Home / Privacy Policy
What we collect, why, and the rights you keep - across the marketing site, AMS, and the publishing platform.
Last updated: 8 August 2026
This policy explains how Technology Fist handles personal data across techfist.org, ams.techfist.org, and publish.techfist.org. The data controller is Technology Fist, a business operating and existing under the laws of Pakistan, located at House # 5, Street # 153, G-13/4, Islamabad, Pakistan (FBR Registration No. 3310010993532; FBR Reference No. (NTN) 8212392-0). For any question about this policy or about data we hold, or to exercise the rights set out in section 7, write to info@techfist.org or telephone +92 317 5615096.
Account data (name, email, affiliation, ORCID if you provide it); submission data (papers, reviews, editorial correspondence); payment records (amount, method, status - card details themselves are handled by our payment processors and never stored on our servers); and technical data needed to run the service (log entries, session cookies).
Running peer review and publication (our contract with you); sending service emails such as decisions, proofs, and receipts; meeting legal and accounting obligations; and protecting the platform against abuse. Published papers include the author names and affiliations you approve at proofing - that is the point of publishing.
Some venues use capabilities that are not part of the standard platform and are enabled individually. Where they are in use, the following also applies.
Reviewer Network. Appearing in the platform-wide reviewer pool is opt-in: you are listed only if you turn on "open to reviewing" and your profile is public. While listed, chairs and editors of participating venues can see your name, affiliation, ORCID, declared research interests, your review service record (how many reviews you have completed, across how many venues, and how promptly), your declared annual capacity and your current load. You can change that capacity, pause yourself, or leave at any time, and any invitation can be declined without giving a reason.
Portable peer review. A review is shared with another venue only if the reviewer who wrote it explicitly consents, per review. The reviewer also chooses whether their identity is disclosed or the review travels anonymously, and can withdraw consent later. Confidential comments written to a chair or editor are never shared. Authors choose whether to create a passport at all and can revoke it.
Event registration and certificates. If you register for an event, we hold the details you provide (name, email, affiliation, country) and, if you attend, a check-in record; the venue is the controller of that data. A certificate issued to you carries a verification code, and anyone holding that code can see your name, the venue, the certificate type and its date on a public verification page. That is the purpose of the code — it lets a third party confirm the certificate is genuine — and nothing further is exposed by it.
We use cookies to keep you signed in and remember preferences. The consent notice on your first visit records your choice. We do not run third-party advertising or tracking cookies on our sites.
We share data only with: PCI-DSS-certified payment processors (to take payment - e.g. Paddle and 2Checkout (Verifone); card details go directly to them and never touch our servers), DOI registration agencies (published-paper metadata - title, authors, affiliation - which is public by design), and infrastructure providers under contract. We do not sell personal data.
Technology Fist operates from Pakistan, and the platform is hosted on servers contracted to us. Pakistan is not the subject of an adequacy decision by the European Commission or the UK government. Where we handle the personal data of people in the EEA or the UK, that data is therefore transferred outside those areas.
We rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where the UK GDPR applies) as the safeguard for those transfers, together with the technical measures described in the security section below. Institutions carrying out their own transfer risk assessment can request our current documentation at info@techfist.org, and we will provide it.
The scholarly record is permanent: published papers, their metadata, and the editorial record behind them are retained indefinitely. Account data is kept while your account is active and for the period required by law after closure. Payment records are kept for statutory accounting periods.
You may request access to, correction of, or deletion of your personal data (deletion cannot apply to the published scholarly record, where correction and retraction processes apply instead). Write to info@techfist.org; we respond within 30 days. If you are in a jurisdiction with a data-protection authority, you also have the right to complain to it.
Access to personal data is role-restricted, transport is encrypted (HTTPS), passwords are stored hashed, and personal links (such as proof approvals) use hashed one-time tokens.