SAMPLE TEMPLATE — NOT LEGALLY BINDING. This is example text shipped with the software and has not yet been adapted by the operator of this archive. It is real, usable wording, but it is not legal advice and is not binding as written. If you run this archive, replace the bracketed placeholders with your own details, check that it fits your country's data-protection law, and have it reviewed by a lawyer before you rely on it. Edit it under Legal & Information Documents → Privacy; the version you publish replaces this example.

Privacy Policy

This policy explains what personal data this archive collects, why, how it is protected, and the rights you have over it. We follow the principle "saving data against untrustworthy use": we collect only what we need to run the archive, and we do not sell your data.

1. Who is responsible

The organisation or person responsible for your personal data ("we", "us") is the operator named in the Imprint:

[Operator name]
[Address]
Email for data-protection enquiries: [privacy contact email]

If a data protection officer has been appointed, their contact details are: [name and contact, or remove this line].

2. What we collect

For visitors who only read the archive, we collect very little — typically only the technical information your browser sends and short-lived session data needed to serve pages securely.

For members, we collect and store the personal data necessary to operate your membership:

your username and, where you provide it, your legal name and the mandatory registration details required by the operator;
your email address;
an encrypted (hashed) form of your password — we never store your password in readable form;
a record of activity needed for the security and administration of the archive, including sign-ins, and the date and version of the member agreement you accepted (the originating IP address is stored only in a hashed form);
content you contribute and the metadata attached to it.

3. Why we use it and the legal basis

We use this data to create and secure your account, to let you take part in the archive, to keep a legally defensible record of the agreement you accepted, and to protect the archive and its members against misuse. Depending on your jurisdiction, the legal basis is typically the performance of our agreement with you, our legitimate interest in running a secure archive, compliance with legal obligations, and — where required — your consent.

4. Cookies and sessions

We use strictly necessary cookies to keep you signed in and to protect forms against abuse. These are essential to the service and are not used for advertising or cross-site tracking. If the operator adds any non-essential cookies or analytics, they must be described here and, where required, offered on an opt-in basis.

We do not sell your personal data and we do not share it with third parties for their own purposes. We share it only where it is strictly necessary to operate the service (for example, with a hosting provider acting on our instructions) or where we are required to do so by law. Any such processors are listed here by the operator: [hosting / email / other processors, or "none beyond our hosting provider"].

6. How long we keep it

We keep your account data for as long as your membership is active. When you close your account, we delete or anonymise your personal data within a reasonable period, except for the minimum records we are required to keep by law and the anonymised record that a given agreement version was accepted.

7. How we protect it

We take reasonable technical and organisational measures to protect your data against loss and unauthorised access — including password hashing, access controls, and encrypted connections. No system is perfectly secure, but we work to keep the risk low.

8. Your rights

Subject to applicable law, you have the right to access the personal data we hold about you, to ask for it to be corrected, to ask for your account and associated personal data to be deleted, to object to or restrict certain processing, and to receive a copy of your data in a portable form. To exercise these rights, contact a coordinator or write to [privacy contact email]. You also have the right to complain to your local data-protection authority.

9. International transfers

If your data is stored or processed outside your country or region, the operator must ensure an adequate level of protection and describe the safeguards here.

10. Changes to this policy

We may update this policy from time to time. When we make a significant change, we will publish the updated version here and, where appropriate, let members know.

Privacy