Privacy notice

Who we are

the institution operating this platform is responsible for processing personal data in BAHETH, the research and publishing management platform (the controller). the institution's data protection officer oversees the protection of your data; for anything about it, write to the contact address published on this platform or to the address published on the institution's website.

The data we collect

• Account data: name, e-mail address, affiliation, country and your ORCID iD if you give it.
• Academic profile: rank, specialty, qualifications, research output and the CV you upload.
• Funding and publishing applications, reports and their attachments, and the reviews and committee decisions about them.
• Financial data needed to pay you when you receive a grant or a fee.
• Technical records: the audit trail (action, time, who took it, network address and browser) and sign-in records.

Purposes and lawful basis

We process your data to run, review and decide funding and publishing applications, make payments and prepare reports, and to verify identity and permissions and protect the platform. We rely on the institution's functions in supporting research and publishing under the laws and regulations that govern it, on carrying out the applications you make and are party to, and on your consent where we ask for it explicitly for optional data. Fields marked as required in a form are needed to consider the application; the others are optional.

Who we share data with

Only the offices of the institution operating this platform that need it for their role see your data (research units, secretariats, committees, councils, finance), and reviewers see what a review needs. We do not sell personal data. Data leaves the institution only where a law requires it, or to service providers that operate the platform for the institution (hosting, e-mail delivery) under a contract binding them to confidentiality and protection.

Retention

We keep account data while the account exists, application and decision records for the period set by the institution's records retention schedule or as long as their purpose requires, and audit records for at least twelve months. Data, backups included, is destroyed once its purpose ends unless a law requires keeping it.

Your rights

• To be told the lawful basis and purpose of collecting your data.
• To access your data and obtain a copy of it.
• To ask for your data to be corrected, completed or updated.
• To ask for your data to be destroyed once it is no longer needed, unless a law requires keeping it.
• To withdraw your consent where consent is the basis of the processing, by writing to the contact address published on this platform.
• To complain to the Kingdom's personal data protection authority.

Send requests to the contact address published on this platform; we answer within thirty days of receiving a complete request.

Transfers outside the Kingdom

The platform is hosted in the environment chosen by the institution operating it. Personal data is transferred outside the Kingdom only in the cases the Regulation on Personal Data Transfer outside the Kingdom permits, with the safeguards it requires.

Security

The platform protects data by checking permissions on every request, a second factor for privileged roles, encrypted sessions and an audit trail that is never changed. We notify the competent authority within 72 hours of learning of a breach that may harm the data or the people concerned, and the people affected as the law requires.

Changes to this notice

Every change to this notice is published on this page with its version number and effective date.