Disroot/Disroot-Privacy-Policy
9
0
Fork 1
Code Pull requests 1 Releases Activity

adjustment for better viewing in website repo #29

Merged
fede merged 1 commit from adjustment2 into Privacy_Statement_Draft 2020-03-04 20:52:22 +01:00
Conversation 0 Commits 1 Files changed 1 +65 -148
1 changed files with 65 additions and 148 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

211
privacy_policy.md
View file

@ -1,359 +1,275 @@
--- ---
title: Privacy Statement title: Privacy Statement
bgcolor: '#1F5C60' bgcolor: '#FFF'
fontcolor: '#FFF' fontcolor: '#1F5C60'
section_id: privacy
text_align: left
--- ---
**Version 1.2 - February 2020** # Privacy Statement
<br><br>
# Table of Contents <br>
### About this document <a name="about"></a>
### Definitions used on this Privacy Policy
### The Data covered by this Privacy Statement
### 1. What data do we collect?
- 1.1. What do we do with your data?
- 1.2. How do we store your data?
### 2. What we do not do with your data
### 3. Where the data is stored?
### 4. Detailed privacy notices per services
- 4.1. Email
- 4.2. Cloud
- 4.3. XMPP Chat
- 4.4. Search
- 4.5. Upload
- 4.6. Pads
- 4.7. Polls
- 4.8. Bin
- 4.9. Forum
- 4.10. Project Board
- 4.11. Calls
- 4.12. Social
- 4.13. GIT
### 5. Your rights
- 5.1. Access to your information
### 6. Changes on this Privacy Statement
----
## About this document ## About this document
This document has been originally written in English and is the only version for which **Stichting Disroot.org** can be held accountable.<br> This document has been originally written in English and is the only version for which **Stichting Disroot.org** can be held accountable.<br>
Any translation of this **Privacy Statement** is a community effort to make the information accessible in other languages and should be taken as such, with no other value than merely informative. Any translation of this **Privacy Statement** is a community effort to make the information accessible in other languages and should be taken as such, with no other value than merely informative.
<br> <br>
<a name="definitions"></a>
## Definitions used on this Privacy Statement ## Definitions used on this Privacy Statement
- **GDPR**: General Data Protection Regulation, [EU 2016/679](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1580499932731&uri=CELEX:32016R0679) - **GDPR**: General Data Protection Regulation, [EU 2016/679](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1580499932731&uri=CELEX:32016R0679)
- **Data**: According to the **GDPR**, data is any information that can be used to identify a person, either directly (real name, phone number, IP address, etc.) or indirectly (any combination of the aforementioned plus device fingerprints, cookies, etc.). In the specific context of the use of our platform, it is the minimum information required for the proper operation of the services provided by **Disroot.org** as well as the information the user optionally submits on any of them. - **Data**: According to the **GDPR**, data is any information that can be used to identify a person, either directly (real name, phone number, IP address, etc.) or indirectly (any combination of the aforementioned plus device fingerprints, cookies, etc.). In the specific context of the use of our platform, it is the minimum information required for the proper operation of the services provided by **Disroot.org** as well as the information the user optionally submits on any of them.
- **Services**: the set of different softwares, protocols and standards used to exchange data between web applications. - **Services**: the set of different softwares, protocols and standards used to exchange data between web applications.
- **User** or **you**: any person or third party that access and uses the services provided by **Disroot.org**. - **User** or **you**: any person or third party that access and uses the services provided by **Disroot.org**.
- **Disroot, Disroot.org, we** or **us**: Stichting Disroot.org - **Disroot, Disroot.org, we** or **us**: Stichting Disroot.org
- **Platform**: the set of services provided by **Disroot.org** and that are hosted on our servers. - **Platform**: the set of services provided by **Disroot.org** and that are hosted on our servers.
- **Disroot credentials**: they are the username and password created and used by the user to log in to the services provided by us. - **Disroot credentials**: they are the username and password created and used by the user to log in to the services provided by us.
- **Federated services**: services that operate on the basis of so-called **federation protocols** which enable users who signed up at different services providers to interact with each other. Examples of these services are **Nextcloud**, **Email**, **Diaspora\***, **Hubzilla** and **XMPP**. - **Federated services**: services that operate on the basis of so-called **federation protocols** which enable users who signed up at different services providers to interact with each other. Examples of these services are **Nextcloud**, **Email**, **Diaspora\***, **Hubzilla** and **XMPP**.
