Privacy

Privacy notice DRAFT — fill in the parts in [brackets] and have it checked before relying on it. It describes what this software does; if you change how you run the site (hosting, backups, extra services), update it. Who is responsible for your data [Zavod Rizoma, full address, registration number], email: [privacy contact email]. This organisation is the "controller" of your personal data under the EU General Data Protection Regulation (GDPR). What we collect - Account: your name, login email address and password (stored only as a one-way hash), pronouns if you give them. - Profile: what you choose to add — about you, skills, availability, area, links, profile picture and photos. - Contact details you choose to add (phone, contact email, notes, preferred ways to be contacted) and who may see them. - Dietary needs you choose to add, including allergies or intolerances. Allergies are health information (a "special category" under GDPR); we process them only with your explicit consent, given when you add them (Article 9(2)(a)), and show them only to the people who can see your contact details. Remove them at any time to withdraw consent. - Activity on the site: places you host, actions and jobs you post, sign-ups, offers of help, notes to hosts, who you have met in person, who invited you and who accepted you, when you agreed to the guidelines and terms. - Technical: a session cookie that keeps you logged in and a security cookie that protects forms. No tracking, analytics or advertising cookies are used. Your IP address is kept in memory for up to 15 minutes to block password-guessing, and is not stored. - Photos are re-encoded when uploaded, which removes hidden location data. Why, and on what legal basis We use your data only to run this network: so hosts and volunteers can find each other, arrange work and get in touch. The legal basis is our agreement with you when you join (Article 6(1)(b) GDPR) and our legitimate interest in keeping the network safe, for example knowing who invited whom (Article 6(1)(f)). Optional details such as pronouns, photos and contact details are shared because you choose to add them, and you can remove them at any time. Who can see it Only logged-in members of this network. Your contact details are shown according to your own setting (all members, or only people you're connected to). Your login email is visible only to admins. We never sell your data or share it outside the network. Services we rely on - Hosting: [hosting provider, country] stores the site and its database on our behalf. [Make sure you have a data processing agreement with them.] - Email (if used): notification emails are sent through [email provider]. They contain only names and links to this site. - Maps: map images are loaded by your browser from OpenStreetMap (tile.openstreetmap.org, run by the OpenStreetMap Foundation, UK). This shares your IP address with them, as any website would. Address searches go through our server, so OpenStreetMap does not learn who searched. How long we keep it As long as you are a member. When you delete your account (Account → Delete account), your profile, contact details, photos, sign-ups and other personal data are removed immediately. Places you host alone are deleted too; shared places stay with the other hosts. Backups are kept for up to [30] days and then overwritten. Your rights You can see and correct your data on your profile and account pages, download a copy of everything we hold about you (Account → Download my data), and delete your account at any time. You also have the right to object to or restrict processing. Contact [privacy contact email] for anything else. If you think we handle your data wrongly, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si). Age Members must be at least 18 years old, or join together with a parent or guardian. Changes If we change how we use your data, we will update this notice and tell members.