57 lines
5.6 KiB
Markdown
57 lines
5.6 KiB
Markdown
[[https://vdpr.org/VDMDI/.resources/raw/branch/main/vdpol-logo-pr.png]]
|
|
---
|
|
|
|
Viridian Public Privacy Policy (VDPrivP) / Fourth Revision
|
|
===
|
|
|
|
The Viridian Public Privacy Policy (VDPrivP) defines how the Viridian Administration collects, stores, and handles data through the VDPR server (vdpr.org).
|
|
|
|
1: What is VDPR?
|
|
---
|
|
|
|
VDPR is a customized gitea server. The administration of this server has not implemented telemetry or other means of data collection in addition to gitea defaults. Gitea does not employ telemetry or other means of data collection, except for data necessary to operate the server.
|
|
|
|
2: Hosting and Infrastructure
|
|
---
|
|
|
|
VDPR is hosted on rented infrastructure. For more information, review the [VDMDI Public Infrastructure Notice](https://vdpr.org/VDMDI/.resources/src/branch/main/infrastructure.md).
|
|
|
|
3: Processing and Storage of Data
|
|
---
|
|
1. User sessions and activity - log-ins, pages you access, as well as data about your devices including IP address, browser, operating system, and similar information: this data may be stored in server logs. Logs are deleted after seven days. VDPR utilizes strictly necessary session and security cookies (such as CSRF protection tokens and login session identifiers) to provide authentication. *This processing is based on a legitimate interest pursuant to Art. 6(1)(f) GDPR (ensuring system stability, preventing abuse/attacks)*
|
|
2. Changes made on repositories and organisations, tickets filed, comments; including private organisations and repositories: modifications you make to data on the VDPR server can be traced back to you. Data you store on VDPR, including but not limited to uploaded files, created repositories or organisations, tickets, comments, are stored until deleted by you or the Viridian Administration. *This processing is necessary for the performance of a contract or service pursuant to Art. 6(1)(b) GDPR (provision of the Gitea platform).*
|
|
3. Violations of Viridian Public Policy in accordance with section seven of this policy.
|
|
4. A backup of the VDPR server is securely and incrementally pulled to a dedicated, encrypted partition of a local storage medium, i.e. data on the server is mirrored to the backup. Public access to the storage medium used is not facilitated. The backup is no more than seven days out of date. Data deleted on the server may therefore remain available on this backup for up to seven days. *This processing is necessary in order to ensure availability of VDPR, and to be able to restore the service in the event of technological failure pursuant to Art. 32(1) GDPR. This processing therefore is a legitimate interest pursuant to Art. 6(1)(f) GDPR.*
|
|
|
|
4: Your personal data
|
|
---
|
|
1. When signing up for an account on VDPR, you are required to disclose the following data:
|
|
1. full name
|
|
2. username
|
|
3. e-mail address (can be hidden, **visible to other users by default**)
|
|
2. This data, alongside other information you voluntarily add to your profile, is publicly visible to others unless you manually change visibility settings.
|
|
|
|
5: Records and Data Review
|
|
---
|
|
1. The Viridian Administration may look at your full name and e-mail address in order to contact you.
|
|
2. The Viridian Administration may review server logs for security reasons.
|
|
3. The Viridian Administration may observe all changes you make on VDPR, including but not limited to the creation of organisations, repositories, and tickets, as well as creation, upload, and modification of files.
|
|
|
|
6: Your rights
|
|
---
|
|
1. You may contact the Viridian Administration in order to obtain information about, or to request changes to or deletion of your data at all times (Arts. 15, 16, and 17 GDPR). Data regarding your violations of Viridian Public Policy is retained in accordance with section seven of this policy.
|
|
2. You have the right to object to the storage and processing of your data on VDPR by contacting the Viridian Administration. Such objection may be overridden under Art. 21(1) GDPR.
|
|
3. You cannot delete or modify individual commits made on a repository. This is due to the nature of git services and pursuant to Art. 17(3)(d) GDPR (archiving purposes in the public interest / collaborative technical integrity).
|
|
4. You may lodge a complaint with a data protection supervisory authority, free of charge and without any formal requirements, if you believe the processing of your personal data infringes the GDPR.
|
|
|
|
7: Retention of Data regarding Violations
|
|
---
|
|
1. The Viridian Administration retains data regarding violations of Viridian Public Policy for every user who has breached such policy. *This processing is based on a legitimate interest pursuant to Art. 6(1)(f) GDPR (ensuring platform security and safety, preventing abuse/attacks)*
|
|
2. The following information is retained:
|
|
1. The offender's account ID
|
|
2. The offender's current penalty score
|
|
3. Violations recognised by the Viridian Administration within the past three years, including the following information for each violation:
|
|
1. Full name, username, and e-mail of the offender provided at the time of recognition of the violation
|
|
2. The specific rules breached (quoted and cited)
|
|
3. Evidence of violation in the form of screenshots
|
|
3. If you request deletion of your data under Art. 17 GDPR, data retained under subsection two is retained for a minimum of two but no more than three calendar years. *This retention is pursuant to Art. 17(3)(e) GDPR (necessary for defence of legal claims). VDPR is operated in Germany. Section 195 of the German Civil Code defines three years as the regular statutory limitation period for civil claims. The Viridian Administration is allowed to retain evidence regarding your violations during this period.* |