- **Brute-force attack**: is a cryptographic attack that consists of submitting many passwords or passphrases, hoping to eventually find the right ones. - **Brute-force attack**: is a cryptographic attack that consists of submitting many passwords or passphrases, hoping to eventually find the right ones.
<br>
<a name="coverage"></a>
## The Data covered by this Privacy Statement ## The Data covered by this Privacy Statement
This **Privacy Statement** applies to all services hosted on **Disroot.org** and its sub-domains. It does not extend to any websites or web services that can be accessed from our platform including, but not limited to, any federated services and social media websites outside **Disroot**. Federated services are those that interoperate with each other (exchanging information and services) regardless of the provider (e.g. mail or open social networks). These services use protocols that necessarily share or transfer data between different providers and therefore such interactions are outside the scope of this Privacy Statement.<br> This **Privacy Statement** applies to all services hosted on **Disroot.org** and its sub-domains. It does not extend to any websites or web services that can be accessed from our platform including, but not limited to, any federated services and social media websites outside **Disroot**. Federated services are those that interoperate with each other (exchanging information and services) regardless of the provider (e.g. mail or open social networks). These services use protocols that necessarily share or transfer data between different providers and therefore such interactions are outside the scope of this Privacy Statement.<br>
It is important to note that **sharing data with other services providers is a user’s choice** (see [1. What data do we collect?](#data_we_collect)) and is configured by the users in their services settings, including the decision what to share and with whom. It is important to note that **sharing data with other services providers is a user’s choice** (see [1. What data do we collect?](#data_we_collect)) and is configured by the users in their services settings, including the decision what to share and with whom.
<br>
<a name="data_we_collect"></a>
---
# 1. What data do we collect? # 1. What data do we collect?
If a user chooses to use any of the services provided by us, the following data will be required and therefore collected by **Disroot.org**: If a user chooses to use any of the services provided by us, the following data will be required and therefore collected by **Disroot.org**:
- A valid email address: required for account creation. This email address is deleted from our database after the account has been approved/denied, unless the user chooses during the registration process, to keep it for password reset process. - A valid email address: required for account creation. This email address is deleted from our database after the account has been approved/denied, unless the user chooses during the registration process, to keep it for password reset process.
- An username and a password: required to identify the account holder and provide the services offered by **Disroot.org**. - An username and a password: required to identify the account holder and provide the services offered by **Disroot.org**.
- Necessary information related to the operation and functioning of the services which may include, for example, IP address, User Agent, etc. *More detailed information about this and how we handle it can be found in the [Privacy notices per service](#per_services).*
- Necessary information related to the operation and functioning of the services which may include, for example, IP address, User Agent, etc.<br> *More detailed information about this and how we handle it can be found in the [Privacy notices per service](#per_services).*
- When a user makes an online donation to **Disroot.org**, we collect personal data such as, but not limited to, username (if any), country (in case of extra storage request for tax purposes), transaction IDs or bank account/reference. The purpose for which we use this data is merely administrative (verification of regular donations, accounting management) and is maintained under the same security measures described in the "[How do we store your data?](#how_we_store)" section. Since all the data we collect is previously processed by a third-party payment processor such as PayPal, Patreon or Liberapay, by using these or similar services, their use of your information is based on their terms of service and policies, not ours, so we encourage you to review those policies carefully. - When a user makes an online donation to **Disroot.org**, we collect personal data such as, but not limited to, username (if any), country (in case of extra storage request for tax purposes), transaction IDs or bank account/reference. The purpose for which we use this data is merely administrative (verification of regular donations, accounting management) and is maintained under the same security measures described in the "[How do we store your data?](#how_we_store)" section. Since all the data we collect is previously processed by a third-party payment processor such as PayPal, Patreon or Liberapay, by using these or similar services, their use of your information is based on their terms of service and policies, not ours, so we encourage you to review those policies carefully.
- Any additional information that the user chooses to supply while using the services provided by us (whether it is chats, posts, emails, etc.). This additional information is optional and with the user's consent. - Any additional information that the user chooses to supply while using the services provided by us (whether it is chats, posts, emails, etc.). This additional information is optional and with the user's consent.
