Privacy Policy
Last updated: 21 August 2026
The Scholarly Networks Security Initiative (“SNSI”, “we”, “us” or “our”) is committed to protecting your personal data and respecting your privacy.
SNSI is a strategic partner of the International Association of Scientific, Technical and Medical Publishers (“STM”). For the purposes of applicable data protection law, STM is the data controller responsible for the personal data described in this Privacy Policy.
We process personal data in accordance with applicable data protection legislation, including:
the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”);
the Dutch Uitvoeringswet Algemene verordening gegevensbescherming (“UAVG”);
the UK General Data Protection Regulation (“UK GDPR”);
the Data Protection Act 2018; and
other applicable privacy, electronic communications and data protection legislation.
This Privacy Policy explains what personal data we collect, how and why we use it, the lawful bases on which we process it, who we may share it with, how long we retain it, how we protect it and the rights you have in relation to your personal data.
1. Who we are
The Scholarly Networks Security Initiative brings together publishers, libraries, universities, technology providers, cybersecurity specialists and others involved in scholarly communications to help address cybersecurity risks affecting scholarly networks and research communications.
SNSI is a strategic partner of:
International Association of Scientific, Technical and Medical Publishers (STM)
Prins Willem-Alexanderhof 5
2595 BE The Hague
The Netherlands
STM also has an office at:
Prama House
267 Banbury Road
Oxford OX2 7HT
United Kingdom
If you have questions about how SNSI or STM processes your personal data, you can contact our Data Protection Officer at:dpo@stm-assoc.org
2. Personal data we collect
Information you provide to us
When you contact SNSI through our website, register your interest in an activity or otherwise communicate with us, we may collect personal data including:
your name;
your email address;
your organisation or institution;
your job title or professional role, where provided;
the subject or purpose of your enquiry;
information contained in messages you send to us; and
any other information you choose to provide.
You do not need to provide personal data simply to browse the SNSI website.
Information collected when you use our website
When you visit the website, certain technical and usage information may be collected automatically.
This may include:
your IP address;
browser and device type;
operating system;
approximate geographic location;
referring website or source;
pages viewed;
date and time of visits; and
information about how you interact with the website.
Some of this information is collected using cookies and similar technologies.
3. How we use your personal data
We may use personal data to:
respond to enquiries and requests;
communicate with you about SNSI and its activities;
provide information, publications or resources you have requested;
manage relationships with SNSI participants, partners, contributors and other stakeholders;
administer events, initiatives and activities where applicable;
operate, maintain and secure our website;
prevent spam, fraud, misuse, cyberattacks and other malicious activity;
understand how visitors use our website;
measure the effectiveness and performance of our website and resources;
improve our website, resources and communications;
comply with legal and regulatory requirements; and
establish, exercise or defend legal claims where necessary.
We will not use your personal data for purposes that are incompatible with those described in this Privacy Policy unless permitted or required by law.
SNSI and STM do not sell your personal data.
4. Our lawful bases for processing
Under applicable data protection law, we must have a lawful basis for processing your personal data.The lawful basis we rely on will depend on why and how we are using the information.
Legitimate interests
We may process personal data where this is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your rights, interests or fundamental freedoms.
Our legitimate interests may include:
operating SNSI and carrying out its activities;
responding to professional and organisational enquiries;
maintaining relationships with participants, partners and stakeholders;
providing relevant information and resources;
understanding and improving the use of our website;
protecting the security and integrity of our website, systems and communications; and
preventing fraud, misuse and malicious activity.
Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and take account of its potential impact on individuals.
Consent
Where required, we will ask for your consent before processing your personal data.
This may include:
certain non-essential cookies;
analytics technologies;
third-party media technologies; and
communications where consent is legally required.
Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Contract or steps taken at your request
We may process personal data where this is necessary to provide something you have requested, to take steps at your request before entering into an agreement, or to perform an agreement with you.
Legal obligation
We may process personal data where necessary to comply with a legal or regulatory obligation that applies to us.
5. Contact enquiries
If you contact SNSI using a form on the website, by email or through another communication channel, we will use the information you provide to review, manage and respond to your enquiry.
This may include your:
name;
email address;
organisation;
professional role; and
information contained in your message.
We may keep an appropriate record of our correspondence where this is necessary for administration, continuity, security or legal purposes.
We will not automatically add you to a marketing mailing list simply because you have contacted us.
Where you separately choose to receive communications requiring consent, we will provide an appropriate way to withdraw that consent or unsubscribe.
6. Cookies and similar technologies
The SNSI website uses cookies and similar technologies to operate correctly, understand how the website is used, protect the website and provide certain functionality.
Cookies are small files or pieces of information stored on or accessed from your device when you visit a website.
The cookies and similar technologies used by the SNSI website may include the following categories.
Essential cookies
Essential cookies are necessary for the website to operate correctly.
