R4

privacy-en.md

@@ -1,7 +1,7 @@
 [[https://vdpr.org/VDMDI/.resources/raw/branch/main/vdpol-logo-pr.png]]
 ---
 
-Viridian Public Privacy Policy (VDPrivP) / Third Revision
+Viridian Public Privacy Policy (VDPrivP) / Fourth Revision
 ===
 
 The Viridian Public Privacy Policy (VDPrivP) defines how the Viridian Administration collects, stores, and handles data through the VDPR server (vdpr.org).
@@ -16,11 +16,12 @@ VDPR is a customized gitea server. The administration of this server has not imp
 
 VDPR is hosted on rented infrastructure. For more information, review the [VDMDI Public Infrastructure Notice](https://vdpr.org/VDMDI/.resources/src/branch/main/infrastructure.md).
 
-3: Processing
+3: Processing and Storage of Data
 ---
 1. User sessions and activity - log-ins, pages you access, as well as data about your devices including IP address, browser, operating system, and similar information: this data may be stored in server logs. Logs are deleted after seven days. VDPR utilizes strictly necessary session and security cookies (such as CSRF protection tokens and login session identifiers) to provide authentication. *This processing is based on a legitimate interest pursuant to Art. 6(1)(f) GDPR (ensuring system stability, preventing abuse/attacks)*
 2. Changes made on repositories and organisations, tickets filed, comments; including private organisations and repositories: modifications you make to data on the VDPR server can be traced back to you. Data you store on VDPR, including but not limited to uploaded files, created repositories or organisations, tickets, comments, are stored until deleted by you or the Viridian Administration. *This processing is necessary for the performance of a contract or service pursuant to Art. 6(1)(b) GDPR (provision of the Gitea platform).*
 3. Violations of Viridian Public Policy in accordance with section seven of this policy.
+4. A backup of the VDPR server is securely and incrementally pulled to a dedicated, encrypted partition of a local storage medium, i.e. data on the server is mirrored to the backup. Public access to the storage medium used is not facilitated. The backup is no more than seven days out of date. Data deleted on the server may therefore remain available on this backup for up to seven days. *This processing is necessary in order to ensure availability of VDPR, and to be able to restore the service in the event of technological failure pursuant to Art. 32(1) GDPR. This processing therefore is a legitimate interest pursuant to Art. 6(1)(f) GDPR.*
 
 4: Your personal data
 ---