Effective date: 3 November 2026
Controller: Gordon Institute Limited
Authoritative policy: https://economy.ac/privacy-policy

This Privacy Policy explains how The Economy, operated by Gordon Institute Limited ("we", "our", "us" or the "Institution"), collects, obtains, uses, discloses, protects and retains personal data in connection with its journalism, research, rankings, Wiki, publications, institutional correspondence and online services. It also explains how individuals can exercise data protection rights and how formal correction requests, ranking challenges and other submissions are handled from a privacy perspective.

Our work combines public editorial material with private administrative records. A published article or ranking is not the same thing as a private request file. We preserve this distinction throughout our processes, including when someone disputes an assessment, submits evidence or requests removal of personal information.

1. Identity of the controller and privacy contact

• Legal entity and data controller: Gordon Institute Limited.
• Service: The Economy, including its relevant editorial and research services and The Economy Portal.
• Registered address: 60 Merrion Square South, Dublin 2, Co. Dublin, D02 HE24, Ireland.
• Data Protection Officer: David O’Neill, [email protected].

Questions about the use of personal information, access, rectification, erasure, objections, cookie-related concerns, security incidents involving your data or other privacy rights should be directed to [email protected]. A privacy complaint is distinct from a challenge to an editorial conclusion or ranking position; both routes are described below. The contact details above are the designated point of contact for privacy and data protection matters concerning this service.

2. Services and sites covered

This policy covers our operation of economy.ac and relevant first-party services and subdomains, including editorial and research sections, regional language editions, The Economy Rankings, The Economy Wiki, and The Economy Portal at https://portal.economy.ac. Regional editions include, where operated, ar.economy.ac, jp.economy.ac and kr.economy.ac. Official email and notification subdomains used to support these services are also within scope.

The Portal provides or is being developed to provide formal channels for Wiki updates and new-page requests, ranking reviews and challenges, editorial contributions, research enquiries, newsletter registration and preferences, licensing and purchase enquiries, and correspondence about existing requests. A feature labelled "Being prepared" is not an active submission channel until enabled. This policy applies to data actually received or processed when a particular service is available; it does not mean every listed service is currently operating.

A service under a different legal entity or an independently administered forum, school, employment or learning platform may have its own privacy notice. Links to other organizations within the wider institutional network do not automatically bring their unrelated services within this policy. If a specific transaction or service supplies a more detailed privacy notice, read that notice together with this policy for the activity concerned.

3. Categories of personal data

We collect information according to the purpose of the interaction. Not every category is collected from every visitor.

3.1 Website, device and operational information

Our websites and infrastructure may process IP addresses (including full IP addresses for security logs), browser and device information, request times, referring pages, approximate location derived from an IP address, pages visited, cookies, session identifiers, error reports, anti-abuse signals and records of requests made to the service. Data used for aggregated analytics may be truncated, pseudonymized or aggregated, but not all operational information is anonymous at collection.

3.2 Portal submissions and case files

When someone submits a Wiki request, a ranking review or challenge, a correction, an article, a research enquiry or another available form, we may collect their name, business email, role, organizational affiliation, organization website, relevant page or ranking URL, requested changes, reasons, text, source links, article drafts, author biographies, correspondence and supporting evidence. Where uploads are available, files may contain additional information voluntarily supplied by the sender or about third parties.

We may also keep case identifiers, submission timestamps, email confirmation and secure-link events, affiliation-verification information, staff assignments, internal assessment notes, requests for clarification, review status, decisions, reasons, subsequent changes and records needed to explain how a decision was reached. We do not assume that a sender is authorized to speak for an organization merely because a request has been received.

3.3 Public, editorial and professional information

For reporting, research, institutional profiles, Wiki entries and rankings, we may use the names, positions, affiliations, professional contact details, career histories, public statements and other relevant professional information of executives, academics, experts, contributors and public figures. Sources may include institutional websites, annual reports, official registers, scholarly and professional publications, authorized interviews, media coverage, submissions, publicly available records and reputable professional-contact data services. Information that is publicly available can still be personal data.

3.4 Newsletters, institutional correspondence and email records

We may process email addresses, names, organizations, ranking-family or newsletter selections, consent and confirmation records, subscription changes, unsubscribes, suppression records, delivery failures and available email engagement events (such as opens and link clicks, when enabled by an email provider). We also maintain records of one-to-one editorial correspondence, ranking notifications, institutional introductions, event invitations and service enquiries, subject to applicable electronic-marketing rules.

