From 100cd9a48f96bf3f0cd8f049e1815c83fa22a2d7 Mon Sep 17 00:00:00 2001 From: Sander Roosendaal Date: Wed, 7 Mar 2018 22:06:27 +0100 Subject: [PATCH] updated legal text on legal page and GDPR opt in page --- rowers/templates/gdpr_optin.html | 177 +++++++++++++++++++++++++++- rowers/templates/legal.html | 190 +++++++++++++++++++++++++------ 2 files changed, 330 insertions(+), 37 deletions(-) diff --git a/rowers/templates/gdpr_optin.html b/rowers/templates/gdpr_optin.html index 532dd59f..939a307f 100644 --- a/rowers/templates/gdpr_optin.html +++ b/rowers/templates/gdpr_optin.html @@ -7,7 +7,6 @@ {% block content %}

GDPR Opt-In

-

To comply with the European Union General Data Protection Regulation, @@ -19,9 +18,183 @@ and remove your account.

+
+ +

Personal information collection

+

+ rowsandall.com may collect and use the following kinds of information: +

+ Explicitly, the following information is collected: + +

- This paragraph will contain the data policy + The site is only accessible to user of 16 years and older. +

+ +

Data Deletion

+ +

All the data mentioned in the previous section are stored in files + and in a database, hosted on our hosting provider's servers. Our + hosting provider is creating backups of those data. The database backups + are retained for 7 days. File backups are retained for 30 days. However, + the file names or content do not contain any links to the users. The + link to the file is stored under the user data in the database, so once + a database entry is removed, there is no way to link a file with data + to a particular user. +

+

+ When a user requests deletion of the data, his account and all data linked to his account + are removed from the database and the files are deleted. This includes all data mentioned in the + previous section. In backups, database entries will be removed after 7 days and files after + 30 days. +

+ +

Data deletion can be initiated by the user through the button on the user settings page.

+ +

Data Security

+ +

The site uses SSL to encrypt data transferred between the server and the client (web browers, + mobile apps, third party sites). Any forms are secured from Cross Site Request Forgery (CSRF) using Django's + CSRF middleware.

+ +

+ We have a double defense against reading or editing of personal data. First, we ensure that all "protected" views + are only visible to logged-in users. Only logged-in users have buttons leading to the private parts of the site. + As a second step, protecting against guessing of URL, before serving data from the database, we check explicitly that the data + is owned by the user in question, redirecting unauthorized requests to a "Permission Denied" page. Private data is collected + through POST requests to prevent them from being visible in URL data. +

+ +

rowsandall.com will take reasonable technical and organisational precautions to prevent the loss, + misuse or alteration of your personal information.

+ +

In case of loss, misuse or alteration of your personal information, we will inform you without undue delay and take measures + to prevent further misuse. In particular, we will deactivate your account, which will not delete the data but make them + inaccessible even for people who obtained the password (including yourself). We will await your instructions. If no + instructions are received within 7 days of contacting you, your account and all your data will be removed. +

+ + +

Data Sharing and access to data

+ +

+ Only the data owner can the site administrator can edit and/or delete the data. Per our data policy, the site administrator will not alter + or delete any data owned by users, unless requested so. As data are not stored on servers that are physically owner by us, or by + our hosting provider, but we use rented server space, we are technically sharing the information to agents or sub-contractors. +

+ +

+ Where rowsandall.com discloses your personal information to its agents or sub-contractors for these purposes, + the agent or sub-contractor in question will be obligated to use that personal information in accordance with the terms of this privacy statement. + Our hosting provider is based in the European Union and is bound by the same GDPR regulation as we are. +

+ +

In addition to the disclosures reasonably necessary for the purposes identified elsewhere above, rowsandall.com + may disclose your personal information to the extent that it is required to do so by law, in connection with + any legal proceedings or prospective legal proceedings, and in order to establish, exercise or defend its legal rights.