They may support functions including:
website security;
page navigation;
online forms;
load balancing;
fraud or spam prevention; and
remembering your privacy or cookie preferences.
Where these technologies are strictly necessary to provide the website or a service you have requested, they may be used without consent where permitted by applicable law.
Analytics and performance cookies
We use Squarespace Analytics to help us understand how visitors interact with the SNSI website.
Analytics information may include:
numbers of website visits;
pages viewed;
traffic and referral sources;
browser and device information;
general geographic information; and
patterns of website usage.
We use this information to understand website performance, identify which resources are useful to visitors and improve the website.
Where consent is required by applicable law, analytics and performance technologies will only operate after you have provided that consent.
Third-party and media cookies
Some pages on the SNSI website may contain content supplied by third parties, including embedded YouTube videos.
Those third-party services may use cookies or similar technologies when content is loaded or when you interact with it.
Where required, non-essential third-party technologies will be prevented from operating until you have provided the appropriate consent.
You can manage your choices using the cookie controls provided on the SNSI website. You can also manage or delete cookies using your browser settings.
7. Squarespace
The SNSI website is built and hosted using Squarespace.
Squarespace may process certain personal and technical information in order to provide services including:
website hosting;
infrastructure;
website security;
forms;
analytics; and
other website functionality.
This may include information such as:
IP address;
browser information;
device information;
pages visited; and
interactions with the website.
Where Squarespace processes personal data on our behalf, it acts as one of our technology service providers and is required to handle that information in accordance with applicable contractual and data protection requirements.
8. YouTube videos
The SNSI website may contain videos hosted by YouTube, a service provided by Google.
When a page containing an embedded YouTube video is loaded, or when you interact with the video, information may be transmitted to Google.
This may include:
your IP address;
browser and device information;
information about the page you are viewing; and
information about your interaction with the video.
YouTube and Google may also use cookies and similar technologies in connection with embedded video content.
Where required by applicable law, we will use cookie controls or other technical measures designed to prevent non-essential YouTube technologies from operating before the appropriate consent has been provided.
Where technically appropriate, we may use privacy-enhanced embedding options.
Google processes information it receives through YouTube in accordance with its own privacy policies and terms.
9. Website security and spam prevention
Protecting the security of our website and communications is particularly important to SNSI.
We may therefore use technical measures and third-party services to help protect our website and online forms against:
spam;
automated submissions;
fraud;
unauthorised access;
malicious activity;
cyberattacks; and
other security threats.
These measures and services may process technical information relating to your browser, device, network connection, IP address and interaction with the website where necessary for security purposes.
10. Third-party websites and services
The SNSI website may contain links to websites, services or content provided by third parties.
If you follow a link to another website or interact with third-party content, the relevant third party may process personal data about you in accordance with its own privacy policies and terms.
SNSI and STM are not responsible for the privacy practices, security or content of independent third-party websites.
We recommend reviewing the privacy information provided by those organisations before providing personal data to them.
11. Who we share personal data with
We may share personal data with trusted third parties where reasonably necessary to operate SNSI, provide the website or carry out the purposes described in this Privacy Policy.
These third parties may include:
Squarespace and other website technology providers;
hosting and infrastructure providers;
analytics providers;
website security and spam-prevention providers;
video and media providers such as YouTube and Google;
email and communications providers;
organisations supporting SNSI projects and activities;
professional advisers, auditors and consultants;
service providers acting on our behalf; and
regulators, courts, law enforcement bodies or other public authorities where disclosure is required or permitted by law.
Where another organisation processes personal data on our behalf, we take appropriate steps to require that organisation to protect the data and use it only for authorised purposes.
Where another organisation acts as an independent controller, its own privacy policy will apply to its processing.
We seek to limit any personal data we disclose to what is reasonably necessary for the relevant purpose.
We do not sell or rent personal data to advertisers or other third parties.
12. International transfers of personal data
SNSI and STM operate internationally and some of the technology providers and other organisations we work with may process personal data in countries outside the United Kingdom or European Economic Area (“EEA”).
Personal data may therefore be accessed, processed or stored in more than one country, including the United Kingdom, the Netherlands and other countries in which our service providers operate.
Where personal data is transferred internationally, we take appropriate measures to ensure that the transfer complies with the applicable UK and/or EU data protection requirements.
Depending on the circumstances, these measures may include relying on:
a recognised adequacy decision or adequacy regulation;
the European Commission's Standard Contractual Clauses (“SCCs”);
the UK's International Data Transfer Agreement (“IDTA”);
the UK Addendum to the EU Standard Contractual Clauses;binding contractual safeguards; or
another transfer mechanism permitted by applicable data protection law.
Where required, we may also carry out assessments of the protections available in the country receiving the personal data and implement additional safeguards.