3.5 Licensing, purchases and accounts where offered

If a license, recognition asset, sponsorship, other commercial service or authenticated account feature is made available, we may process the customer or representative's name, company, business contacts, license or order identifiers, contracts, billing and invoicing details, transaction status, correspondence and related service records. Payment processing may be performed through a specialist provider under its own notice. We do not request payment-card credentials in Wiki, ranking-review or contributor forms.

3.6 Special categories and third-party information

We do not ask Portal users to provide medical, biometric, political, religious or similarly sensitive personal information as routine evidence. Do not submit such information, personal identity documents or unrelated information about third parties unless genuinely necessary and legally appropriate. Where sensitive data is lawfully processed for a particular journalistic or research purpose, we assess necessity, the applicable legal basis, safeguards and any relevant statutory protections rather than treating public availability as automatic permission.

4. How and where information is obtained

We receive information directly from people who complete Portal forms, confirm an email, contact an editor, subscribe, participate in an interview or purchase a service. We obtain other information from public and licensed professional sources, named sources, institutional records, research documents and credible third parties. Technical information may arise from the visitor's connection, our hosting and security infrastructure, browser features, cookies or contracted service providers.

When third-party or public information is incorporated into editorial work, informing every person individually may not always be practicable or legally required. We assess transparency duties and any lawful exceptions in context, including protections for legitimate journalistic activity. Individuals can raise concerns through the privacy contact or the editorial correction channel, as appropriate.

5. Purposes of processing and lawful grounds

We use personal data for specific activities; the applicable ground depends on the facts and relevant law. Under the EU General Data Protection Regulation, these may include:

• Legitimate interests — operating and securing services: maintaining the websites and Portal, answering enquiries, confirming organizational affiliation, preventing impersonation or malicious submissions, detecting abuse, keeping proportionate case histories and protecting the credibility of institutional services, subject to the rights and interests of affected individuals.
• Legitimate interests — research and editorial administration: gathering professional evidence, checking accuracy, contacting relevant organizations and sources, responding to requests and maintaining an auditable editorial and rankings record where the balancing of interests supports the activity.
• Contract or steps requested before a contract: processing a particular licensing enquiry, preparing an order, providing an agreed publication-related service or fulfilling contractual customer obligations where applicable.
• Legal obligation: keeping legally required business and financial records, responding to binding orders, complying with data protection duties or satisfying other relevant statutory obligations.
• Consent: managing voluntary newsletter choices and other activities where consent is required, including non-essential cookies or electronic marketing that requires opt-in. Consent may be withdrawn without affecting earlier lawful processing.
• Journalistic and freedom-of-expression protections: where we process information to exercise rights of freedom of expression and information, relevant protections, including section 43 of Ireland's Data Protection Act 2018, may apply to the extent justified by law. They do not automatically exempt all of our business or Portal operations.

A public-interest editorial objective does not, by itself, mean every processing operation relies on the GDPR's public-task lawful basis. We assess the appropriate Article 6 ground separately from any applicable journalism-related exemptions.

6. Formal corrections, Wiki requests and ranking challenges

The Portal provides designated routes for requests concerning an organization's Wiki profile, a ranking entry or recognition, factual corrections and supporting evidence. Relevant channels include https://portal.economy.ac/portal/wiki and https://portal.economy.ac/portal/rankings?tab=review, to the extent the requested functions are enabled. Submissions may be checked for mailbox control, identity or authority to represent an organization, relevance, completeness and the reliability of supporting sources.

Receiving or recording a request does not guarantee publication, removal, re-ranking, a particular editorial outcome or an unlimited right of access to the editorial working file. We may seek clarification, check competing evidence, consult the relevant editorial or research staff, correct an established error, update a profile, add contextual material, decline an inadequately supported change or retain an accurate historical record. Our internal request record may include the evidence reviewed and the reasons for a decision.

Editorial review decisions are made independently of badge purchases, licenses, sponsored interviews, advertising or other commercial relationships. A purchase, a request for quotation or a commercial relationship does not entitle the purchaser to alter a ranking, suppress legitimate reporting or bypass an evidence-based review.

A submitted correction or complaint is generally handled as private correspondence, not automatically published as the sender's own statement. However, our eventual public article, Wiki entry or ranking may reflect verified information and our independent editorial findings. We may preserve confidential source material or third-party details where disclosure would be inappropriate or unlawful. Requests involving personal data rights are assessed under the relevant privacy law even where an editorial request is also pending.