(For more detailed information, please refer to the [Detailed privacy notices per service](#per_services) section below) (For more detailed information, please refer to the [Detailed privacy notices per service](#per_services) section below)
<a name="what_we_do"></a>
## 1.1. What do we do with your data? ## 1.1. What do we do with your data?
- Our processing of your information is limited to providing the service. - Our processing of your information is limited to providing the service.
- We store logs of your activity for a period no longer than 24 hours (unless specified otherwise per service). This data is used to help diagnose software issues, maintain security of the system against intrusion and monitor the health of the platform. - We store logs of your activity for a period no longer than 24 hours (unless specified otherwise per service). This data is used to help diagnose software issues, maintain security of the system against intrusion and monitor the health of the platform.
(Detailed information on [Privacy notices per service](#per_services) section) (Detailed information on [Privacy notices per service](#per_services) section)
<a name="how_we_store"></a>
## 1.2. How do we store your data? ## 1.2. How do we store your data?
To protect your data we use the following security measures: To protect your data we use the following security measures:
* a. We use disk encryption on all servers to prevent data leak in case the servers are stolen, confiscated or in any way physically tampered with. 1. We use disk encryption on all servers to prevent data leak in case the servers are stolen, confiscated or in any way physically tampered with.
2. We provide and require SSL/TLS encryption on all "user-to-server" and "server-to-server" communications on all provided services.
* b. We provide and require SSL/TLS encryption on all "user-to-server" and "server-to-server" communications on all provided services. 3. We utilize "end-to-end" and/or "server-side" encryption technologies whenever it is made available by services that allow it to provide maximum security for the users.
* c. We utilize "end-to-end" and/or "server-side" encryption technologies whenever it is made available by services that allow it to provide maximum security for the users.
<a name="what_we_do_not"></a>
# 2. What we do not do with your data # 2. What we do not do with your data
- We do not collect any other data than what is needed to provide you the service. - We do not collect any other data than what is needed to provide you the service.
- We do not, in any way, process, analyze your behavior or personal characteristics to create profiles about you or your usage of the services. We have no advertisements or business relationships with advertisers. - We do not, in any way, process, analyze your behavior or personal characteristics to create profiles about you or your usage of the services. We have no advertisements or business relationships with advertisers.
- We do not sell your data to any third party. - We do not sell your data to any third party.
- We do not share your data to any third party unless in case of federated services which requires certain data to be shared in order to operate (e.g. other email service provider needs to know your email address to be able to deliver emails). - We do not share your data to any third party unless in case of federated services which requires certain data to be shared in order to operate (e.g. other email service provider needs to know your email address to be able to deliver emails).
- We do not require any additional information that is not crucial for the operation of the service (we do not ask for phone numbers, private personal data, home address). - We do not require any additional information that is not crucial for the operation of the service (we do not ask for phone numbers, private personal data, home address).
- We do not read/look nor process your personal data, emails, files, etc., stored on our servers unless needed for providing the service, troubleshooting purposes or under suspicion of breaking our **Terms Of Services** in which case we ask for prior permission from you or inform you afterwards of all actions taken against the account in the transparency report addressed to account holder. - We do not read/look nor process your personal data, emails, files, etc., stored on our servers unless needed for providing the service, troubleshooting purposes or under suspicion of breaking our **Terms Of Services** in which case we ask for prior permission from you or inform you afterwards of all actions taken against the account in the transparency report addressed to account holder.
<a name="where_store"></a>
# 3. Where the data is stored? # 3. Where the data is stored?
We store all data in **our own servers**, located in a data center in the **Netherlands**. We store all data in **our own servers**, located in a data center in the **Netherlands**.
<a name="per_service"></a>
# 4. Detailed privacy notices per service # 4. Detailed privacy notices per service
<a name="email"></a>
## 4.1 - **Disroot Email** (https://mail.disroot.org) ## 4.1 - **Disroot Email** (https://mail.disroot.org)
- This service requires login with **Disroot** credentials. - This service requires login with **Disroot** credentials.
