Legal · AIC-DOC-04
Data Protection and GDPR Policy
The operational data protection policy of the journal, written to the UK and EU GDPR standard and applied to everyone whose data we hold, wherever they live. Version 1.0, adopted 8 June 2026.
Version 1.0 · Adopted by the editorial board 8 June 2026 · In force from 8 June 2026 · Next scheduled review June 2027
Owner: Editor-in-Chief · Contact: dataprotection@caribbeanaijournal.org
This is the journal's operational data protection policy. It is written to the standard of the UK General Data Protection Regulation and the EU General Data Protection Regulation (Regulation (EU) 2016/679), and it is applied to everyone whose data we hold, wherever they live. The shorter, plainer privacy statement says the same things for a general reader; where the two differ, this document governs.
We apply the GDPR standard globally rather than only to people it strictly covers. A journal published from the Caribbean, holding data on authors in a dozen jurisdictions with a dozen different data protection regimes, can either run one high standard or run twelve inconsistent ones. We run one.
1. Who Is Responsible
| Data controller | Caribbean Artificial Intelligence Association, publisher of Artificial Intelligence in the Caribbean |
|---|---|
| Data protection contact | dataprotection@caribbeanaijournal.org |
| Accountable officer | The Editor-in-Chief holds personal accountability for this policy. The journal is below the threshold at which a statutory Data Protection Officer must be appointed, and the role is discharged by the Editor-in-Chief. |
| Escalation | Unresolved matters go to the Council of the Caribbean Artificial Intelligence Association, and then to a supervisory authority. See section 12. |
| Scope | Everyone whose data the journal holds: readers, registrants, authors, co-authors, student authors and their named adults, mentors, reviewers, endorsers, applicants for editorial roles, editors, and anyone who writes to us. |
2. The Seven Principles, and What They Mean Here
| Principle | How the journal meets it |
|---|---|
| Lawfulness, fairness and transparency | Every processing purpose is listed in section 4 with its lawful basis. Nothing is collected for a purpose we have not published. |
| Purpose limitation | Data given for a submission is used to handle that submission. It is not repurposed for marketing, profiling or research about our users. |
| Data minimisation | The forms ask for what the editorial process actually needs. We collect no date of birth, no address, no gender, no ethnicity and no identity document. Age is collected as a number because the safeguarding rule turns on it, and nothing finer is required. |
| Accuracy | You may correct your record at any time, and corrections to published work are handled under the corrections policy. |
| Storage limitation | The retention schedule in section 7 gives a defined clock for every category. The published scholarly record is the deliberate exception, and it is explained there. |
| Integrity and confidentiality | Transport encryption everywhere, encryption at rest, access on a need-to-know basis, and the confidentiality undertaking every editor signs before handling a manuscript. |
| Accountability | This document, the record of processing in section 3, the processor list in section 8, and the breach log in section 9 are the evidence. |
3. Record of Processing Activities
Article 30 requires a controller to keep a record of what it processes. This is ours, published rather than kept in a drawer.
| Activity | Data categories | Data subjects | Recipients |
|---|---|---|---|
| Contributor registration | Name, email, age, affiliation, country, ORCID, profile URL, subject codes, statement of work, endorsement, declarations, optional supporting document | Registrants | Editorial office; form host |
| Manuscript submission and peer review | Author and co-author names, emails, affiliations, countries, ORCID, the manuscript and its files, declarations, correspondence | Authors, co-authors | Editorial office; assigned editor; reviewers, who see an anonymised file |
| Preprint submission | As above, plus licence choice and version history. Author names are deliberately not anonymised. | Submitting authors | Editorial office; moderators; the public, on announcement |
| Student submissions | Student name, age, email, school, country; mentor name, email and role; named adult's name, email, relationship and consent; the paper and its files | Students aged 13 to 30, mentors, named adults | Student section editor; the review panel; the named adult |
| Editorial role applications | Name, email, age, affiliation, position, qualifications, CV, publication list, referees, competing interests, and any files uploaded | Applicants | Editor-in-Chief; the appointment panel; referees, only if shortlisted and only after we tell you |
| Peer review administration | Reviewer names, emails, expertise, review reports, availability | Reviewers | Editorial office; the assigned editor |
| Correspondence | Whatever you put in an email or a contact form | Anyone who writes to us | Editorial office; mail provider |
| Publication | Author name, affiliation, country, ORCID, and the article itself | Published authors | The public, permanently; indexing services and preservation archives |
| Optional editorial mailing | Name, email, subject codes | People who ticked the box | Editorial office |
We process no special category data under Article 9 and no criminal offence data under Article 10. Do not put health data, biometric data, political opinions, religious beliefs, trade union membership, sexual orientation or criminal history about yourself or anyone else into a submission form. Research data containing such categories belongs in a documented repository under the terms of the research ethics policy, not in a web form.