7. Contributor submissions, authorship and editorial records

Where the contributions channel is available at https://portal.economy.ac/portal/contributions, contributors may provide manuscripts, proposals, sources, biographies, affiliations and contact information. We process them to assess suitability, communicate with the author, verify originality and authority, prepare possible editorial revisions and document publication decisions. We may retain correspondence and decision history whether a submission is published, revised or declined, subject to the retention criteria below.

Submitting work does not automatically publish it, confer editorial affiliation, transfer intellectual-property rights beyond separately agreed terms, or subscribe the contributor to a marketing newsletter. An author biography or attribution may be published as part of an accepted article where agreed or otherwise lawfully justified. We do not treat material supplied in confidence as a general public submission merely because it was uploaded to the Portal.

8. Email verification, private request access and accounts

The standard public submission channels are designed to operate without automatically creating an internal ERP or website user account. We may email a confirmation or time-limited access link to verify the sender's mailbox and permit follow-up on an individual private request. We may record confirmation and access events to protect the case against unauthorized access or fraudulent changes.

Access links are confidential: recipients should not forward them. Possession of a link does not establish legal authority to represent an organization, and we may request additional verification where a request affects organizational claims, personal information, confidential evidence or commercially sensitive material. An expired link may require a new confirmation. If a separate registered account is introduced for a particular service, its additional data processing will be disclosed when relevant.

9. Newsletters, ranking briefings and direct communications

The Economy may offer editorial newsletters, ranking-family briefings and other subscriptions. Choosing a newsletter is separate from submitting an editorial or Wiki request. A submission does not automatically opt the sender into marketing emails. Newsletter registration and preference changes use a separate email-confirmed process, including where available https://portal.economy.ac/portal/subscriptions. Recipients can change their selections or unsubscribe through the mechanism provided in the relevant messages or service.

We may also contact professional representatives about reporting, fact-checking, research, ranking notifications or an existing institutional relationship. We distinguish those communications from promotional electronic marketing and assess both data protection and applicable ePrivacy rules. Where marketing consent is legally required, we do not treat the existence of a public business email address, a ranking listing or a submitted correction as consent. Objections to direct marketing and unsubscribes are recorded and respected; a limited suppression entry may be kept to prevent accidental future contact.

Email infrastructure may supply delivery, bounce, spam-complaint, open and link-interaction events. We use such records for mailing operations, security, unsubscribe management and aggregate reporting where lawful. Unsubscribing from optional newsletters does not by itself delete records of editorial cases, invoices, legal duties or essential correspondence about a service the person has separately requested.

10. Cookies, analytics and site security

Our websites and Portal may use necessary cookies and session technologies to operate forms, protect against cross-site request forgery or other abuse, provide secure temporary access, process email-confirmed preferences, maintain requested sessions and balance traffic. Such technologies may be used where they are strictly necessary for a service requested by the visitor.

We also use or may use analytics tools, including Google Analytics, to understand traffic, use of content and technical performance. Analytics may involve identifiers, pseudonymous events and IP-derived information, even when settings reduce identification. Non-essential analytics cookies are distinct from strictly necessary session cookies and are subject to prior consent where required by applicable law. Browser controls alone are not a substitute for a valid consent mechanism where the law requires one. Users should be able to change or withdraw applicable cookie consent through the controls actually provided on the service.

Our infrastructure may use Cloudflare or comparable technical providers for content delivery, traffic management, threat detection and protection against automated abuse. Security systems may process IP addresses, request attributes and limited device information for these purposes. We do not sell browsing histories to advertising networks or data brokers. If we introduce materially different advertising or tracking technologies, we will provide the relevant notice and choices.

11. Supporting documents, malware controls and confidential material

Where a Portal workflow permits file uploads, we may receive documents and images used as evidence. Supporting files are treated as material for the specific submission, not as permission to republish their entire contents. The Portal's current design includes a locally operated antivirus check of uploaded files before acceptance. Antivirus screening is a security measure, not a guarantee that every attachment is harmless.

Authorized staff may examine submitted materials to verify authenticity, evaluate facts and document decisions. We may reject files containing malware, abusive content, unrelated private information or material that cannot lawfully be processed. Senders should minimize personal information, remove unnecessary identifiers and ensure that they have authority to provide third-party material. We may share necessary excerpts internally or with appropriate professional advisers where justified; we do not routinely publish confidential supporting files.