You may contact us if you would like further information about the safeguards used for a particular international transfer.
13. How long we keep your personal data
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected.
When determining an appropriate retention period, we may consider:
the nature and sensitivity of the personal data;
the purposes for which it was collected;
whether we continue to have an ongoing relationship with you;
operational and administrative requirements;
security requirements;
applicable limitation periods; and
legal or regulatory obligations.
Information relating to routine enquiries will generally be retained only for as long as necessary to respond to the enquiry and maintain an appropriate record of our correspondence.
Unless there is an ongoing relationship, legal requirement or other legitimate reason to retain the information for longer, we would normally expect routine enquiry records to be deleted or anonymised within 24 months.
Where you have consented to a particular form of communication, relevant information may be retained until you withdraw your consent or unsubscribe, subject to any limited records we need to retain to record your preference.
Aggregated or anonymised analytics information may be retained for longer where it can no longer reasonably be used to identify an individual.
We periodically review the personal data we hold and delete or anonymise information that is no longer required.
14. How we protect your personal data
We take appropriate technical and organisational measures designed to protect personal data against:
unauthorised access;
accidental loss;
destruction;
misuse;
alteration; and
unauthorised disclosure.
Our security measures are reviewed as appropriate having regard to the nature of the information, the risks involved and developments in technology and cybersecurity.
Access to personal data is restricted where appropriate to individuals and service providers who require access for legitimate purposes.However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.
15. Your data protection rights
Depending on where you are located and the circumstances in which we process your personal data, the EU GDPR, UK GDPR and other applicable data protection laws may give you a number of rights. These may include the following.
Right of access
You may request confirmation of whether we process personal data about you and request access to that data.
Right to rectification
You may ask us to correct personal data that is inaccurate or complete information that is incomplete.
Right to erasure
In certain circumstances, you may ask us to delete personal data we hold about you. This right is sometimes referred to as the “right to be forgotten”.
Right to restriction of processing
In certain circumstances, you may ask us to restrict the way in which we process your personal data.
Right to object
You may have the right to object to certain processing of your personal data, including processing based on legitimate interests.Where personal data is processed for direct marketing purposes, you may object to that processing at any time.
Right to data portability
In certain circumstances, you may request that personal data you have provided to us be supplied to you or another organisation in a structured, commonly used and machine-readable format.
Right to withdraw consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.
Rights relating to automated decision-making
Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.
Right to complain
You have the right to complain to an appropriate data protection supervisory authority if you believe your personal data has been processed in a way that does not comply with applicable law.
These rights are not absolute and may not apply in every circumstance.
We may need to ask you for information reasonably necessary to confirm your identity before acting on a request. We aim to respond to valid data protection requests within the period required by applicable law.
Where permitted by law, that period may be extended for particularly complex or numerous requests, in which case we will inform you.
To exercise your data protection rights, please contact:dpo@stm-assoc.org
16. Complaints and supervisory authorities
If you have concerns about the way we process your personal data, we encourage you to contact us first so that we have an opportunity to address your concerns.
You can contact our Data Protection Officer at:dpo@stm-assoc.org
You also have the right to lodge a complaint with a competent data protection supervisory authority.
Netherlands and European Union
In the Netherlands, the supervisory authority is:
Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
If you are located elsewhere in the European Economic Area, you may also be entitled to contact the data protection supervisory authority in the country where you live or work, or where you believe an infringement has taken place.
United Kingdom
In the United Kingdom, the supervisory authority is:
Information Commissioner's Office (ICO)
You are not required to contact us before exercising your right to complain to a supervisory authority.
17. Children's privacy
The SNSI website and SNSI's activities are primarily intended for professionals and organisations involved in areas including:
scholarly communications;
higher education;
publishing;
libraries;
research;
technology; and
information and cybersecurity.
We do not knowingly seek to collect personal data from children through this website.If we become aware that personal data relating to a child has been collected in circumstances where it should not have been, we will take appropriate steps in accordance with applicable law.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to:
the SNSI website;
the way we process personal data;
our technologies and service providers;
SNSI's activities; or
applicable legal and regulatory requirements.
When we make material changes, we will publish the updated Privacy Policy on the SNSI website and revise the “Last updated” date at the top of this page.
We recommend reviewing this Privacy Policy periodically.
19. Contact us
If you have questions about this Privacy Policy, how SNSI uses your personal data, or you would like to exercise your data protection rights, please contact:
Scholarly Networks Security Initiative (SNSI)
c/o International Association of Scientific, Technical and Medical Publishers (STM)
Head Office:
Prins Willem-Alexanderhof 5
2595 BE The Hague
The Netherlands
UK Office:
Prama House
267 Banbury Road
Oxford OX2 7HT
United Kingdom
Data Protection Officer:
dpo@stm-assoc.org
You may also contact us through the contact form on the SNSI website.