customer support and communications;
• payment processing, if fees are introduced; and
• accounting, legal, or compliance support.

These providers may process personal data on our behalf and are expected to protect it and use it only for authorised purposes.

9.4 Publication, Indexing, and Archival Services

If work is accepted for publication, we may share article files, author metadata, abstracts, citation information, DOIs or other identifiers, and related publication information with indexing services, archives, repositories, search engines, databases, libraries, metadata providers, and other platforms that support discovery, preservation, citation, or distribution.

9.5 Legal, Safety, and Compliance Reasons

We may share information where required or permitted by law, including with regulators, courts, law enforcement, professional advisors, or other parties where necessary to comply with legal obligations, enforce our rights, protect safety, investigate misconduct, respond to claims, or protect the integrity and security of the Review.

9.6 Business Transfers

If Hinksey Labs, Ltd. or The Hinksey Review is involved in a merger, acquisition, restructuring, partnership, transfer, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards where required.

10. International Data Transfers

The Hinksey Review is operated by Hinksey Labs, Ltd. in the United Kingdom, but our contributors, website users, editors, reviewers, service providers, and systems may be located in different countries.

Your personal data may be stored or processed in the United Kingdom, the European Economic Area, the United States, or other countries where we, our personnel, or our service providers operate.

Where required by applicable law, we use appropriate safeguards for international transfers, such as adequacy decisions, Standard Contractual Clauses, contractual commitments, technical safeguards, access controls, encryption, or other lawful transfer mechanisms.

11. How Long We Keep Information

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including editorial, publication, archival, legal, integrity, administrative, accounting, security, and communication purposes.

Retention periods may vary depending on the type of information and context. For example:

• rejected submissions may be retained for a reasonable period to manage editorial records, prevent duplicate submissions, handle enquiries, maintain integrity records, and improve the review process;
• accepted and published articles, author metadata, publication records, and citation information may be retained indefinitely as part of the scholarly record;
• peer review records, editorial notes, decision records, and revision histories may be retained to maintain accountability, confidentiality, and publication integrity;
• newsletter subscription data may be retained until you unsubscribe or ask us to delete it, subject to suppression records needed to respect your opt-out;
• parent or guardian consent records may be retained where needed to demonstrate consent and comply with legal or safeguarding obligations;
• payment and accounting records, if fees are introduced, may be retained as required by tax, accounting, and legal obligations; and
• technical, analytics, and cookie data may be retained according to the settings of the relevant tools and our cookie practices.

You may request deletion of your personal data, but we may retain certain information where necessary for legal, editorial, archival, publication-integrity, dispute-resolution, security, or legitimate business purposes.

12. How We Protect Information

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include access controls, password protection, encryption where appropriate, secure cloud storage, limited access permissions, staff or contractor confidentiality obligations, security monitoring, and review of our data handling practices.

No website, platform, email system, or digital storage method is completely secure. We cannot guarantee absolute security. If a data breach occurs and notification is required, we will notify affected individuals and relevant authorities in accordance with applicable law.

13. Cookies and Tracking Technologies

We may use cookies and similar technologies on The Hinksey Review website.

Cookies are small files placed on your device when you visit a website. They help websites function, remember preferences, understand usage, improve performance, and, where enabled, support analytics or marketing.

13.1 Types of Cookies We May Use

We may use:

• strictly necessary cookies, which are required for the website to function;
• performance or analytics cookies, which help us understand how visitors use the website;
• functional cookies, which remember preferences and improve user experience; and
• targeting or advertising cookies, which may support marketing, retargeting, or measurement where enabled and where legally permitted.

13.2 Analytics and Advertising Tools

We load these tools through Google Tag Manager, which decides which tags run and applies your cookie choices to them. Google Tag Manager does not itself set cookies or collect personal information. The tags it manages may include Google Analytics, Google Ads, Meta Pixel, and Reddit Pixel, and may collect information about website visits, pages viewed, links clicked, referring sources, device information, and other usage data.

Whether these tags are active before you choose depends on your region, which we determine from your IP address. For visitors in the United States they are active by default and you may switch them off at any time. For visitors elsewhere they stay off until you accept them. Strictly necessary and security cookies are always active, and are not affected by your choice.

13.3 Managing Cookies

You can manage cookies through your browser settings and, where available, through the "Manage Cookies" option or cookie banner on our website. Your choice covers three groups separately — preferences, analytics, and marketing — and takes effect immediately.

We remember your choice in your browser's local storage on the device you made it on, and we store a short-lived cookie recording the country your visit came from so the banner can apply the correct regional default. Clearing your browsing data for this site erases your choice, and the banner will ask again.

Some browsers allow users to send a "Do Not Track" signal. Because there is no consistent legal or technical standard for responding to such signals, our website may not respond to them in a uniform way.

If you disable certain cookies, parts of the website may not work properly.

14. Marketing and Communications

We may send operational communications related to submissions, peer review, editorial decisions, publication, policy updates, account administration, or other services you have requested. These messages are not marketing and may be necessary to operate the Review.

Where permitted, we may also send newsletters, calls for papers, issue announcements, publication updates, event invitations, or information about related Hinksey Labs opportunities.

Where a work has more than one author, the submitting author confirms this consent on behalf of all listed authors when submitting. Any author may withdraw it at any time, independently of the others and without affecting their submission or its review, using the unsubscribe link in any such email or by contacting us at team@hinksey.review.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or contacting us at team@hinksey.review. We may retain limited suppression records to ensure we do not send you marketing communications after you opt out.

15. Your Rights

Depending on where you are located and which laws apply, you may have rights over your personal data, including the right to:

• access personal data we hold about you;
• request a copy of your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• request data portability where applicable; and
• lodge a complaint with a data protection authority.

These rights may be subject to legal limits, exemptions, identity verification, and competing obligations. For example, we may not be able to delete certain information where it is needed for legal compliance, editorial integrity, archival purposes, publication records, dispute resolution, security, or protection of rights.

To exercise your rights, contact us at team@hinksey.review. We may ask you to verify your identity before responding.

16. California, Virginia, and Other US Privacy Rights

If you are located in a jurisdiction with specific privacy rights, such as California, Virginia, Colorado, Connecticut, Utah, or other US states with applicable privacy laws, you may have additional rights regarding access, deletion, correction, portability, opt-out of certain processing, and information about data sharing.

We do not sell personal information. If we use advertising or analytics technologies that are considered "sharing", "targeted advertising", or similar under applicable law, you may have the right to opt out through our cookie tools or by contacting us.

17. Third-Party Websites and Services

The Hinksey Review website, articles, submission forms, emails, or publications may link to third-party websites, tools, databases, articles, organisations, repositories, payment providers, social media platforms, or services.

We are not responsible for the privacy practices, content, policies, security, or availability of third-party websites or services. You should review their privacy policies before providing information to them.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, publication model, or operations.

When we update this Privacy Policy, we will post the revised version on our website and update the "Last Updated" date. Where required by law or where changes are significant, we may provide additional notice.

Your continued use of The Hinksey Review after an updated Privacy Policy is posted means that you acknowledge the updated policy.

19. Contact Us

If you have questions about this Privacy Policy or how we handle personal data, please contact us at: team@hinksey.review.

If you are located in the United Kingdom and are not satisfied with how we handle your concern, you may contact the UK Information Commissioner's Office. If you are located in the European Economic Area, you may also have the right to contact your local data protection supervisory authority.