1. Scope and responsibility

This statement covers registration, manuscript submission and consideration, peer review, editorial work, correspondence, requests and website use. It applies to both electronic and paper records associated with the journal’s activities.

The responsible organisation is the Research Institute of Criminology of the Republic of Uzbekistan, the journal’s founder and publisher. The institute organises processing through its editorial office and authorised personnel, determines the necessary data and fulfils the obligations of the owner and/or operator of the relevant databases within its functions.

Engaged technical providers receive only necessary access on an established basis and within their assigned task. Their authority, confidentiality, protection, onward disclosure and cessation of processing must be governed by appropriate arrangements. Technical access does not authorise unrelated uses of data for a provider’s own purposes or interference with editorial decisions.

Research participants’ data are additionally protected under the Ethical Requirements for Research Involving Human Participants and the Informed Consent Policy. Submission does not authorise the transfer of state secrets, restricted case records or other restricted information without a permissible basis. The journal’s research subject does not itself create a right to make such a transfer.

2. Personal data collected

Depending on the task, the following may be processed:

• first and last names and other necessary name information;
• email address, telephone number and other contact details provided;
• institution, department, position, country, degree and academic title;
• expertise, research interests and biographical information relevant to the task;
• ORCID and other scholarly profile identifiers provided;
• username, account information and access records;
• manuscripts, supplementary files, metadata and co-author details;
• reviews, editorial decisions, invitations and correspondence;
• statements on authorship, contributions, funding, conflicts of interest, ethics, data and AI use;
• necessary payment, invoice and accounting information, where applicable;
• information concerning requests, complaints, appeals and assessments of possible misconduct.

Data may come from the person concerned, the corresponding author, other authorised participants in the process, and permissible public scholarly sources when identifying experts or checking attribution. When receiving data from another person, the editorial office checks the permissibility of their use and provides the information required by law. The corresponding author must ensure that co-author details are accurate and that the necessary grounds for providing them exist.

Required and optional information is distinguished at collection. Without minimum contact and identification details, creating an account, considering a manuscript or assigning a review may be impossible; declining optional information must not prevent the core service.

Passwords, full payment card details, identity documents, criminal conviction information, health or private life details and other sensitive material should not be sent without necessity and an agreed procedure. If special, biometric or other protected data are genuinely necessary, the lawful basis, required form of consent and safeguards are established separately. Special personal data are subject to the law’s specific conditions, including written consent or consent in the form of an electronic document where processing relies on consent.

3. Automatically collected technical data

Depending on the actual website and platform settings, records may include:

• IP address and technical connection details;
• browser, device type and operating system;
• requested pages and main system actions;
• date, time and referral source;
• selected language and approximate regional information, if determined;
• session, error, authentication and security event records.

Such data are used only as necessary for website operation, access protection, diagnostics and permissible statistics. Precise location must not be collected without a separate need, information provision and an appropriate basis. Calling information “technical data” does not remove the need for protection if a person can be identified.

The actual information collected must correspond to enabled functions. Aggregated statistics are not automatically anonymous: the possibility of linking them to a particular user must be excluded.

4. Purposes of processing

Data may be used for:

• registration, account management and access recovery;
• manuscript submission, initial checks and scholarly editorial assessment;
• selecting experts and organising double-anonymous peer review;
• communicating with authors, reviewers, editors and people making requests;
• editing, preparing, publishing and disseminating accepted material;
• scholarly attribution, metadata preparation and DOI registration where the relevant service is used;
• transferring published material and necessary metadata to the indexing and preservation systems used;
• checking originality, references, images, technical requirements and the accuracy of editorial records;
• handling conflicts of interest, complaints, appeals and ethics matters;
• maintaining security, resolving errors and improving platform operation;
• accounting and meeting applicable legal, contractual and institutional obligations.

Optional mailing lists and notifications beyond necessary manuscript or account correspondence are arranged separately on an appropriate basis, with an option to decline. Article submission does not imply consent to unrelated advertising.

A new processing purpose must meet applicable requirements; where the purpose changes, necessary consent is obtained and the person’s information is updated before the relevant use begins.