4. Lawful Basis for Each Purpose
| Purpose | Lawful basis | Why that one |
|---|---|---|
| Running a submission through screening, review and decision | Contract, Art. 6(1)(b) | You asked us to consider your work. Handling it is the service you requested. |
| Registration and identity screening | Contract and legitimate interests, Art. 6(1)(b) and (f) | The account is the mechanism of the relationship; screening protects the integrity of the scholarly record. |
| Research integrity checks, similarity screening, moderation | Legitimate interests, Art. 6(1)(f) | Balancing test completed 8 June 2026: readers and the wider record have a substantial interest in integrity checks; the intrusion on an author is minimal and expected. |
| Publishing an accepted article with author names | Legitimate interests, Art. 6(1)(f), and contract | Attribution is the point of scholarly publishing. Anonymous authorship would destroy the record's value. |
| Processing the data of an author under 18 | Consent, Art. 6(1)(a), given and verified under Art. 8 | Consent comes from the named adult, is verified by email, and is withdrawable. See section 6. |
| Editorial role applications | Consent, Art. 6(1)(a), and steps prior to a contract, Art. 6(1)(b) | You chose to apply, and you can withdraw the application at any point. |
| The optional editorial mailing | Consent, Art. 6(1)(a) | A tick box you may leave untouched, withdrawable in one click. |
| Keeping an unsuccessful application on file | Consent, Art. 6(1)(a) | A separate tick box. Untouched means deleted at twelve months. |
| Preserving the published record, corrections and retractions | Legal obligation and legitimate interests, Art. 6(1)(c) and (f) | A scholarly record that can be silently rewritten is not a record. See section 5. |
| Responding to a legal or regulatory demand | Legal obligation, Art. 6(1)(c) | Only where the demand is valid and binding on us. |
Where the basis is legitimate interests, we have carried out and documented a balancing test, and you may ask for it. Where the basis is consent, it is a real choice: nothing you need from the journal is withheld for declining an optional tick box, and no box is pre-ticked anywhere on this site.
5. Your Rights, and How to Use Them
Write to dataprotection@caribbeanaijournal.org from the address we hold for you. There is no form to complete and no fee. We answer within one calendar month, extendable by two further months for a genuinely complex request, in which case we tell you inside the first month and say why.
