1. Scope and responsibility
This policy applies to the central Inrep Scholar website, hosted institutional workspaces, account and support services, repository submission workflows, and public discovery pages. An institution or other subscribing institution normally determines the purpose of processing student, staff, researcher and repository information in its workspace. Inrep Scholar operates the platform and processes that information on the institution's instructions, except where Inrep Scholar determines a separate purpose such as platform security, billing, legal compliance or direct support.
InRep Campus is installed on infrastructure controlled by the institution. The institution controls local Campus accounts, submissions and files. Only approved published metadata, synchronization status and necessary licensing/health information are exchanged with the central platform as configured.
2. Information we process
- Account and identity data: name, email address, phone number, institutional role, department, programme, matriculation or staff identifier, verification and account status.
- Academic and repository data: submission metadata, authorship, supervisor relationships, review comments, correction history, access choices, deposit agreements, published records and uploaded files.
- Service and communication data: support requests, messages, notifications, saved searches, privacy requests, content reports and email-delivery events.
- Security and usage data: login/session activity, device and browser information, IP address, access requests, record views/downloads, audit events, integrity checks and rate-limit/security signals.
- Commercial data: institution subscription, invoice and payment-reference information. Full payment-card details are handled by the configured payment provider and should not be stored in repository records.
3. Public and private repository information
Published metadata may be intentionally public and may be exposed through repository pages, citation metadata, search-engine tags, OAI-PMH, Dublin Core, DataCite or approved exports. Files and non-public records are not made public merely because their metadata exists. Access is governed per record as open, metadata-only, view-only, institution-only, restricted, embargoed or private. External-link deployments remain subject to the external provider's access settings.
4. Why information is used
Information is used to create and secure accounts; verify institutional affiliation; receive and review academic submissions; manage supervision, library review, corrections, embargoes and publication; enforce file-access decisions; provide discovery and citation services; operate subscriptions and support; prevent abuse; investigate incidents; preserve audit evidence; meet institutional instructions; and comply with applicable legal obligations.
The legal basis depends on the relationship and jurisdiction and may include performance of a service agreement, steps requested before entering an agreement, the institution's public or academic task, legitimate interests in secure repository operations, legal obligations, and consent where consent is the appropriate basis. Consent is not described as the basis when the processing is required for account security, a contract or a legal/institutional duty.
5. Security, confidentiality and integrity
Inrep Scholar uses authenticated application routes, tenant and role checks, CSRF protection, bound database parameters, password hashing, session controls, private storage paths, expiring access grants, audit logging, file checksums and tamper-evident security-log chaining. Administrative and repository actions are limited by role and institution. Data exports are generated only for the authenticated account and exclude passwords, authentication secrets, reset/OTP tokens and private file paths.
No internet service can promise absolute security. Institutions must also secure their administrators, hosting, backups, email accounts, external storage providers and Campus servers. Suspected unauthorized access should be reported promptly through the contact page or the institution's administrator. Confirmed personal-data incidents are assessed, contained, documented and notified to affected controllers, people or authorities where applicable law requires notification.
6. Sharing and subprocessors
Information may be shared with the relevant institution, authorised reviewers or supervisors, infrastructure/email/payment providers used to deliver the service, professional advisers, and authorities where disclosure is legally required. Access is limited to the purpose for which it is shared. A current institution-specific data processing agreement and applicable subprocessor information should be obtained during procurement or requested through the Trust Center.
7. Retention and deletion
Retention depends on the record and the deployment model. Active account and workflow data is kept while needed to provide the service. Security, payment, audit and backup records may be retained for fraud prevention, dispute handling, recovery and legal obligations. Published scholarship, deposit agreements and review history may be part of an institution's academic record and may not be eligible for immediate deletion.
When deletion is approved, eligible information is deleted or anonymized and active sessions/access credentials are revoked. Residual copies may remain in protected backups until their scheduled expiry. A request may be limited where retention is required by law, academic integrity, public interest, contractual duties, legal claims, security evidence or the rights of another person; the requester will be told the applicable reason.
8. Your rights and choices
Depending on applicable law and the context, a person may have rights to be informed, access personal data, receive a portable copy, correct inaccurate data, object to or restrict certain processing, withdraw consent where processing relies on consent, request deletion or anonymization, receive human review of a significant automated decision, and complain to a competent supervisory authority.
- Immediate account export: a signed-in user can open My profile and download a machine-readable JSON copy tied to that account.
- Correction: a signed-in user can update available profile fields or submit a correction request where a field is controlled by an institution.
- Deletion/anonymization: a signed-in user can open a verified deletion review from My profile. Anyone can use the data-subject request form.
- Content/copyright concerns: use the content review and takedown form.
Identity and authority may be verified before information is released or changed. A request concerning an institution's records may be routed to that institution because it controls the relevant academic data.
Research-assistance, metadata and similarity tools may produce suggestions, but they do not replace the authorised supervisor, librarian or institution decision-maker. The platform is not intended to make a solely automated decision that produces legal or comparably significant effects for a user.
9. Cookies and browser storage
Session and security cookies are used for sign-in, CSRF protection and protected workflows. Limited browser storage may remember interface choices. More detail is provided in the Cookie Policy.
10. Younger users and sensitive information
The platform is designed for higher-education and research repositories, but some enrolled students may be below the age at which they can independently consent in their jurisdiction. The responsible institution must provide any required notice, authority or parent/guardian process before creating or approving such an account. Users should not place unnecessary health, biometric, financial, government-identity or other highly sensitive information in support, accessibility or repository text fields. Contact the institution or use the Trust Center if such information was submitted unintentionally.
11. International access and changes
Institutions must assess cross-border transfer requirements for their chosen hosting, email, payment, storage and Campus arrangements. Material changes to this policy will be published on this page with a revised date. Changes do not remove rights already provided by applicable law or an institution's signed agreement.
12. Contact and complaints
Submit privacy requests through the Trust Center. Accessibility barriers can be reported through the Accessibility Statement. Nigerian data subjects may also learn about statutory rights and supervisory complaints from the Nigeria Data Protection Commission.