Privacy policies

[jpmckinney]

Add/update privacy policies (also listed in health sheet)

Edit: Link to main privacy policy at www.open-contracting.org:

• [x] https://standard.open-contracting.org/review/terms/
• [x] https://standard.open-contracting.org/infrastructure/review/terms/
• [x] https://standard.open-contracting.org/latest/en/
• https://open-contracting.health/pages/privacy-policy Will be decommissioned instead

Consider adding missing policies:

• Extension Explorer: Fathom, no cookies, GitHub-hosted (no analytics or server logs)
  • Can be updated to use common footer
• [x] Data Registry: Fathom, no cookies (except for admin), Hetzner-hosted (server logs)
  • Links to main privacy policy via common footer
• Spoonbill
  • Can be updated to use common footer
• BI Tool
  • Can be updated to use common footer

[jpmckinney]

To reduce the number of cookies in Django applications, we can:

• Disable CSRF and sessions on anonymous apps (like CoVE) https://docs.djangoproject.com/en/dev/ref/csrf/

• Set the language in the path instead of the cookie https://docs.djangoproject.com/en/3.2/topics/i18n/translation/#django.conf.urls.i18n.i18n_patterns

Data processors:

• Ask Dogsbody for general privacy and security statement

• https://usefathom.com/compliance and https://usefathom.com/docs/start/policy

  While adding this text can assure your website visitors that you value their privacy, there is no legal requirement to add this (or similar).

Reference for cookie descriptions:

• https://pypi.org/project/django-cookiebanner/
• For HotJar, there were links/descriptions in cove-ocds https://github.com/open-contracting/cove-ocds/commit/0c12e9ad10d89ce7c89ada9e7468e0e9652e3b8b

Reference for general wording:

• https://www.privacypolicies.com/our-terms-of-use/
• https://www.privacypolicies.com/our-disclaimer/
• https://www.privacypolicies.com/our-privacy-policy/
• https://www.mozilla.org/en-US/about/legal/terms/mozilla/

cove-ocds has an in-progress branch: https://github.com/open-contracting/cove-ocds/tree/privacy-policy

[jpmckinney]

New OCP general privacy policy: https://www.open-contracting.org/terms-of-use/

[jpmckinney]

I opened some issues (above). This can now be closed.