Privacy Statement

This Privacy Statement explains how personal data are processed in connection with the submission and evaluation of manuscripts, the publication of articles, correspondence with the editorial office, and the use of the journal's website. It applies to the personal data of authors, reviewers, editorial staff and other individuals who communicate with the journal. Processing is governed by applicable data protection legislation, in particular the General Data Protection Regulation (GDPR).

Categories of Personal Data, Purposes of Processing and Legal Bases

For the purposes of managing the editorial process, the personal data processed include, in particular, names and surnames, institutional affiliations, contact details, areas of expertise, ORCID identifiers where provided, and information contained in manuscripts, author declarations, peer-review reports and related correspondence. Data are obtained primarily from the individuals concerned, although the corresponding author may also provide information about co-authors. When identifying and inviting reviewers, the journal may use professional information made publicly available in publications, institutional profiles and comparable professional sources. Where personal data have not been obtained directly from the individual concerned, the data controller will inform that individual of the processing and the source of the data within one month at the latest, or at the time of the first communication if contact occurs earlier, unless the GDPR provides otherwise in the circumstances concerned.

Manuscript administration, the organisation of peer review, the assessment of conflicts of interest and the handling of specific publication-related concerns are based on the legitimate interest in the proper operation of a scholarly journal and in maintaining the integrity and reliability of published research, pursuant to Article 6(1)(f) GDPR. Processing must remain necessary and proportionate to these purposes and must not unduly interfere with the rights of the individuals concerned. Personal data necessary for agreed publication arrangements and the performance of a licensing agreement are processed on the basis of contractual necessity under Article 6(1)(b) GDPR. Article 6(1)(c) GDPR applies when handling requests under the GDPR or complying with another specific legal obligation. Where a particular processing activity requires consent, consent will be sought separately for that purpose. Neither the submission of a manuscript nor a visit to the website constitutes blanket consent to all forms of processing. Consent to the licensing of an article is distinct from consent to the processing of personal data.

Author Information and Institutional Affiliations

Published articles include the authors' names, institutional affiliations, ORCID identifiers where provided, relevant author declarations, and the corresponding author's email address designated for publication. Published author information identifies authorship, institutional affiliation and responsibility for the published work. Together with bibliographic metadata, such information may be collected and reproduced by search engines, repositories and bibliographic services. Publication does not extend to internal correspondence, non-public contact information, peer-review documentation or review reports. Reviewers' identities are protected in accordance with the journal's double-anonymised peer-review policy. Information required to verify authorship and conduct editorial correspondence is necessary for the assessment and publication of a manuscript; without it, the editorial process may not be completed. Optional information must not influence the scholarly assessment of an article.

Access to non-public information is restricted to individuals who need it for a specific editorial or technical task. In addition to authorised editorial staff, these may include providers of hosting, email and editorial services, technical support, or other services actually used in manuscript processing. Reviewers receive an anonymised manuscript and the supporting materials necessary for scholarly evaluation. Where a service provider acts as a personal data processor, its activities must be governed by an appropriate contractual arrangement. Contact details are neither sold nor disclosed for unrelated advertising purposes. Where necessary, information may be disclosed to competent authorities or relevant institutions in order to comply with a legal obligation or investigate a specific allegation of misconduct, in each case only to an appropriate extent and on a valid legal basis.

Data Retention and Security

Published articles and the information necessary for their identification, attribution and citation are retained over the long term to preserve access to, and the continuity of, the scholarly record. However, long-term retention of publications does not justify indefinite retention of all non-public correspondence or other personal data. Appropriate retention periods are established for internal records, contact databases and technical logs; once those periods have expired, the data are deleted or genuinely anonymised. Where a specific dispute, investigation or legal obligation is ongoing, necessary data may be retained for the period required to resolve the matter, rather than automatically retaining all related records without distinction.

Access to non-public materials is restricted according to assigned responsibilities, and authorised individuals are bound by confidentiality obligations. Technical and organisational safeguards must be appropriate to the nature of the data and the risks associated with their processing. Authors should not submit identifiable research records, signed participant consent forms or other sensitive materials through routine editorial correspondence or as public supplementary files unless they are necessary for a specific, justified assessment. Any transfer of such materials must be agreed with the editorial office in advance and secured appropriately. Decisions on the acceptance or rejection of manuscripts, or on the handling of ethical concerns, are made by a responsible editor and not solely by an automated system.

Rights of Data Subjects

Subject to the conditions laid down in the GDPR, individuals may request access to their personal data, rectification, erasure or restriction of processing. Where processing is based on legitimate interests, individuals may object on grounds relating to their particular situation; the data controller will assess the objection and communicate the outcome. The right to data portability applies, under the relevant conditions, to automated processing based on consent or a contract. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal. Requests concerning personal data contained in published articles are assessed individually, taking into account applicable statutory exceptions to the right to erasure, in particular those relating to freedom of expression and information. The fact that an article has been published does not, in itself, preclude substantive consideration of a request.

Requests should be sent to the data controller's designated data protection contact. The controller will respond without undue delay and no later than one month after receiving the request. Where necessary due to the complexity or number of requests, this period may be extended by a further two months under the conditions prescribed by law; the individual will be informed of the extension and the reasons for it within the initial one-month period. Where there are reasonable doubts, the controller may take proportionate steps to verify the requester's identity. Individuals also have the right to lodge a complaint with the competent supervisory authority, particularly in the country of their habitual residence, place of work or the alleged infringement. In the Czech Republic, this authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).