| Right | Article | What we do |
|---|---|---|
| Be informed | 13–14 | This document and the privacy statement, both public, both free of charge and free of registration. |
| Access | 15 | A copy of everything we hold about you, in a readable format, with the sources and recipients. |
| Rectification | 16 | Corrections to your record, applied promptly. Corrections to a published article follow the corrections policy, which is a public process by design. |
| Erasure | 17 | Unconditional for a registration, an application, correspondence, a mailing subscription, or an unsubmitted draft. Limited for the published record, as set out below. |
| Restriction | 18 | We freeze processing while a dispute about accuracy or lawful basis is resolved. |
| Portability | 20 | Your registration and submission data as machine-readable JSON or CSV, sent to you or, where technically feasible, to another controller you name. |
| Object | 21 | You may object to any processing based on legitimate interests, and we stop unless we can demonstrate compelling grounds that override yours. Objection to the optional mailing is always honoured, immediately and without question. |
| Withdraw consent | 7(3) | At any time, as easily as it was given. Withdrawal does not undo processing that was lawful before it. |
| Not be subject to automated decisions | 22 | Nothing to exercise: we make no automated decisions about people. See section 10. |
| Complain | 77 | To us first if you are willing, and to a supervisory authority whenever you choose. See section 12. |
Where erasure is limited, and why
Erasure is not absolute, and it is fairer to say so plainly than to promise it and then refuse. Once an article or preprint is published, the author's name, affiliation and the work itself form part of a permanent public scholarly record that libraries, indexers, preservation archives and other researchers rely on and have already copied. Article 17(3) recognises this. In practice:
- Before publication: withdraw at any time, and the record is deleted in full.
- After publication: the article stays. We will correct an error in your name, update an affiliation, add or remove an ORCID, and in cases involving a genuine safety risk we will discuss options including publication under initials.
- Retraction replaces rather than removes. The article remains visible, marked retracted, with a public notice explaining why, because deleting it would leave every citation of it pointing at nothing.
- Name changes, including those following a change of gender identity or marital status, are handled quietly and without a public correction notice unless you ask for one. You do not have to explain why, and we do not ask.
- A student who was under 18 at submission may, on reaching 18, ask for their name to be replaced with initials on their published work. We do it, and we do not ask for a reason. This is a right we grant deliberately: a fifteen-year-old cannot properly consent to a decision that follows them into adulthood.
6. Children and Young People
The journal's minimum age is 13, and this is the shape of Article 8 as we apply it:
- Under 13: no account, no submission, no processing. A teacher or guardian may write to us on the young person's behalf.
- 13 to 17: participation requires consent from a named parent, legal guardian, teacher or school-appointed supervisor. We collect that adult's name, relationship and own email address, and we verify the consent by writing to them and waiting for a reply. Nothing proceeds until it arrives.
- 18 and over: the young person consents for themselves, and the named adult is dropped from the record at their request.
Four further protections apply to everyone under 18, and they are operational rules rather than aspirations:
- Data minimisation, harder. We collect name, age, email, school and country, and nothing else. No date of birth, no address, no photograph, no identity document.
- No direct contact. Editors and reviewers write to the named adult and copy the student, never the reverse. No editor holds an unmonitored channel to a young author.
- Publication restraint. Publication shows name, school and country at most, and initials and country on request. No photographs, no ages, no contact details are ever published.
- The shortest retention clock in the journal. Unsuccessful student submissions are deleted at twelve months rather than the twenty-four that applies to adults.
The safeguarding policy carries the full operational detail, including reporting routes and what happens if something goes wrong.
7. Retention Schedule
Every category has a clock and a reason. Deletion is by calendar quarter: a record whose clock expires in a quarter is deleted at the end of it.
| Record | Retained | Reason |
|---|---|---|
| Published articles and preprints, with author metadata | Permanent | The scholarly record. Preserved in archives that we do not control and cannot recall. |
| Peer review correspondence and reviewer reports on published work | 10 years | Post-publication challenge, appeal and integrity investigation |
| Rejected or withdrawn manuscripts and their files | 24 months | Appeals, duplicate-submission and integrity checks |
| Student submissions, unsuccessful | 12 months | Shortened deliberately because the authors are young |
| Named adult and mentor contact details | Until the student turns 18, or 12 months after the submission closes, whichever is sooner | Consent verification only, and no longer |
| Contributor registrations that never submit | 24 months from the last activity | Dormant account clear-out |
| Contributor registrations that do submit | For the life of the account, plus 24 months | Continuity of endorsement and declarations |
| Editorial role applications, unsuccessful | 12 months, or immediately on request; 12 months longer if you ticked the keep-on-file box | Comparison across a recruitment round, and future openings if you asked |
| Editorial appointment records | Term of appointment, plus 6 years | Governance and the masthead record |
| Reviewer records and review history | 6 years from the last review | Reviewer recognition and conflict checking |
| General correspondence | 24 months | Continuity of an ongoing conversation |
| Editorial mailing list | Until you unsubscribe, plus 30 days | Honouring the unsubscribe, then gone |
| Breach log entries | 6 years | Accountability under Art. 33(5) |
| Server and form logs | 90 days | Security and abuse investigation |
8. Processors and Recipients
The journal is a small operation and does not build its own infrastructure. Every third party that touches personal data on our behalf does so under a written processor agreement meeting Article 28, is bound to act only on our instructions, and is listed here.