12. Limited use of external AI-assisted drafting tools

For some editorial or administrative tasks, authorized staff may choose to use a configured external AI drafting service to help organize or draft text. In such cases, selected request text, source links, correspondence excerpts or draft language may be transmitted to and processed by that service provider. Use of the drafting tool is selective, not an automatic consequence of every Portal submission.

Under the Portal workflow described in our current operational guide, uploaded supporting files are not automatically sent to the external AI drafting service. We limit transmitted material according to the task, applicable agreements and data protection requirements. Staff are responsible for reviewing generated text, checking sources and making editorial or institutional decisions. AI-generated drafts do not automatically approve corrections, decide rankings or determine legal rights. Any material change in provider practices or automated decision-making will be reviewed and disclosed where required.

13. Service providers, recipients and disclosures

We use service providers or internal administrative systems for website hosting, content delivery, network security, analytics, ERP/Portal case management, email delivery, newsletters, business correspondence, optional drafting assistance and, where applicable, billing and payment administration. Examples of services presently used or identified in our operating environment include Cloudflare, Google Analytics, Mailgun for some email delivery, and Microsoft 365 for certain staff correspondence. Particular services may differ by regional edition or activity.

Access to identifiable case materials is limited according to responsibilities. Relevant employees, editorial reviewers, institutional representatives and contracted service providers may process information where necessary to perform their roles. We may also disclose information to professional advisers, auditors, law enforcement or regulators where a lawful basis requires or permits it, and in connection with establishing or defending legal claims.

We do not sell personal data to data brokers, and we do not provide confidential Portal case files to advertisers for independent marketing. We do not promise that every technology provider is located in the same country or acts in an identical legal role; individual providers may be processors, independent controllers or both for different activities, as their services and terms require. Further details about relevant providers and safeguards can be requested from our privacy contact.

14. International hosting, access and data transfers

Our digital services have a distributed operational footprint. Depending on the website, administrative function and provider, data may be accessed or processed in Ireland and other European locations, Switzerland, the Republic of Korea, the United Arab Emirates, and locations used by contracted providers. This may include international access to Portal records and editorial correspondence. The exact location may vary by system and service.

For transfers subject to EU or other applicable international-transfer rules, we assess the destination, recipient and applicable transfer mechanism. Switzerland and the Republic of Korea benefit from EU adequacy decisions. Transfers to other locations, including the United Arab Emirates, require assessment of the applicable legal mechanism and, where needed, contractual safeguards such as the European Commission's standard contractual clauses and supplementary measures. We do not imply that an adequacy decision applies to every country or every provider. You may request information about the actual safeguards relevant to your data at [email protected].

15. Retention, editorial archives and case closure

We retain identifiable information only for the period or purposes justified by the activity, subject to statutory obligations and legitimate record-keeping needs. In particular:

• Editorial publications and supporting research: published material and the evidence needed to preserve accuracy, attribution, accountability and a coherent historical record may be kept for the life of the archive, subject to legal requirements and case-by-case review.
• Wiki, ranking and correction case files: requests, supporting sources, review notes, confirmation records and decisions are retained for handling and follow-up, maintaining a defensible editorial history, addressing repeated or related challenges, protecting against abuse and resolving legal issues. Closing a case does not automatically erase it. Unnecessary personal details may be removed or restricted while necessary evidence is preserved.
• Contributor and correspondence records: retained for editorial assessment, publication administration, contributor relations and the documented history of the interaction, with periodic review of their continuing need.
• Newsletters: active preferences are kept while the subscription remains active; confirmation and withdrawal records, and limited suppression identifiers after an unsubscribe, may be retained as necessary to demonstrate the choice and avoid unwanted future emails.
• Commercial records: invoices, agreements, licensing records and related communications are retained according to applicable accounting, tax, contractual and dispute-resolution requirements.
• Technical and security records: retained under rolling operational schedules or longer when needed to investigate abuse, incidents or legal claims; aggregate reports may be retained after underlying identifiers have been removed.

The criteria above reflect the different life cycles of publication, correspondence and administrative records; they are not an assertion that all data is kept indefinitely. Where an exact retention period is required by law or system-specific notice, that period will be given. We review the necessity of identifiable data and delete, restrict or anonymize it where appropriate and lawful.