5. Grounds for processing

The institute identifies a specific applicable basis for each operation. Depending on the circumstances, this may include:

• the person’s consent, receipt of which can be demonstrated, subject to specific requirements concerning its form;
• necessity for performing a contract with that person or taking steps at their request before entering into a contract;
• compliance with an obligation expressly established by law;
• protection of the person’s or another person’s lawful interests in cases provided for by law;
• exercising the rights and lawful interests of the institute or a third party, or pursuing a socially significant purpose, while respecting the data subject’s rights and lawful interests;
• other cases expressly provided for by law, including use of permissible publicly available sources and research processing with mandatory anonymisation where the corresponding conditions apply.

“Scholarly communication”, administrative convenience, the presence of a manuscript in the system or archival value does not itself provide unlimited permission to process data. An applicable basis, a necessary volume of data and compliance with the restrictions on the particular operation are required.

Where processing relies on consent, its content, date and permissible method of collection are recorded. Withdrawal is handled under the law, including requirements to stop processing and destroy data. Continued retention may be justified only by a specific applicable provision and permissible basis; withdrawn consent cannot automatically be replaced by a general reference to the journal’s interests.

For minors and persons with limited legal capacity, applicable rules on involvement of a legal representative are followed. If the necessary lawful basis is absent, the data must not be used for the relevant operation.

6. Publication of author information

An accepted article and its metadata may include, to the extent necessary:

• authors’ names;
• institutions and countries;
• verified ORCID identifiers, where provided;
• agreed contact details for the corresponding author;
• author contribution information;
• statements on funding, conflicts of interest, ethics, data availability and AI use.

Before publication, authors must understand which information will become public and check its accuracy. Home addresses, private telephone numbers, payment documents, consent forms and other unnecessary identifiers are not included in the publication. A professional contact address is preferable.

Public bibliographic information may circulate through DOI services, search engines, libraries, repositories, indexes and archives where these are actually used. This does not mean that confidential reviews or an entire user account are transferred to those services.

Requests to correct or remove personal information are considered in light of the law, personal safety and the integrity of the scholarly record. A DOI does not remove the right to have a request considered. Where a correction is justified, the editorial office takes available steps to update metadata with relevant recipients; complete removal of all external copies cannot be promised.

7. Confidentiality of peer review and editorial work

Under its Peer Review Policy, the journal uses a double-anonymous model. Anonymised versions are used for scholarly assessment; identifying details are accessible only to authorised participants who need them. Anonymisation cannot guarantee that authorship will not be inferred from a topic or public material, but reviewers must not deliberately identify authors or circumvent safeguards.

Reviews, internal discussions, invitations and unpublished manuscripts remain confidential. Reviewer identities and the link between a particular expert and a manuscript are not published within the adopted model. One reviewer’s consent does not itself change that model.

Disclosure of protected information in response to a legal requirement or an authorised investigation is permitted only on an established basis, to the necessary extent and with safeguards. Such an investigation does not automatically entitle an author to the identity of a complainant or reviewer, or to confidential correspondence.

An editor with a conflict of interest, including an author of the article under consideration, receives no access beyond their authorised role. An author’s relationship with the institute or a management position does not entitle them to inspect other people’s manuscripts or reviews. Confidentiality obligations continue after an assignment ends, a manuscript is withdrawn or an article is published.

8. Sharing personal data

To the necessary extent and on a permissible basis, recipients may include:

• authorised editors and institute personnel;
• appointed reviewers, subject to the restrictions of the anonymous process;
• providers assigned specific technical, publishing or accounting tasks;
• hosting, email, security and communication providers actually used;
• DOI agencies, indexing services, repositories and archives, within the necessary publication data;
• competent authorities or institutions under a lawful request or another appropriate basis;
• other persons within valid consent or a case expressly provided for by law.

Before sharing, the data, purpose, recipient’s authority, protection and retention arrangements, onward disclosure and termination of access are determined. Entrusting processing to a third party and notifying the data subject follow applicable requirements; publishing categories of recipients does not replace mandatory individual notification.

