Privacy Statement

This Privacy Statement explains how this journal, published by Lembaga Mitra Solusi Teknologi Informasi (L-MSTI) (the “Publisher”), collects, uses, shares, retains, and protects personal data in connection with its website and scholarly publishing activities on the Open Journal Systems (OJS) platform. It applies to authors, reviewers, editors, registered users, and readers. The Publisher acts as the personal data controller for the processing activities described in this statement and is committed to protecting personal data in accordance with Law No. 27 of 2022 on Personal Data Protection of the Republic of Indonesia and other applicable data protection requirements, including the General Data Protection Regulation (GDPR) where applicable. This statement provides information about our privacy practices. Where consent is required, it will be requested separately through a clear affirmative action. Registration, manuscript submission, or continued use of the website does not, by itself, constitute consent to every processing activity. 1. Information We Collect Depending on the user's role, the journal's configuration, and the services requested, we may collect: Names, account usernames, and profile information voluntarily provided by users. Institutional affiliations, departments, countries, ORCID iDs, and researcher profile links. Email addresses and, where necessary, telephone numbers or correspondence addresses. Account authentication information, including securely hashed passwords. Manuscript files, supplementary materials, submission metadata, and editorial correspondence. Peer review reports, reviewer responses, and editorial decisions. Billing details and payment references where publication charges or optional services apply. Technical information, such as IP addresses, browser details, access logs, session identifiers, and usage statistics, where collected by the platform or its configured services. Users should avoid uploading unnecessary personal data or identifiable research participant information. Authors are responsible for ensuring that personal data included in submissions has been collected and shared lawfully. 2. How We Use Personal Data Personal data is processed for purposes connected with operating the journal, including: Creating and managing user accounts and authentication. Receiving and administering manuscript submissions. Conducting editorial assessment, integrity screening, and peer review. Sending submission acknowledgements, review invitations, editorial decisions, and production communications. Publishing articles and distributing scholarly metadata, including DOI registration where applicable. Administering publication fees and related records, where applicable. Maintaining website security, troubleshooting technical issues, and producing aggregated usage statistics. Addressing publication ethics concerns, complaints, corrections, and legal obligations. Personal data is not sold or traded. It is not shared with third parties for unrelated advertising or promotional purposes. Optional announcements or other non-essential communications are managed in accordance with applicable consent and opt-out requirements. 3. Legal Basis for Processing The applicable legal basis depends on the processing activity. Where permitted by applicable law, this may include: Consent, where required for optional processing activities. Performance of an agreement or steps requested before entering into an agreement, where applicable to publishing services. Compliance with legal obligations. Legitimate interests in administering scholarly publishing, protecting platform security, and maintaining research integrity, subject to appropriate consideration of users' rights and interests. 4. Public Information and Editorial Confidentiality Published articles and their associated metadata are intended to form part of the public scholarly record. Author names, affiliations, ORCID iDs, contribution statements, and designated correspondence details may therefore appear on article pages, published files, DOI records, and indexing or repository services. Non-public submission files, peer review reports, account details, and editorial communications are restricted to authorized persons and service providers where necessary for their assigned functions, subject to applicable confidentiality requirements. The journal applies the review model described in its About the Journal and peer review policies. Where anonymous review is used, reasonable steps are taken to conceal identities as required by that model. Authorized editors and administrators may access identifying information to manage the editorial process. 5. Data Security The Publisher applies appropriate technical and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and loss. These may include role-based access controls, secure connections, software maintenance, backups, and password hashing. No online system can guarantee absolute security. Users should protect their credentials and promptly report suspected unauthorized account access. 6. Data Retention Published articles, associated author information, and publication metadata are generally retained indefinitely to preserve the scholarly record. Account data, unpublished submissions, editorial correspondence, peer review records, technical logs, and financial records are retained only for as long as necessary for their respective purposes, taking account of the Publisher's documented retention practices, legal requirements, research integrity needs, and dispute resolution. Requests to delete account or other non-public personal data are assessed under applicable law. Deletion may be limited where retention is necessary to meet legal obligations or preserve legitimate publication and research integrity records. 7. Third-Party Services and Data Sharing Depending on the services actually used by the journal, relevant data may be shared with: Website hosting, technical support, backup, and email service providers. DOI registration and metadata services, such as Crossref. Similarity screening and research integrity service providers. Digital preservation services, repositories, and scholarly indexing or metadata harvesting services. Payment service providers, where publication charges or optional services apply. Competent authorities or relevant institutions where disclosure is legally required or otherwise lawfully justified. Sharing is limited to information necessary for the relevant purpose. Public article metadata may be redistributed by indexing and scholarly discovery services. Information about service providers used for non-public data processing may be requested through the journal's Contact Us page. 8. Cross-Border Data Transfers Hosting, publication, DOI registration, indexing, and preservation services may involve processing data outside Indonesia. Where applicable, the Publisher will assess relevant transfer requirements and implement the safeguards required by applicable law before transferring personal data. 9. Cookies and Usage Data The website uses essential cookies or similar technologies for authentication, session management, security, dan core platform functions. These identifiers may be associated with a user account or session. Depending on the website configuration, readership and download statistics may be generated from technical usage data. Non-essential analytics or third-party cookies, if enabled, are subject to appropriate notice and consent requirements under applicable law. Users may manage cookies through their browser settings. Disabling essential cookies may prevent login or other website functions from operating correctly. 10. Your Rights Subject to applicable law and relevant exceptions, users may request: Information about the processing of their personal data and access to that data. Correction of inaccurate or incomplete personal data. Deletion, restriction, or termination of processing where applicable. Withdrawal of consent for processing based on consent, without affecting the lawfulness of prior processing. Data portability or objection to processing where provided by applicable law. Requests may be submitted through the Contact Us page. We may request information reasonably necessary to verify the requester's identity. Requests will be handled within applicable legal timeframes. Users may also raise concerns with a competent data protection authority where available under applicable law. 11. Personal Data Breaches If a personal data breach occurs, the Publisher will investigate, take appropriate containment and remedial measures, and notify affected individuals and competent authorities where required, in accordance with applicable statutory timeframes and notification requirements. 12. Privacy Contact The personal data controller is Lembaga Mitra Solusi Teknologi Informasi (L-MSTI). Its correspondence details and the journal's designated contact are provided on the Contact Us page. Please identify your message as a Privacy or Personal Data Request so that it can be directed to the appropriate personnel. 13. Changes to This Statement This statement may be updated to reflect changes in services, legal requirements, or privacy practices. Material changes will be communicated appropriately. Where a change requires additional consent, that consent will be requested separately.