16. Security and incident management

We apply technical and organizational controls appropriate to the sensitivity and use of the information, including access restrictions, secure connections, operational logging, network protections, controlled administrative access, secure email confirmation, local screening of supported file uploads and procedures for handling suspicious requests. Not every submission is visible to every editor, and a public ranking or Wiki page should not expose the contents of its related private case file.

No online system is risk-free. We investigate suspected incidents, take proportionate containment measures and make notifications to authorities or affected individuals when applicable law requires them. Individuals who suspect their private request link has been exposed or their information has been misused should contact [email protected] promptly.

17. Rights of individuals and how to exercise them

Subject to the law applicable to a person and the relevant processing, rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to certain solely automated decisions. You may object at any time to processing for direct marketing. To exercise a privacy right, contact [email protected], identifying the service, relevant information and nature of the request. We may verify identity or authority before disclosing protected information.

For requests governed by the GDPR, we normally respond without undue delay and within one month. Where legally permitted because of complexity or volume, we may extend by up to two additional months and will explain the extension within the initial month. If we cannot grant a request in full, we will explain the lawful basis for that outcome and the available complaint route, subject to valid exceptions.

A privacy right and an editorial disagreement are different matters. Requests to rectify personal data are assessed under applicable law; a demand to change an independent ranking judgment or editorial opinion is not automatically a personal-data correction request. Conversely, we do not treat every complaint about a published article as outside privacy law merely because it relates to journalism. We apply relevant protections for journalism, expression and third-party rights only when they are justified in the circumstances.

18. Complaints, editorial review and independent oversight

For a Wiki update, a ranking review, a factual correction or a submitted article, use the relevant channel on https://portal.economy.ac/ when enabled. This supports structured evidence, email confirmation, case follow-up and a record of editorial handling. Submission does not promise a favorable finding, publication or a particular timeline for an editorial decision. For a privacy complaint or exercise of a legal data right, contact [email protected]; you do not need to buy a license, subscribe or maintain an account to do so.

Where the GDPR applies, individuals may lodge a complaint with a competent supervisory authority. For the Irish controller, the Data Protection Commission (Ireland) is an applicable supervisory authority: https://www.dataprotection.ie/. Depending on the circumstances, a person may also have the right to complain to an authority in the EU member state of habitual residence, employment or alleged infringement, and to seek an available judicial remedy. We encourage users to contact us first if they wish, but contacting us is not a condition of making a regulatory complaint.

19. California and other jurisdiction-specific rights

Residents of California and other jurisdictions may have additional statutory rights where the relevant law applies to our organization and the specific processing. These may include rights to know or access certain information, correct it, request deletion, receive information about disclosures, opt out of applicable sale or sharing, and avoid unlawful discrimination for exercising rights. We do not claim that every consumer privacy law applies to every visitor or service. Our position remains that we do not sell personal information to data brokers or advertising networks.

Requests can be directed to [email protected]. We evaluate the person's location, the applicable legal definitions and thresholds, the nature of the data and any lawful exception before determining the required response.

20. Children and third-party material

Our principal news, research, rankings and professional Portal services are directed to a general and professional audience, not designed to solicit personal information from children. People submitting requests on behalf of an organization or another person should have an appropriate basis to do so and should avoid uploading unrelated information about minors or other third parties. If we discover unnecessary personal data about a child in a Portal case, we assess appropriate removal, restriction or other protective action.

21. Changes to this policy

We may revise this policy when our services, Portal functions, processors, transfer arrangements, law or information practices materially change. The current version and its effective date will be published at https://economy.ac/privacy-policy. Material changes may also be communicated through the relevant service or direct notice where required. An updated policy does not retrospectively authorize processing that lacked a lawful basis when it occurred.

22. Contact and primary service routes

Privacy and data protection: David O’Neill, Data Protection Officer, Gordon Institute Limited, [email protected].
Registered address: 60 Merrion Square South, Dublin 2, Co. Dublin, D02 HE24, Ireland.
Privacy policy: https://economy.ac/privacy-policy
Portal and case access: https://portal.economy.ac/
Wiki requests: https://portal.economy.ac/portal/wiki
Ranking reviews and challenges: https://portal.economy.ac/portal/rankings?tab=review
Contributor submissions: https://portal.economy.ac/portal/contributions
Newsletter preferences: https://portal.economy.ac/portal/subscriptions

The privacy contact handles personal-data rights and concerns; the relevant editorial or service channel handles the substance of a Wiki, ranking or publication request. If the two issues overlap, they may be reviewed in parallel under their respective rules.