Disclosure for an ethics assessment must not become unrestricted circulation of allegations or sensitive material. Requests are checked for authenticity, competence and the necessary scope of disclosure. The rights of affected people and the complainant’s confidentiality are protected within the limits permitted by law.

The journal does not sell personal data or share them for unrelated direct marketing. A provider acting on the institute’s instructions must not use the data for its own advertising or to train publicly available AI models without a separate permissible basis and an authorised purpose.

9. Cross-border transfers and processing location

International publishing infrastructure, remote peer review, email, DOI services and archives may involve transfers or access from abroad. Each operation is assessed under Articles 15 and 27¹ of the Law “On Personal Data”, taking account of the data category, country, recipient and actual processing conditions.

The current wording of Article 27¹, introduced by the Law of 26 March 2026, No. ZRU-1125, is taken into account. Data subject to mandatory storage in Uzbekistan must meet that requirement. Other data covered by that article may be stored and processed abroad only where an established condition is met: recognised adequate protection; contractual terms or corporate rules meeting approved requirements; or compliance with standards included in an approved list.

The institute must document the applicable condition, necessary consents, transfer restrictions and database registration requirements. Use of a foreign service, its reputation, HTTPS or a general reference to a contract does not demonstrate compliance. Public availability of author metadata does not automatically authorise transferring the entire editorial database abroad.

Users may request information about the actual processing countries, recipients and applicable safeguards for their data. Adding new services must be accompanied by the necessary assessment and information before the relevant transfer.

10. Cookies and similar technologies

Depending on enabled functions, the website may use cookies or similar technologies for:

• maintaining sessions and secure authentication;
• remembering the selected language and user settings;
• operating forms and other platform functions;
• identifying threats and preventing abuse;
• permissible usage statistics subject to the relevant conditions.

Necessary functions and optional analytics are distinguished. Information about the purpose, provider, duration and management of the technologies used must be available. Where consent is required, optional technologies are not activated before consent, and declining or changing the choice must be possible.

Browser settings can restrict or delete cookies; disabling necessary technologies may disrupt login or individual functions. Continuing to browse does not itself replace required consent. External videos, widgets, fonts and buttons are also assessed for technical data transfers, even if they do not set cookies.

11. Data security

The institute organises legal, organisational and technical measures proportionate to the risks. Where applicable, these include:

• role-based access and timely termination of unnecessary access;
• protection of accounts and authentication data;
• secure transfer and storage of sensitive material;
• backups with restricted access and a defined lifecycle;
• software updates and security event monitoring;
• confidentiality commitments and guidance for authorised personnel;
• documentation, assessment and resolution of incidents.

Users must protect access to their accounts and report suspected compromise. The editorial office does not request passwords by email. Sensitive material should not be sent without agreeing on a secure method; a brief description of the issue can be sent first.

In an incident, the institute limits further harm, assesses affected data and risks to people, preserves necessary evidence and takes corrective action. Individuals and competent authorities are notified in the circumstances, manner and timeframes required by applicable rules. Absolute security cannot be guaranteed for any online system.

12. Data retention

Retention is determined by data category, purpose, processing basis and applicable obligations. In particular:

• account details are retained while needed for the account and remaining lawful tasks after closure;
• manuscripts, reviews and editorial correspondence are retained for consideration, documenting decisions and a justified period of subsequent assessment;
• financial records are retained for the applicable mandatory periods;
• complaint and investigation records are retained during consideration and necessary subsequent retention on an established basis;
• technical logs are retained for a limited period for diagnostics and security;
• publications and necessary public metadata are retained to maintain the scholarly record within lawful conditions of retention and dissemination.

Periods or verifiable criteria that can be communicated to the data subject are established for each category; “as long as the journal needs it” without a specific basis is insufficient. Unpublished manuscripts, reviewer contacts, passwords and an entire account history do not become permanent records merely because the journal is scholarly.

Deleting an account and correcting a published article are different actions. Retaining particular records after account closure requires an established basis and a necessary scope. When a purpose is fulfilled, an authorised period ends or another statutory ground arises, steps are taken to cease processing and destroy data; where only anonymised information may be retained, re-identification must be excluded.