- All emails, unless encrypted by the user (with GnuPG/PGP, for example) are stored unencrypted on our servers. - All emails, unless encrypted by the user (with GnuPG/PGP, for example) are stored unencrypted on our servers.
- IP addresses of currently logged in users via IMAP/POP3 protocols are stored as long as the device is logged in the server *(per each device logged in)*. - IP addresses of currently logged in users via IMAP/POP3 protocols are stored as long as the device is logged in the server *(per each device logged in)*.
- Server logs, which store information such as, but not limited to, your username and your IP address, *from* and *to* email addresses, IP addresses of servers the emails come in or go out to, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues. - Server logs, which store information such as, but not limited to, your username and your IP address, *from* and *to* email addresses, IP addresses of servers the emails come in or go out to, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
- Given that email works on a **federated** protocol, when interacting with email addresses hosted on third party servers (eg. Gmail.com, Posteo.org), data is sent to other independently operated and owned servers in the network over which we have no control. - Given that email works on a **federated** protocol, when interacting with email addresses hosted on third party servers (eg. Gmail.com, Posteo.org), data is sent to other independently operated and owned servers in the network over which we have no control.
<a name="cloud"></a>
## 4.2 - **Disroot Cloud** (https://cloud.disroot.org) ## 4.2 - **Disroot Cloud** (https://cloud.disroot.org)
- This service requires login with **Disroot** credentials. - This service requires login with **Disroot** credentials.
- All files sent to the cloud are encrypted with a key-pair created based on the user password to add an extra level of security. Note, however, that the keys are stored on the server, which compromises the level of security to some degree (e.g.: if an attacker knows your password and obtain the encryption key-pair, can decrypt the data). However, **no** "Master Key" does exist on our setup, which means the Admins cannot decrypt any file stored on the cloud without knowing user's password prior. - All files sent to the cloud are encrypted with a key-pair created based on the user password to add an extra level of security. Note, however, that the keys are stored on the server, which compromises the level of security to some degree (e.g.: if an attacker knows your password and obtain the encryption key-pair, can decrypt the data). However, **no** "Master Key" does exist on our setup, which means the Admins cannot decrypt any file stored on the cloud without knowing user's password prior.
- Excluding the files, everything else (calendars, contacts, news, tasks, bookmarks, etc.) is stored unencrypted in a database, unless an application provides external encryption (none so far). This is a limitation of the software we are utilizing for this service (Nextcloud). - Excluding the files, everything else (calendars, contacts, news, tasks, bookmarks, etc.) is stored unencrypted in a database, unless an application provides external encryption (none so far). This is a limitation of the software we are utilizing for this service (Nextcloud).
- Server logs, which store information such as, but not limited to, your IP address, your username, an app currently used, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues. - Server logs, which store information such as, but not limited to, your IP address, your username, an app currently used, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
<a name="chat"></a>
## 4.3 - **Disroot XMPP Chat** (https://webchat.disroot.org) ## 4.3 - **Disroot XMPP Chat** (https://webchat.disroot.org)
- This service requires login with **Disroot** credentials. - This service requires login with **Disroot** credentials.
- The roster (your XMPP contact list) is stored on the server's database. - The roster (your XMPP contact list) is stored on the server's database.
- Chat history is stored on the server in the same form as on the chat itself, meaning unencrypted chat is stored in plain-text and encrypted chat is stored encrypted. Additionally, the chat history, if not specified by the user on per chatroom basis, is stored on the server for a period of three months. You can decide to not have any history stored on the server per chat. - Chat history is stored on the server in the same form as on the chat itself, meaning unencrypted chat is stored in plain-text and encrypted chat is stored encrypted. Additionally, the chat history, if not specified by the user on per chatroom basis, is stored on the server for a period of three months. You can decide to not have any history stored on the server per chat.
- Server logs, which store information such as, but not limited to, your IP address and your username are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues. - Server logs, which store information such as, but not limited to, your IP address and your username are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
- Given that XMPP is a **federated** protocol, when interacting with users or chat-rooms hosted on third party servers, data is sent to other independently operated and owned servers in the network over which we have no control. - Given that XMPP is a **federated** protocol, when interacting with users or chat-rooms hosted on third party servers, data is sent to other independently operated and owned servers in the network over which we have no control.
