Privacy Notice

[jeffsmith82]

Is it possible to include a text box to the manage subscriptions page so that we can add a privacy notice on how any data we collect will be used.

Basically want to post something like We will only collect email addresses and they will only be used for communicating with you about the services you are subscribed to or security related issues.

I believe this notice is required by GDPR.

[welcome]

👋 Thank you for opening your first issue. I'm just an automated bot that's here to help you get the information you need quicker, so please ignore this message if it doesn't apply to your issue.
If you're looking for support, you should try the Slack group by registering your email address at https://cachethq-slack.herokuapp.com. Alternatively, email [email protected] for our Professional support service (please note, this a paid service.
If you're issue is with documentation, you can suggest edits by clicking the Suggest Edits link on any page, or open an issue at https://github.com/CachetHQ/Docs

[vantzs]

Take a look at my website Carolinas Cloud this website uses this script found on CookieConsent. I will include my sample usage of the script below.

<!-- Begin Cookie Consent plugin by Silktide - http://silktide.com/cookieconsent -->
<script type="text/javascript"> window.cookieconsent_options = {"message":"This website uses cookies to ensure you get the best experience on our website","dismiss":"Got it!","learnMore":"More info","link":"https://www.carolinascloud.com/privacy-policy/","theme":"dark-bottom"}; </script>

<script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/1.0.10/cookieconsent.min.js"></script>
<!-- End Cookie Consent plugin -->
With this you should be able to hang a privacy-policy page off of your main site like I did and point this to it. From there once they click Got It! or what ever your close button uses you'll be good to go.

Once you get your code wrote you can deploy it from Dashboard -> Settings -> Customization and put it in the Footer HTML box.

Hope this helps!

[jbrooksuk]

Cachet isn’t storing any personally identifiable information, so shouldn’t fall under GDPR.

[jbrooksuk]

Please correct me if I’m wrong.

[SnowBlinderP]

@jbrooksuk If a User "subscribes" to a Cachet Instance (Email Notification) then Cachet stores the Mail Adresse in the Databases - Right?
Email Adresses are Personal Information which requires declaring it (GDPR)

So if im not completely wrong then Cachet needs to Display a Textbox (or something) with a Privacy Notice of some kind

(some1 correct me if im wrong)

[jbrooksuk]

@SnowBlinderP true, I must've been talking stupid that day 😂

That said, I wonder if because Cachet is self-hosted, the privacy policy should be handled by the data controller (the people running the instance) as their use of the email may extend beyond what Cachet itself does?

[SnowBlinderP]

@jbrooksuk I think the Privacy Policy needs to be handled by 2 Instances

1. The Person maintaining the Cachet Installation.
2. The Person running the Web / Database Server (If Person 1 is using Managed Webshosting or something like that).
   But it would be really nice to have a Text Box for the Privacy Policy inside of Cachet

For Everything else (in example => i copy your Mail Address out of the Database and send u a Email via Gmail or Stuff) there needs to be a Section in the Privacy Policy of the Company

(Please Correct me if i misunderstood something)

[jbrooksuk]

I'm unsure in this case, sorry.

I guess, if people are subscribing to updates, they need to agree to a privacy policy of some sort under GDPR. The issue here is that what the policy says, is not guaranteed to be how the person running the installation will use the data.

I'll see if I can find out more.

[SnowBlinderP]

@jbrooksuk You could implement a "Default" Policy for default Usage (If People only use it with Cachet) and also add a Textbox in the Administration Part so Users can adjust it for their needs and purpose

[jbrooksuk]

@SnowBlinderP that could work, yeah. This would be one part of the system which I would not want to be translated because it'd be hard to keep them updated with any changes that come in. Also, how would we go about versioning it?

I've asked on a Facebook group for GDPR Planning & Compliance Group to see what they think.

[SnowBlinderP]

@jbrooksuk Yep Translation would be bad
What do u mean by Versioning it?

[jbrooksuk]

My understanding is that any revised policies must be versioned so that you can see how they were at the time you subscribed?

[SnowBlinderP]

I think thats Correct | So you need to store any Version of the Privacy Policy in the Database so the User can go back to his Version when he Subscribed

Another Idea would be to send 2 Mails

1. "Confirm your Subscription"
   and
2. "Our Privacy Policy for Email / Subscriptions"

[jbrooksuk]

I think you need to agree at the time of signup.

[SnowBlinderP]

The Agreement could be done via the "Confirmation" Email with a Sentence like "With Confirming your Subscription you Agree to our Privacy Policy which u can find here [link]" or something like that

[johnny-bit]

With GDPR there are many ways to skin a cat. Basically, user has to give clear consent for subscribing and text for subscription can't be "Subscribe to newsletter", but has to clearly say eg "Subscribe to be informed about service changes, every time the service changes. Your mail will only be used for informing about service changes, More information in our privacy policy".

WIth cachet not doing anything shady with user data and with clear subscription forms, cachet itself is in the clear with GDPR. Person hosting cachet is in the clear if subscription text is clear enough and person can honestly consent to receiving mails from that cachet instance. It's cachet instance owner's responsibility to disclose any additional thingies + you can't gather any more data than necessary to provide service the client consented to. And you can't use gathered data for any other purpose than user consented to.

Shady things that can be done:

• if instance owner gets subscibers mails from cachet DB without dislosing that to subscribers and then uses those mail to market services to them... then it's bad thing and in for punishment.
• if instance owner customizes subscription info gathering to include name, age, sex and others (in any combination) but all that's required for subscription is email, then it's kinda bad and is in for warning. Well, that can be circumvented by having eg Name + email form and mails sent out are like "Hey, %name%, the service you've subscribed to changed". Still - instance owner HAS to disclose cearly what for will those data be used.

Anyhow - All this can be handled by instance owner main site with clear links to appropriate legal documents with very little cachet having to do except for providing way to inform subscribers about legal stuff.

Another thing are staff members/admins that use cachet - they do too fall under GDPR, so instance owner has to inform them on how their data is being used/stored but this time it's easier - you have to have login credentials in order to be able to log in, so no need to say that out loud, because thats "by default". Generally it's best to read the whole GDPR and see for yourself, it's not cookie consent v2, but it's more for people than agains service owners.

[jbrooksuk]

Thanks for the very insightful post @johnny-bit. If we're confident that this is the case, then we introduce the consent check as part of #3102.

Once #3102 is completed, we'll only be collecting emails that have been verified. We should introduce a scheduled task that cleanses any emails that have not been verified within x time. This would also help us within GDPR, right?

[jbrooksuk]

@ALL do you have any examples of what the policy would need to look like?

[vantzs]

You can use my business' site as a template. It's been written by a team of lawyers in the US and in the UK to keep is legal in multiple countries. We paid for it but that's fine... I don't mind sharing it with others. They can just substitute our information for theirs.

https://www.carolinascloud.com/privacy-policy/

[gcommit]

Hi, when will this be added? Companies can be punished to penalties of several thousands of € if a user can't apply to the GDPR !!!!! This is highly important!!!

[jbrooksuk]

Thank you for your input on Cachet 2.x. We are shifting our attention and resources to Cachet 3.x and will no longer be supporting the 2.x version. If your feedback or issue is relevant to the 3.x series, we encourage you to engage with the new branch.

For more information on the Cachet rebuild and our plans for 3.x, you can read the announcement here.

We appreciate your understanding and look forward to your contributions to the new version.