+ + +

+ Workout data and charts based on workout data can be shared to anyone by sharing the URL. Workouts have an option to be set to + "private", in which case the data are not visible to anyone except the owner. The site is not searchable for data other than + your own data, so there is no way for other people to track your workouts, unless you share them. +

+ +

+ Cross-border data transfers. Information that rowsandall.com collects may be stored and processed in and transferred + between any of the countries in which rowsandall.com operates to enable the use of the information in accordance with this privacy policy. + In addition, personal information that you submit for publication on the website will be published on the internet and + may be available around the world. + You agree to such cross-border transfers of personal information. +

+ +

+ By accepting an "invitation" to become a member of a team, or by requesting to become part of a team, you agree to automatically + share all your workout data (including workouts done prior to becoming a member of the team) to the team manager (coach) and, + depending to the team policy, to other members of the team. When you leave + a team, all your workout data will immediately become invisible to those who had access to it during your team membership, including + workouts that cover the period of time when you were member of the team. As a member of a team, you grant the team manager + permission to edit workout data + on your behalf, including the creation of charts and cross workout analysis. You also grant the team manager permission to + edit your heart rate and power settings, as well as functional threshold information and the account information accessible on your + settings page under the header "Account Information". The team manager is not able to access or change your passwords, team memberships, + favorite charts, export settings, workflow layout, or secret tokens. Also, the team manager is not able to download all your data, + not can he deactivate or delete your account. +

+ +

+ This site offers the possiblity to synchronize your data with other fitness sites. By clicking on the share or connect button (link, or + equivalent) you agree to share information between rowsandall.com and the other website. Rowsandall.com is not responsible for the privacy + policies or practices of any third party. +

+ +

Data portability

+ +

Through the "download your data" link on the user settings page, each user can download all workout data. Stroke data can be downloaded + through links in the downloaded workout data file.

+ +
+ +

+ To start or continue using the site, please give your consent by clicking on the green Opt In button below.

diff --git a/rowers/templates/legal.html b/rowers/templates/legal.html index 37951f1b..6a4b3d35 100644 --- a/rowers/templates/legal.html +++ b/rowers/templates/legal.html @@ -159,61 +159,181 @@

Credit

This document was created using a Contractology template available at -http://www.freenetlaw.com..

+http://www.freenetlaw.com.. It was modified to reflect the GDPR requirements.

-

Personal information collection

-

rowsandall.com may collect and use the following kinds of information: -

+

Personal information collection

+

+ rowsandall.com may collect and use the following kinds of information: +

+ Explicitly, the following information is collected: + +

-

Using personal information

+

+ The site is only accessible to user of 16 years and older. +

-

rowsandall.com may use your personal information to: -

+

Data Deletion

-

Where rowsandall.com discloses your personal information to its agents or sub-contractors for these purposes, the agent or sub-contractor in question will be obligated to use that personal information in accordance with the terms of this privacy statement.

+

All the data mentioned in the previous section are stored in files + and in a database, hosted on our hosting provider's servers. Our + hosting provider is creating backups of those data. The database backups + are retained for 7 days. File backups are retained for 30 days. However, + the file names or content do not contain any links to the users. The + link to the file is stored under the user data in the database, so once + a database entry is removed, there is no way to link a file with data + to a particular user. +

+

+ When a user requests deletion of the data, his account and all data linked to his account + are removed from the database and the files are deleted. This includes all data mentioned in the + previous section. In backups, database entries will be removed after 7 days and files after + 30 days. +

-

In addition to the disclosures reasonably necessary for the purposes identified elsewhere above, rowsandall.com may disclose your personal information to the extent that it is required to do so by law, in connection with any legal proceedings or prospective legal proceedings, and in order to establish, exercise or defend its legal rights.

+

Data deletion can be initiated by the user through the button on the user settings page.

-

Securing your data

+

Data Security

-

rowsandall.com will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

+

The site uses SSL to encrypt data transferred between the server and the client (web browers, + mobile apps, third party sites). Any forms are secured from Cross Site Request Forgery (CSRF) using Django's + CSRF middleware.

