Privacy Policy

Who we are

The data controller for this website and for the journal is Heritage & Partners LLP, Unit H, 128 City Road, London EC1V 2NX, United Kingdom. For any question about this policy or about your personal data, write to [email protected].

We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, and, for people in the European Union, the EU General Data Protection Regulation.

Visiting the website

You can read and download everything on girn.uk without registering or giving us any information. The website sets no cookies, uses no analytics or tracking, and loads no content from third parties: fonts, scripts and the PDF reader are all served from girn.uk itself.

Like every web server, ours records a technical log of each request: your IP address, the date and time, the page or file requested, the referring page and your browser's user-agent string. We use these logs only to keep the site running and secure, for example to diagnose errors and defend against abuse. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f) GDPR). Logs are not combined with other data and are not used to identify or profile visitors.

The website is hosted by Contabo GmbH, Germany, in its data centre in Lauterbourg, France. Contabo processes the server logs on our behalf under a data processing agreement, and the data stays within the European Union.

Contacting us

When you email us, we receive your email address, your name and anything you choose to include. We use it only to deal with your message. The legal basis is our legitimate interest in answering correspondence, or taking steps at your request before entering into an agreement such as a publication agreement (Article 6(1)(b) and (f) GDPR).

Authors

When you submit a manuscript we process the information needed to review, edit and publish it: your name, affiliation, postal and email address, ORCID identifier, biographical note and our correspondence with you. The legal basis is performance of the publication agreement with you (Article 6(1)(b) GDPR).

During double-blind review, reviewers do not see your identity.

If your article is published, your name, affiliation, ORCID identifier and biographical note appear on the article page, and the article PDF also carries the contact details printed in its "About the author" section. You agree to this publication when you approve the final proofs. Published articles form part of the permanent scholarly record: their metadata is openly available to indexing services and aggregators, for example through Google Scholar and our OAI-PMH interface, and the articles themselves may be freely copied under the CC BY 4.0 licence. For that reason we cannot remove published author information on request. We will, however, correct it, for example after a change of affiliation or name.

Reviewers and editorial board

For reviewers we keep a name, email address, affiliation and areas of expertise so that we can invite them to review, together with the reviews they write. Reviewers' identities are never published and are not disclosed to authors. The legal basis is our legitimate interest in running peer review (Article 6(1)(f) GDPR).

Members of the editorial board agree to the publication of their name, title, affiliation, photograph and biography on the editorial board page. This information is removed or updated when they leave the board or ask us to change it.

We do not sell personal data and do not share it for advertising. Personal data is only passed on where it is necessary:

to our hosting provider Contabo GmbH, which stores the website and its server logs;
to our email service provider, which stores our correspondence;
to members of the editorial board and to reviewers, in anonymised form where the manuscript is concerned, as part of peer review;
for published articles only, to indexing services and archives that harvest the published metadata.

Data processed by us is stored in the United Kingdom and the European Union. The UK recognises the European Union as providing adequate data protection, and vice versa.

How long we keep data

Server logs: deleted automatically after 30 days.
General correspondence: kept for as long as needed to deal with the matter, and no longer than three years.
Rejected or withdrawn submissions, including the manuscript, reviews and related correspondence: deleted three years after the decision.
Published articles and the author information in them: kept permanently as part of the scholarly record. Correspondence about a published article is kept as long as the journal needs it to document the editorial process.
Reviewer details: kept while you are willing to review for us. Ask us at any time to remove you from our list of reviewers.

Your rights

You have the right to ask us for access to the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you may withdraw it at any time. Some rights are limited for published articles, as explained above. To exercise any of these rights, email [email protected]. We will answer within one month.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority in the EU country where you live or work.

We do not use your data for automated decision-making or profiling.

Changes to this policy

If we change how we process personal data, for example by adding a contact form or visitor statistics, we will update this page before the change takes effect and revise the date at the top. This version was last updated on 30 September 2026.

Privacy policy