Add GDPR consent to email modal and data governance document
- Email modal now shows a plain-language GDPR data notice before the input field, with an explicit consent checkbox that must be ticked before the submit button becomes active - Added DATA_GOVERNANCE.md covering legal basis, purpose, retention, data subject rights, and deletion deadlines for audit compliance Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
beantownbabeandClaude Sonnet 4.6 committed
1 parent
27a59671fc
commit
f54b55674c
2 files changed
+115
-1
No files matched your search
@@ -0,0 +1,98 @@
|
||||
# Data Governance and Privacy Notice
|
||||
## HiActs Conference Poll — Hi-Acts 3rd Network Meeting, DESY Hamburg, 10 June 2026
|
||||
|
||||
**Data Controller:** TXproducts GmbH
|
||||
**Contact:** mblack@txproducts.de
|
||||
**Document version:** 1.0, prepared June 2026
|
||||
|
||||
---
|
||||
|
||||
## 1. What data is collected
|
||||
|
||||
This application collects two categories of data:
|
||||
|
||||
**a) Anonymous poll responses**
|
||||
Answers to the 11 poll questions. No names, device identifiers, or IP addresses are stored alongside answers. Responses are stored in `answers.json` on the server. This data is not personal data under GDPR.
|
||||
|
||||
**b) Email addresses (optional)**
|
||||
Attendees may voluntarily submit their email address to receive the full analysis report after the event. This is personal data under GDPR Article 4(1).
|
||||
|
||||
---
|
||||
|
||||
## 2. Legal basis for processing
|
||||
|
||||
The legal basis for processing email addresses is **consent** under GDPR Article 6(1)(a).
|
||||
|
||||
Consent is obtained through an explicit tick-box on the email capture modal, with the following conditions met:
|
||||
- Consent is freely given (submission is optional and declining has no consequence)
|
||||
- Consent is specific (stated purpose is sending the analysis report only)
|
||||
- Consent is informed (a clear data notice is shown before the checkbox)
|
||||
- Consent is unambiguous (a positive action, ticking the checkbox, is required)
|
||||
|
||||
---
|
||||
|
||||
## 3. Purpose of processing
|
||||
|
||||
Email addresses are collected for one purpose only: to send the attendee a copy of the full poll analysis report after the conference. They will not be used for marketing, profiling, or any secondary purpose.
|
||||
|
||||
---
|
||||
|
||||
## 4. Data sharing and third parties
|
||||
|
||||
Email addresses are not shared with, sold to, or disclosed to any third party. The data is stored on TXproducts' own server infrastructure. The report is sent using TXproducts' own SMTP mail service.
|
||||
|
||||
---
|
||||
|
||||
## 5. Retention and deletion
|
||||
|
||||
| Data type | Retention period | Deletion method |
|
||||
|-------------------|-------------------------------------------|------------------------------|
|
||||
| Poll responses | Until admin reset or 90 days post-event | Admin reset button or manual deletion of answers.json |
|
||||
| Email addresses | No longer than 30 days after the conference (by 10 July 2026) | Manual deletion of emails.json |
|
||||
| Comments | No longer than 30 days after the conference (by 10 July 2026) | Manual deletion of comments.json |
|
||||
|
||||
**Responsible for deletion:** McKinley Black, mblack@txproducts.de
|
||||
**Deletion deadline:** 10 July 2026
|
||||
|
||||
---
|
||||
|
||||
## 6. Data subject rights
|
||||
|
||||
Under GDPR Chapter III, attendees who submitted their email have the following rights:
|
||||
|
||||
- **Right of access** (Article 15): to know what data is held
|
||||
- **Right to erasure** (Article 17): to have their email deleted at any time before scheduled deletion
|
||||
- **Right to withdraw consent** (Article 7(3)): at any time, without affecting the lawfulness of prior processing
|
||||
|
||||
To exercise any of these rights, attendees should contact mblack@txproducts.de. Requests will be fulfilled within 72 hours.