Backups follow a limited retention cycle and access safeguards. Deleted data must not return to ordinary use after backup restoration; the relevant restrictions are reapplied. Retention for a specific dispute or lawful order is documented and reviewed when the basis ends.

13. User rights and requests

Under applicable requirements, a person may request:

• confirmation that their data are held and information on their content and source;
• information about processing purposes, grounds, methods, recipients and periods, including cross-border processing;
• access to information concerning them and a copy to the permissible extent;
• correction or completion of inaccurate, incomplete or outdated data;
• temporary suspension or cessation of impermissible or unnecessary processing and destruction of data in cases provided for by law;
• withdrawal of consent through the prescribed procedure;
• explanation and reconsideration of an automated result affecting them;
• protection of their rights by the authorised state body or a court.

Requests are sent to the address in section 17. Only necessary evidence is requested to verify identity; a passport copy is not a standard requirement for every request. Additional sensitive documents, if needed, are transferred by an agreed secure method. A duly authorised representative may also make a request.

Responses and necessary action follow the procedure and timeframes applicable to the particular request. Where a request is only partly fulfilled or restricted, the specific reasons, legal basis and available route of challenge are explained. Reference to an archive, DOI or ethics assessment without considering the applicable provision is not sufficient grounds for refusal.

Providing a copy of data does not mean disclosing another person’s personal information, a protected reviewer’s identity or all internal correspondence. The editorial office provides permissible access while protecting third parties and explaining justified restrictions.

14. Automated tools and artificial intelligence

Previously authorised tools for technical checks, similarity detection, metadata preparation and security may be used with permissible access and processing conditions. An automated score is not independent proof of misconduct or a basis for a final scholarly decision; significant findings are checked by an authorised person.

Substantive manuscript assessment, writing a reviewer’s scholarly evaluation and editorial decisions are not delegated to generative AI. Confidential manuscripts, reviews, personal data and private correspondence must not be uploaded to publicly available or journal-unauthorised AI systems.

An authorised technical or language function of a protected tool is limited to a task agreed in advance. The provider, retention, training on input data, onward recipients and the ability to stop processing are assessed. A user’s own belief that a service is safe does not replace authorisation or a lawful basis. Further requirements appear in the Policy on the Use of Artificial Intelligence Tools.

15. External links and services

The website may link to DOI pages, ORCID, repositories, databases and other external resources. After following a link, the operator of that resource applies its own processing conditions; users can review them before providing data.

An external resource’s independent activities differ from processing entrusted by the institute to a provider. Referring to an external privacy policy does not release the institute from responsibility for its own data transfers, provider selection or embedded website tools.

Connecting ORCID or another profile, if available, must include a clear explanation of the permissions requested. Disconnecting a profile or closing an account does not automatically remove an identifier already lawfully published; the corresponding request is considered separately.

16. Changes to this statement

The statement is reviewed when legislation, processing purposes, recipients, platform functions or editorial processes change. Actual publication and amendment dates are shown on the website; significant changes are communicated to affected people by an appropriate means where necessary.

A new statement must not retrospectively expand consent or authorise impermissible processing that has already occurred. Where a change requires new consent or another action, that action is completed before the relevant operation begins. Previous versions are retained to establish which conditions were communicated at the relevant time.

17. Administration and contact

Following approval, this statement takes effect on its publication date on the official website of Criminology (Uzbekistan). The Research Institute of Criminology of the Republic of Uzbekistan, through its authorised editorial office, is responsible for organising its implementation.

Questions, rights requests and reports of possible confidentiality breaches should be sent through the institute’s contact address: info@uzkti.uz. The subject line may read “Personal data — Criminology”. An initial message need only include a reply address, a description of the request and, where available, a manuscript number or article link.

Do not attach passwords, excessive identity documentation, restricted case records or signed consent forms without prior agreement. If a matter concerns another organisation or joint processing, the editorial office explains the limits of its competence and the permissible referral procedure while maintaining the necessary confidentiality.