Privacy Policy

Controller and scope

The data controller is Curvio Cheerdck Publications Ltd, a company registered in England and Wales under number 13847221, whose registered office is at 14 Ashworth Lane, Cambridge CB2 1TN, United Kingdom ("the Company"). This policy applies to personal data processed through the website at curviocheerdck.com and through correspondence addressed to the Company by email or through the contact form. It does not apply to third-party websites reached by following external links, including the journals, preprint servers and institutional pages cited in the References of each section.

Data collected

Data provided directly

When the contact form is submitted, the Company receives the name, email address, subject and message entered by the sender, together with the time of submission. When email is sent to a Company address, the Company receives the sender's address and the content of the message.

Data collected automatically

The hosting provider records server logs containing the IP address, user agent string, requested URL, referrer and timestamp of each request. Where analytics consent has been given, an anonymised page-view record is created that contains the page path, referrer, approximate country derived from the IP address, and screen size class. The IP address is not stored in analytics records.

Cookies and local storage

The site uses a single essential item of browser local storage to record the visitor's cookie choice, together with optional analytics and functional cookies that are set only after consent. The names, purposes and durations of each item, and instructions for disabling them, are set out in the Cookie Policy. Consent may be withdrawn at any time through the "Cookie preferences" control in the footer of every page.

Purposes and legal bases

• Responding to correspondence: processing is necessary for the Company's legitimate interest in answering enquiries (UK GDPR Article 6(1)(f)).
• Maintaining security and preventing abuse of the service through server logs: legitimate interest (Article 6(1)(f)).
• Analytics: consent (Article 6(1)(a)), which may be withdrawn at any time.
• Compliance with legal obligations, including responses to lawful requests from public authorities (Article 6(1)(c)).

The Company does not sell personal data, does not use personal data for automated decision-making, and does not use it for advertising.

Third-party processors

Each processor is bound by a written data processing agreement that meets the requirements of UK GDPR Article 28.

International transfers

Where personal data is transferred outside the United Kingdom or the European Economic Area, the Company relies on the United Kingdom's adequacy regulations, the International Data Transfer Agreement, or the European Commission's Standard Contractual Clauses as applicable. Copies of the relevant transfer mechanism may be requested from the data protection contact.

Retention

• Contact-form submissions and email correspondence: 24 months from the last exchange, then deleted unless required for an ongoing legal matter.
• Server logs: 30 days, then deleted automatically.
• Anonymised analytics aggregates: retained indefinitely, as they contain no personal data.
• Cookie consent record: 12 months in the visitor's own browser; the Company holds no copy.

Rights under GDPR and CCPA

Individuals in the United Kingdom and European Economic Area have the right to access, rectify and erase their personal data; to restrict or object to processing; to data portability; to withdraw consent; and to lodge a complaint with a supervisory authority, which in the United Kingdom is the Information Commissioner's Office (ico.org.uk). Residents of California have the right under the California Consumer Privacy Act to know what personal information is collected, to request its deletion, to opt out of any sale or sharing of personal information (the Company conducts none), and to non-discrimination for exercising those rights. Requests may be made to the data protection contact below and will be answered within one month, extendable by two further months for complex requests, with notice.

Security

The site is served exclusively over TLS. Access to correspondence is restricted to editorial staff using hardware-backed multi-factor authentication. The Company maintains a breach response procedure and will notify the Information Commissioner's Office within 72 hours of becoming aware of a reportable breach, and affected individuals where the breach is likely to result in a high risk to their rights.

Children

The site is not directed at children under 16 and the Company does not knowingly collect personal data from them. Where such data is identified it is deleted.

Changes to this policy

Material changes will be indicated by a revised effective date at the head of this page. The previous version is available on request.

Data protection contact

Data Protection Officer, Curvio Cheerdck Publications Ltd, 14 Ashworth Lane, Cambridge CB2 1TN, United Kingdom. Email: [email protected]. General correspondence: [email protected].