|
||||
|
||||
---
|
||||
|
||||
## 7. Security measures
|
||||
|
||||
- The server runs over HTTPS
|
||||
- Data files (answers.json, emails.json, comments.json) are excluded from version control via .gitignore
|
||||
- No data files are committed to this repository
|
||||
- Admin page access is restricted by URL obscurity during the event
|
||||
|
||||
---
|
||||
|
||||
## 8. Audit trail
|
||||
|
||||
| Date | Action | Responsible |
|
||||
|------|--------|-------------|
|
||||
| 2026-06-10 | Conference event, data collection begins | McKinley Black |
|
||||
| By 2026-07-10 | emails.json and comments.json deleted | McKinley Black |
|
||||
| By 2026-07-10 | answers.json deleted or anonymised | McKinley Black |
|
||||
|
||||
---
|
||||
|
||||
## 9. Applicable law
|
||||
|
||||
This application and its data handling comply with:
|
||||
- Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR)
|
||||
- Bundesdatenschutzgesetz (BDSG), the German Federal Data Protection Act
|
||||
|
||||
---
|
||||
|
||||
*This document is maintained in the project repository as a record of data governance decisions and should be updated if any data handling practices change.*
|
||||
+17
-1
@@ -310,6 +310,10 @@
|
||||
.em-confirm { display: none; text-align: center; color: #059669; font-weight: 700; font-size: 14px; margin-bottom: 12px; }
|
||||
.em-skip { display: block; text-align: center; font-size: 13px; color: #8a9baf; text-decoration: none; }
|
||||
.em-skip:hover { color: #4a5568; }
|
||||
.em-gdpr { font-size: 11.5px; color: #718096; line-height: 1.65; margin-bottom: 14px; padding: 10px 13px; background: #f7fafc; border-radius: 8px; border: 1px solid #e2e8f0; }
|
||||
.em-consent { display: flex; align-items: flex-start; gap: 10px; margin-bottom: 14px; font-size: 12.5px; color: #4a5568; line-height: 1.5; cursor: pointer; }
|
||||
.em-consent input[type="checkbox"] { margin-top: 2px; flex-shrink: 0; width: 15px; height: 15px; cursor: pointer; accent-color: #2563eb; }
|
||||
.em-submit:disabled { opacity: 0.4; cursor: not-allowed; }
|
||||
</style>
|
||||
</head>
|
||||
|
||||
@@ -737,9 +741,16 @@
|
||||
<p class="em-body">
|
||||
For a full in-depth analysis of all results, including how responses differ across roles and facilities, leave your email below. We will send the complete report to you after the event.
|
||||
</p>
|
||||
<div class="em-gdpr">
|
||||
<strong>Data notice (GDPR):</strong> Your email address will be collected by TXproducts GmbH solely to send you this analysis report. It will not be shared with or sold to any third party. It will be permanently deleted within 30 days of the conference. You may request deletion at any time by contacting mblack@txproducts.de.
|
||||
</div>
|
||||
<input class="em-input" id="emailInput" type="email" placeholder="your@email.com" autocomplete="email">
|
||||
<label class="em-consent">
|
||||
<input type="checkbox" id="gdprCheckbox" onchange="toggleSubmit()">
|
||||
I have read the data notice above and consent to TXproducts GmbH storing my email address for the purpose of receiving this report.
|
||||
</label>
|
||||
<div class="em-confirm" id="emailConfirm">Thank you. We will be in touch after the event.</div>
|
||||
<button class="em-submit" id="emailSubmitBtn" onclick="submitEmail()">Send me the full report</button>
|
||||
<button class="em-submit" id="emailSubmitBtn" onclick="submitEmail()" disabled>Send me the full report</button>
|
||||
<a href="#" class="em-skip" onclick="closeEmailModal(); return false;">No thanks, just show the results</a>
|
||||
</div>
|
||||
</div>
|
||||
@@ -756,6 +767,11 @@
|
||||
}, 400);
|
||||
}
|
||||
|
||||
function toggleSubmit() {
|
||||
const checked = document.getElementById('gdprCheckbox').checked;
|
||||
document.getElementById('emailSubmitBtn').disabled = !checked;
|
||||
}
|
||||
|
||||
function closeEmailModal() {
|
||||
sessionStorage.setItem('emailModalShown', '1');
|
||||
const modal = document.getElementById('emailModal');
|
||||
|
||||
Reference in new issue
Block a user