GDPR compliance #862 - Githubissues

ushahidi / tenfour

API For TenFour

MIT License

7 stars 3 forks source link

GDPR compliance #862 #67

Open CeciliaHinga opened 5 years ago

CeciliaHinga commented 5 years ago

COGECO, a $30k deal, wants to be sure we are GDPR compliant. We need to complete this by May when they want to start using the app.

[x] Update Privacy policy to reflect GDPR compliance including SMS Gateways
[ ] Delete user and org avatars from storage if user or org is deleted
[ ] Delete chargebee accounts if organisation is deleted
[x] Delete csv files an hour after upload is done
[ ] Document how we are to give data to users - for the sake of the right to download/ get data

CeciliaHinga commented 5 years ago

There is one thing that came up on discussion with Linda, if I recall correctly. It would be to discard the CSV files uploaded to the private S3bucket, once they have been processed.

We could implement this easily with a lifecycle rule that would discard files X seconds after their creation (i.e. the following day).

Shall I apply such rule to the private bucket, but only to the "contacts" folder?

CeciliaHinga commented 5 years ago

@tuxpiper Yes. Ok to discard files in contacts folder after 24 hours.

CeciliaHinga commented 5 years ago

@tuxpiper can you confirm if the first part is done? Thanks

CeciliaHinga commented 5 years ago

Files with contacts (csv) are removed about a day after their upload . One more item of the list down.

CeciliaHinga commented 5 years ago

Great! Thanks David.