- Files uploaded to the server are stored as is (plain-text or encrypted) for a period of three months. - Files uploaded to the server are stored as is (plain-text or encrypted) for a period of three months.
<a name="search"></a>
## 4.4 - **Disroot Search** (https://search.disroot.org) ## 4.4 - **Disroot Search** (https://search.disroot.org)
- This service does not require login or providing any personal data. - This service does not require login or providing any personal data.
- **No log data** (IP address, session cookie, etc.) is stored on the server. - **No log data** (IP address, session cookie, etc.) is stored on the server.
- Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after. - Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after.
- Personal information of our users is never leaked to the other search engines. - Personal information of our users is never leaked to the other search engines.
<a name="upload"></a>
## 4.5 - **Disroot Upload** (https://upload.disroot.org) ## 4.5 - **Disroot Upload** (https://upload.disroot.org)
- This service does not require login or providing any personal data. - This service does not require login or providing any personal data.
- **No log data** (IP address, session cookie, etc.) is stored on the server. - **No log data** (IP address, session cookie, etc.) is stored on the server.
- Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after. - Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after.
- All files uploaded to the server are **end-to-end encrypted** which means no one with access to the server can decrypt/read the data. - All files uploaded to the server are **end-to-end encrypted** which means no one with access to the server can decrypt/read the data.
- Files uploaded to the server are wiped based on the retention period set by the user upon upload. - Files uploaded to the server are wiped based on the retention period set by the user upon upload.
<a name="pads"></a>
## 4.6 - **Disroot Pads** (https://pad.disroot.org and https://calc.disroot.org) ## 4.6 - **Disroot Pads** (https://pad.disroot.org and https://calc.disroot.org)
- This service does not require login or providing any personal data. - This service does not require login or providing any personal data.
- **No log data** (IP address, session cookie, etc.) is stored on the server. - **No log data** (IP address, session cookie, etc.) is stored on the server.
- We do not collect any other personal data that can be linked to the pads. - We do not collect any other personal data that can be linked to the pads.
- Pad content is stored on the server in the database as is (plain-text). - Pad content is stored on the server in the database as is (plain-text).
- Untouched pads and calcs expire after six months and are then removed from the server. - Untouched pads and calcs expire after six months and are then removed from the server.
<a name="polls"></a>
## 4.7 - **Disroot Polls** (https://poll.disroot.org) ## 4.7 - **Disroot Polls** (https://poll.disroot.org)
- This service does not require login or providing any personal data. - This service does not require login or providing any personal data.
- **No log data** (IP address, session cookie, etc.) is stored on the server. - **No log data** (IP address, session cookie, etc.) is stored on the server.
- Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after. - Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after.
- Poll data is stored on the server in the database as is (plain-text). - Poll data is stored on the server in the database as is (plain-text).
- Expired polls are removed from the database according to the user setting during poll creation. - Expired polls are removed from the database according to the user setting during poll creation.
<a name="bin"></a>
## 4.8 - **Disroot Bin** (https://bin.disroot.org) ## 4.8 - **Disroot Bin** (https://bin.disroot.org)
- This service does not require login or providing any personal data. - This service does not require login or providing any personal data.
- **No log data** (IP address, session cookie, etc.) is stored on the server. - **No log data** (IP address, session cookie, etc.) is stored on the server.
- Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after. - Logs may be enabled occasionally in case of troubleshooting. Logs are then enabled for the duration of problem assessment and are purged immediately after.
- All files uploaded to the server are **end-to-end encrypted** which means no one with access to the server can decrypt/read the data. - All files uploaded to the server are **end-to-end encrypted** which means no one with access to the server can decrypt/read the data.
- Files uploaded to the server are wiped based on the retention period set by the user upon upload. - Files uploaded to the server are wiped based on the retention period set by the user upon upload.
- Comments and discussions under pastes are **end-to-end encrypted**. - Comments and discussions under pastes are **end-to-end encrypted**.
<a name="forum"></a>
## 4.9 - **Disroot Forum** (https://forum.disroot.org) ## 4.9 - **Disroot Forum** (https://forum.disroot.org)
- This service requires to create separate account or use **Disroot** credentials to interact with discussions. - This service requires to create separate account or use **Disroot** credentials to interact with discussions.