| Processor | What it does | Data it sees |
|---|---|---|
| Netlify | Hosts this website and receives every form submission and uploaded file | Everything you type into a form, and every file you attach |
| Email provider | Editorial mailboxes and correspondence | Names, addresses, message content, attachments |
| Similarity screening service | Plagiarism and duplicate-submission checks on submitted manuscripts | Manuscript text. Configured not to retain submitted text in a comparison corpus. |
| DOI registration agency | Registers persistent identifiers for published work | Author names, affiliations, ORCID iDs, article metadata — all of it already public |
| Preservation archive | Long-term archiving of published content | Published articles and their metadata only |
Beyond those: reviewers see an anonymised manuscript and no author identity; indexing services receive published metadata that is public by definition; and a named endorser or referee is contacted only with your knowledge. We sell nothing, rent nothing, and run no advertising, no analytics, no tracking pixels and no third-party scripts of any kind. There is no data-sharing arrangement to disclose because there is none.
Where a valid legal order compels disclosure, we comply, and we tell the person concerned unless the order forbids it.
9. International Transfers
The journal is published from the Caribbean, our processors operate in the United States and the European Union, and our authors are everywhere. Personal data therefore crosses borders, and Chapter V of the GDPR governs how.
- Transfers to a country with an adequacy decision proceed on that basis.
- All other transfers are made under the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved.
- A transfer risk assessment is completed before a processor is engaged and reviewed annually, covering the destination's surveillance laws and the practical remedies available to a data subject there.
- Supplementary measures are applied where the assessment calls for them: encryption in transit and at rest, pseudonymisation where the purpose allows, and access limited to named individuals.
Ask us for the transfer documentation for any processor and we will send it.
10. Personal Data Breaches
A breach is any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. The procedure below was adopted 23 June 2026 and is rehearsed annually.
Report, immediately
Anyone who becomes aware of a breach, inside the journal or outside it, reports it to dataprotection@caribbeanaijournal.org. Reporting a breach you caused yourself carries no penalty. Concealing one ends an appointment.
Contain, within hours
Revoke access, isolate the affected system, and preserve the evidence before anything is cleaned up.
Assess the risk to people
What data, how many people, what could realistically happen to them. The test is the risk to the individuals, never the embarrassment to the journal.
Notify the supervisory authority within 72 hours
Where the breach is likely to result in a risk to people's rights and freedoms, under Art. 33. If the full picture is not yet clear, we notify inside 72 hours anyway and complete it afterwards.
Notify the people affected, without undue delay
Where the risk is high, under Art. 34: what happened, what data, what we have done, and what they should do. In plain language, not legal cover.
Log and learn
Every breach, notifiable or not, is recorded in the breach log with its cause and the change made to prevent a repeat. The log is kept 6 years and reviewed by the board annually.
11. Automated Decisions, Profiling and AI
An AI journal that quietly ran its own editorial decisions through a model would deserve everything that followed. So this section is short and absolute.
- No editorial decision about a manuscript is made by an automated system. Desk rejections, review outcomes, preprint moderation, registration screening and role appointments are all made by a named human being who is accountable for them.
- No profiling. We do not score, rank, segment or predict anything about authors, reviewers or readers.