-

rowsandall.com will store all the personal information you provide

+

+ We have a double defense against reading or editing of personal data. First, we ensure that all "protected" views + are only visible to logged-in users. Only logged-in users have buttons leading to the private parts of the site. + As a second step, protecting against guessing of URL, before serving data from the database, we check explicitly that the data + is owned by the user in question, redirecting unauthorized requests to a "Permission Denied" page. Private data is collected + through POST requests to prevent them from being visible in URL data. +

-

Cross-border data transfers

+

rowsandall.com will take reasonable technical and organisational precautions to prevent the loss, + misuse or alteration of your personal information.

-

Information that rowsandall.com collects may be stored and processed in and transferred between any of the countries in which rowsandall.com operates to enable the use of the information in accordance with this privacy policy.

+

In case of loss, misuse or alteration of your personal information, we will inform you without undue delay and take measures + to prevent further misuse. In particular, we will deactivate your account, which will not delete the data but make them + inaccessible even for people who obtained the password (including yourself). We will await your instructions. If no + instructions are received within 7 days of contacting you, your account and all your data will be removed. +

-

In addition, personal information that you submit for publication on the website will be published on the internet and may be available around the world.

-

You agree to such cross-border transfers of personal information.

+

Data Sharing and access to data

-

Updating this statement

+

+ Only the data owner can the site administrator can edit and/or delete the data. Per our data policy, the site administrator will not alter + or delete any data owned by users, unless requested so. As data are not stored on servers that are physically owner by us, or by + our hosting provider, but we use rented server space, we are technically sharing the information to agents or sub-contractors. +

-

rowsandall.com may update this privacy policy by posting a new version on this website.

+

+ Where rowsandall.com discloses your personal information to its agents or sub-contractors for these purposes, + the agent or sub-contractor in question will be obligated to use that personal information in accordance with the terms of this privacy statement. + Our hosting provider is based in the European Union and is bound by the same GDPR regulation as we are. +

-

You should check this page occasionally to ensure you are familiar with any changes.

+

In addition to the disclosures reasonably necessary for the purposes identified elsewhere above, rowsandall.com + may disclose your personal information to the extent that it is required to do so by law, in connection with + any legal proceedings or prospective legal proceedings, and in order to establish, exercise or defend its legal rights.

-

Other websites

+ +

+ Workout data and charts based on workout data can be shared to anyone by sharing the URL. Workouts have an option to be set to + "private", in which case the data are not visible to anyone except the owner. The site is not searchable for data other than + your own data, so there is no way for other people to track your workouts, unless you share them. +

-

This website connects to other websites. By clicking the connect button (link, or equivalent) you agree to share information between rowsandall.com and the other website.

+

+ Cross-border data transfers. Information that rowsandall.com collects may be stored and processed in and transferred + between any of the countries in which rowsandall.com operates to enable the use of the information in accordance with this privacy policy. + In addition, personal information that you submit for publication on the website will be published on the internet and + may be available around the world. + You agree to such cross-border transfers of personal information. +

+ +

+ By accepting an "invitation" to become a member of a team, or by requesting to become part of a team, you agree to automatically + share all your workout data (including workouts done prior to becoming a member of the team) to the team manager (coach) and, + depending to the team policy, to other members of the team. When you leave + a team, all your workout data will immediately become invisible to those who had access to it during your team membership, including + workouts that cover the period of time when you were member of the team. As a member of a team, you grant the team manager + permission to edit workout data + on your behalf, including the creation of charts and cross workout analysis. You also grant the team manager permission to + edit your heart rate and power settings, as well as functional threshold information and the account information accessible on your + settings page under the header "Account Information". The team manager is not able to access or change your passwords, team memberships, + favorite charts, export settings, workflow layout, or secret tokens. Also, the team manager is not able to download all your data, + not can he deactivate or delete your account. +

+ +

+ This site offers the possiblity to synchronize your data with other fitness sites. By clicking on the share or connect button (link, or + equivalent) you agree to share information between rowsandall.com and the other website. Rowsandall.com is not responsible for the privacy + policies or practices of any third party. +

-

rowsandall.com is not responsible for the privacy policies or practices of any third party.

+

Data portability

+ +

Through the "download your data" link on the user settings page, each user can download all workout data. Stroke data can be downloaded + through links in the downloaded workout data file.

- {% endblock content %} \ No newline at end of file + {% endblock content %}