- **No log data** (IP address, session cookie, etc.) is stored on the server. - **No log data** (IP address, session cookie, etc.) is stored on the server.
- The forum software stores your last used IP address in the database. - The forum software stores your last used IP address in the database.
- All forum data (groups, threads, posts, usernames, email addresses) are stored on the server in the database as is (plain-text). - All forum data (groups, threads, posts, usernames, email addresses) are stored on the server in the database as is (plain-text).
<a name="project_board"></a>
## 4.10 - **Disroot Project Board** (https://board.disroot.org) ## 4.10 - **Disroot Project Board** (https://board.disroot.org)
- This service requires login with **Disroot** credentials. - This service requires login with **Disroot** credentials.
- Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues. - Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
- All board data (usernames, project data, email addresses) is stored on the server in the database as is (plain-text). - All board data (usernames, project data, email addresses) is stored on the server in the database as is (plain-text).
<a name="calls"></a>
## 4.11 - **Disroot Calls** (https://calls.disroot.org) ## 4.11 - **Disroot Calls** (https://calls.disroot.org)
- This service does not require login. - This service does not require login.
- **No log data** (IP address, session cookie, etc.) is stored on the server. - **No log data** (IP address, session cookie, etc.) is stored on the server.
- No user data is permanently stored on the server. - No user data is permanently stored on the server.
<a name="diaspora"></a>
## 4.12 - **Disroot Social (Diaspora\* pod)** (https://pod.disroot.org) ## 4.12 - **Disroot Social (Diaspora\* pod)** (https://pod.disroot.org)
- This service requires to create a separate account. - This service requires to create a separate account.
- Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues. - Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
- This service works on **federated protocols** which means your public posts are shared/transfered to other independently operated servers in the network over which we have no control. - This service works on **federated protocols** which means your public posts are shared/transfered to other independently operated servers in the network over which we have no control.
- Private posts/messages are sent to users on other servers only if you intentionally choose to interact with them. - Private posts/messages are sent to users on other servers only if you intentionally choose to interact with them.
- All pod data (usernames, email addresses, posts and messages, polls, contacts, photos and images) are stored on the server in the database as is (plain-text). - All pod data (usernames, email addresses, posts and messages, polls, contacts, photos and images) are stored on the server in the database as is (plain-text).
<a name="git"></a>
## 4.13 - **Disroot GIT** (https://git.disroot.org) ## 4.13 - **Disroot GIT** (https://git.disroot.org)
- This service requires to create a separate git account to interact with others. - This service requires to create a separate git account to interact with others.
- Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues. - Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
- All git data such as, but not limited to, usernames, email addresses, messages, code, files, versions, pull requests, etc., are stored on the server in the database as is (plain-text). - All git data such as, but not limited to, usernames, email addresses, messages, code, files, versions, pull requests, etc., are stored on the server in the database as is (plain-text).
<a name="rights"></a>
# 5. Your rights # 5. Your rights
Under the **GDPR** you have a number of rights with regard to your personal data: Under the **GDPR** you have a number of rights with regard to your personal data:
* a. **Right to access** - The right to request (I) copies of your personal Data or (II) access to the information you submited and we hold at any time. 1. **Right to access** - The right to request (I) copies of your personal Data or (II) access to the information you submited and we hold at any time.
2. **Right to correct** - The right to have your Data rectified if it is inaccurate or incomplete.*
* b. **Right to correct** - The right to have your Data rectified if it is inaccurate or incomplete.* 3. **Right to erase** - The right to request delete or remove your Data from our servers.
4. **Right to restrict the use of your Data** - The right to restrict processing or limit the way we use your Data.
* c. **Right to erase** - The right to request delete or remove your Data from our servers. 5. **Right to Data portability** - The right to move, copy or transfer your Data.
6. **Right to object** - The right to object to our use of your Data.
* d. **Right to restrict the use of your Data** - The right to restrict processing or limit the way we use your Data.
* e. **Right to Data portability** - The right to move, copy or transfer your Data.
* f. **Right to object** - The right to object to our use of your Data.