- No manuscript, review report or personal record is entered into a generative AI system that retains inputs or trains on them. This binds editors and reviewers and is part of the confidentiality undertaking every one of them signs. The AI and research integrity policy sets out the narrow, disclosed tooling that is permitted.
- Automated tools assist and never decide. Similarity screening flags a passage for a human to read; it does not reject anything. Spam filtering blocks a form submission; a person reviews anything caught in error.
- Nothing you submit trains a model of ours. We do not have one, and we do not license your work to anyone building one.
12. Cookies and Tracking
This website sets no cookies at all. Not essential ones, not preference ones, not analytics. There is no consent banner because there is nothing to consent to, which is the only honest reason to be without one.
- No analytics. No Google Analytics, no Plausible, no Fathom, no server-side visitor tracking.
- No advertising or tracking pixels, and no social media embeds that phone home.
- No local storage or session storage holding anything about you.
- Two third-party origins, both declared in the site's content security policy: Google Fonts for typefaces and Unsplash for header photographs. Both see your IP address as any image host would; neither receives an identifier from us.
- Server logs at the host record IP address, timestamp and requested page for security purposes, and are deleted after 90 days.
If we ever needed a cookie, this page would be updated before it was set, not afterwards.
13. Security Measures
| Measure | Detail |
|---|---|
| Encryption in transit | HTTPS everywhere, with HTTP Strict Transport Security preloaded for two years including subdomains |
| Encryption at rest | Form submissions, uploaded files and editorial mailboxes are encrypted at rest by the processors listed above |
| Browser hardening | A strict Content Security Policy, X-Content-Type-Options, X-Frame-Options: DENY, a cross-origin opener policy, and a permissions policy denying geolocation, camera, microphone, payment and cohort tracking |
| Access control | Named accounts, multi-factor authentication on every administrative account, and access granted by role rather than by seniority |
| Need-to-know | An editor sees the manuscripts they handle. A reviewer sees an anonymised file. Nobody browses the archive for interest. |
| Confidentiality undertaking | Signed by every editor, moderator and reviewer before their first manuscript, and enforced as a condition of appointment |
| Minimised attack surface | A static site with no database, no login system, no user-generated content rendered back to visitors, and no server-side application to compromise |
| Review | Security posture reviewed annually alongside this policy, and after any breach |
14. Data Protection by Design, and Impact Assessments
Article 25 requires protection to be designed in rather than added later. Concretely: this is a static site with no database, because a database we do not have cannot leak. The forms ask for the minimum the process needs. No box is pre-ticked. The under-18 route was designed around the named adult rather than having consent bolted onto it afterwards.
A Data Protection Impact Assessment is completed before we start any processing likely to result in a high risk to people, and always before: introducing any account system holding credentials, processing any special category data, adding any analytics or tracking, engaging a processor in a country without an adequacy decision, or deploying any automated tool that touches an editorial decision. A DPIA covering the student section and its under-18 processing was completed on 10 June 2026 and is reviewed annually. Ask and we will share its conclusions.
15. Complaints
Write to dataprotection@caribbeanaijournal.org. We acknowledge within 3 business days and respond substantively within one calendar month. If our answer does not satisfy you, escalate to the Council of the Caribbean Artificial Intelligence Association through the same address, marked for the Council's attention.
You may also complain directly to a data protection supervisory authority, and you do not have to come to us first. Which authority depends on where you are: for people in the United Kingdom, the Information Commissioner's Office at ico.org.uk; for people in the European Economic Area, the supervisory authority of your country of residence or workplace; for people in the Caribbean, the data protection authority or information commissioner of your territory, several of which now operate under statutes closely modelled on the GDPR. Complaining to a regulator costs nothing and is not held against you here in any way.
16. Changes to This Policy
This policy is reviewed annually by the editorial board and whenever the law, our processors or our processing changes materially. Every version carries a version number and an adoption date, and superseded versions are kept and available on request. Material changes are announced on this page and in the document register at least 30 days before they take effect. Where a change materially affects processing that rests on your consent, we ask for consent again rather than assuming it.