beantownbabeandClaude Sonnet 4.6
b11dfcde6a
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
99 lines
3.9 KiB
Markdown
99 lines
3.9 KiB
Markdown
# Data Governance and Privacy Notice
|
|
## HiActs Conference Poll — Hi-Acts 3rd Network Meeting, DESY Hamburg, 10 June 2026
|
|
|
|
**Data Controller:** TXproducts UG
|
|
**Contact:** mblack@txproducts.de
|
|
**Document version:** 1.0, prepared June 2026
|
|
|
|
---
|
|
|
|
## 1. What data is collected
|
|
|
|
This application collects two categories of data:
|
|
|
|
**a) Anonymous poll responses**
|
|
Answers to the 11 poll questions. No names, device identifiers, or IP addresses are stored alongside answers. Responses are stored in `answers.json` on the server. This data is not personal data under GDPR.
|
|
|
|
**b) Email addresses (optional)**
|
|
Attendees may voluntarily submit their email address to receive the full analysis report after the event. This is personal data under GDPR Article 4(1).
|
|
|
|
---
|
|
|
|
## 2. Legal basis for processing
|
|
|
|
The legal basis for processing email addresses is **consent** under GDPR Article 6(1)(a).
|
|
|
|
Consent is obtained through an explicit tick-box on the email capture modal, with the following conditions met:
|
|
- Consent is freely given (submission is optional and declining has no consequence)
|
|
- Consent is specific (stated purpose is sending the analysis report only)
|
|
- Consent is informed (a clear data notice is shown before the checkbox)
|
|
- Consent is unambiguous (a positive action, ticking the checkbox, is required)
|
|
|
|
---
|
|
|
|
## 3. Purpose of processing
|
|
|
|
Email addresses are collected for one purpose only: to send the attendee a copy of the full poll analysis report after the conference. They will not be used for marketing, profiling, or any secondary purpose.
|
|
|
|
---
|
|
|
|
## 4. Data sharing and third parties
|
|
|
|
Email addresses are not shared with, sold to, or disclosed to any third party. The data is stored on TXproducts' own server infrastructure. The report is sent using TXproducts' own SMTP mail service.
|
|
|
|
---
|
|
|
|
## 5. Retention and deletion
|
|
|
|
| Data type | Retention period | Deletion method |
|
|
|-------------------|-------------------------------------------|------------------------------|
|
|
| Poll responses | Until admin reset or 90 days post-event | Admin reset button or manual deletion of answers.json |
|
|
| Email addresses | No longer than 30 days after the conference (by 10 July 2026) | Manual deletion of emails.json |
|
|
| Comments | No longer than 30 days after the conference (by 10 July 2026) | Manual deletion of comments.json |
|
|
|
|
**Responsible for deletion:** McKinley Black, mblack@txproducts.de
|
|
**Deletion deadline:** 10 July 2026
|
|
|
|
---
|
|
|
|
## 6. Data subject rights
|
|
|
|
Under GDPR Chapter III, attendees who submitted their email have the following rights:
|
|
|
|
- **Right of access** (Article 15): to know what data is held
|
|
- **Right to erasure** (Article 17): to have their email deleted at any time before scheduled deletion
|
|
- **Right to withdraw consent** (Article 7(3)): at any time, without affecting the lawfulness of prior processing
|
|
|
|
To exercise any of these rights, attendees should contact mblack@txproducts.de. Requests will be fulfilled within 72 hours.
|
|
|
|
---
|
|
|
|
## 7. Security measures
|
|
|
|
- The server runs over HTTPS
|
|
- Data files (answers.json, emails.json, comments.json) are excluded from version control via .gitignore
|
|
- No data files are committed to this repository
|
|
- Admin page access is restricted by URL obscurity during the event
|
|
|
|
---
|
|
|
|
## 8. Audit trail
|
|
|
|
| Date | Action | Responsible |
|
|
|------|--------|-------------|
|
|
| 2026-06-10 | Conference event, data collection begins | McKinley Black |
|
|
| By 2026-07-10 | emails.json and comments.json deleted | McKinley Black |
|
|
| By 2026-07-10 | answers.json deleted or anonymised | McKinley Black |
|
|
|
|
---
|
|
|
|
## 9. Applicable law
|
|
|
|
This application and its data handling comply with:
|
|
- Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR)
|
|
- Bundesdatenschutzgesetz (BDSG), the German Federal Data Protection Act
|
|
|
|
---
|
|
|
|
*This document is maintained in the project repository as a record of data governance decisions and should be updated if any data handling practices change.*
|