\* *Your* **Disroot username** *and* **Disroot email address** *are integral part of your user account and cannot be modified.<br>
Usernames remain in the database, even after erasure request, to prevent old usernames being re-used by new users, compromising the privacy of both and enabling possible identity theft. For that reason, usernames of accounts that have been deleted remain in the database to avoid being reused. However, all the linked personal information is deleted permanently.*
> *Your* **Disroot username** *and* **Disroot email address** *are integral part of your user account and cannot be modified.*
> *Usernames remain in the database, even after erasure request, to prevent old usernames being re-used by new users, compromising the privacy of both and enabling possible identity theft. For that reason, usernames of accounts that have been deleted remain in the database to avoid being reused. However, all the linked personal information is deleted permanently.*
You have the right to lodge a complain, make enquires, excercise any of the rights described above or withdraw your consent to the processing of your Data (where consent is our legal basis for processing your Data), by contacting us via email to: You have the right to lodge a complain, make enquires, excercise any of the rights described above or withdraw your consent to the processing of your Data (where consent is our legal basis for processing your Data), by contacting us via email to:
- **data.protection.officer@disroot.org** - Person responsible for this Privacy Statement - **data.protection.officer@disroot.org** - Person responsible for this Privacy Statement
- **info@disroot.org** - General information contact - **info@disroot.org** - General information contact
For the purposes of the **GDPR**, **Disroot.org** is the "data controller". This means that **Disroot** determines the purposes for which and the manner which your data is processed. For the purposes of the **GDPR**, **Disroot.org** is the "data controller". This means that **Disroot** determines the purposes for which and the manner which your data is processed.
**Stichting Disroot.org**:<br> **Stichting Disroot.org**:
Dutch Chamber of Commerce (KVK) number: 69988099 Dutch Chamber of Commerce (KVK) number: 69988099
If you are not satisfied with the way your Data is handled by us, or think its processing is not appropriate, you have the right to send a complaint to the **Information Commissioners’ Office**. If you are not satisfied with the way your Data is handled by us, or think its processing is not appropriate, you have the right to send a complaint to the **Information Commissioners’ Office**.
**Dutch Data Protection Authority (Dutch DPA)** **Dutch Data Protection Authority (Dutch DPA)**
**Postal address**
Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ DEN HAAG
**Phone:** (+31) - (0)70 - 888 85 00
**Fax:** (+31) - (0)70 - 888 85 01
**Postal address**<br> <a name="access_information"></a>
Autoriteit Persoonsgegevens<br>
PO Box 93374<br>
2509 AJ DEN HAAG<br>
<br>
**Phone:** (+31) - (0)70 - 888 85 00<br>
**Fax:** (+31) - (0)70 - 888 85 01<br>
## 5.1. Access to your information ## 5.1. Access to your information
Access to your personal data, stored files and other information you provide to any of the services offered by **Disroot.org** is under your control. This means that all data stored on our services that are bound to personal information (services that require logging in) are available for you to download either for archival purposes or to transfer to another compatible service. Access to your personal data, stored files and other information you provide to any of the services offered by **Disroot.org** is under your control. This means that all data stored on our services that are bound to personal information (services that require logging in) are available for you to download either for archival purposes or to transfer to another compatible service.
#### To learn how to access and self-export your personal data - Learn how to access and self-export your personal data [**here**](https://howto.disroot.org/en/tutorials/user/gdpr)
- Modify your personal data or delete your account [**here**](https://user.disroot.org)
* https://howto.disroot.org/en/tutorials/user/gdpr
#### To modify your personal data or delete your account
* https://user.disroot.org
<a name="changes"></a>
# 6. Changes on this Privacy Statement # 6. Changes on this Privacy Statement
Any and all changes to this **Privacy Statement** will be publicly available and communicated to all users via our social networks and blog post. We recommend that you regularly check for any changes on this Statement. Any and all changes to this **Privacy Statement** will be publicly available and communicated to all users via our social networks and blog post. We recommend that you regularly check for any changes on this Statement.
<br>
You can follow the history of changes on this document on our version control system [**here**](https://git.disroot.org/Disroot/Disroot-Privacy-Policy/commits/branch/master) You can follow the history of changes on this document on our version control system [**here**](https://git.disroot.org/Disroot/Disroot-Privacy-Policy/commits/branch/master)
@ -362,3 +278,4 @@ You can follow the history of changes on this document on our version control sy
- February 12th, 2020 - February 12th, 2020
<br> <br>
[Back to top](#top)