Update privacy staement

_includes/head.html

@@ -30,7 +30,6 @@
   _paq.push(["setDoNotTrack", true]);
   _paq.push(["disableCookies"]);
   _paq.push(['trackPageView']);
-  _paq.push(['enableLinkTracking']);
   (function() {
     var u="https://webstats.elixir-europe.org/";
     _paq.push(['setTrackerUrl', u+'matomo.php']);

privacy.md

@@ -8,7 +8,9 @@ hero_image: /img/heroes/hero-discussion.webp
 hero_darken: true
 ---
 
-This Privacy Policy explains what personal data is collected by the BioHackathon website.
+ELIXIR operates under the data protection framework provided by the [European Molecular Biology Laboratory (EMBL)](https://www.embl.org/) - known as [Internal Policy 68 (IP68)](https://www.embl.org/documents/document/internal-policy-no-68-on-general-data-protection/) on General Data Protection - which is adapted to the needs of international scientific research and reflects the principles of European data protection law.
+
+The [ELIXIR Hub](https://elixir-europe.org/about-us/who-we-are/hub) is the data controller of any data collected by the BioHackathon website.
 
 ## What data we collect
 We collect data about activity on the site, such as:
@@ -21,21 +23,33 @@ We collect data about activity on the site, such as:
 The information is collected anonymously and aggregated. We cannot identify you from the information gathered, or track your web browsing outside of this site.
 
 ## How we collect the data
-We use [Matomo Analytics](https://matomo.org/) to collect this data. We have our own instance of Matomo, hosted in Germany, and we use Matomo **without setting cookies**. See the Matomo statement on its [GDPR compliance](https://matomo.org/gdpr-analytics/).
+We use [Matomo Analytics](https://matomo.org/) to collect this data. We have our own instance of Matomo, hosted in Germany, and we use Matomo **without setting analytics cookies**. See the Matomo statement on its [GDPR compliance](https://matomo.org/gdpr-analytics/).
 
-## Why we collect the data
+## Purposes of processing
 We collect the data so that we can then generate reports about the site for our funders. We also collect the date to help us improve the site, and ensure we design the site for the browsers and devices that most people are using.
 
-## Who has access to the data
-The data collected by Matomo is sent to our servers in Germany, and is only accessible by the website administrator.
+## Legal basis
+We process your data for the achievement of the aims laid down in the [ELIXIR Consortium Agreement](https://elixir-europe.org/sites/default/files/documents/elixir-consortium-agreement.pdf), for example, the legitimate interest to manage and administer ELIXIR activities, coordinate services and provide support to the ELIXIR Nodes and the user community (ECA Article 3.3).
 
-## If you have concerns about your data
-Please contact <[email protected]> if you have any queries concerning the data we may have.
+## Who has access to the data 
+ELIXIR website administrators may share aggregated reports with ELIXIR Hub Staff, such as those on the BioHackathon organising Committee, as well as the event Programme Committee.
 
-## Data collected by GitHub 
+## External data processors
+### GitHub
 The website is hosted on GitHub, and GitHub collects the IP addresses of site visitors for security purposes (see their [Data Collection statement](https://docs.github.com/en/pages/getting-started-with-github-pages/about-github-pages#data-collection)). This enables them to detect and block attacks on the sites hosted by them e.g. by blocking the IP address of the attacker.
 
-## YouTube videos and privacy
+### YouTube
 The YouTube videos embedded in this site are embedded using [privacy-enhanced mode](https://support.google.com/youtube/answer/171780?hl=en-GB#zippy=%2Cturn-on-privacy-enhanced-mode). 
 
-**Unfortunately this does not stop YouTube tracking your viewing habits.** Instead of a cookie, YouTube saves a snippet of data in another part of your browser, called local storage. We cannot stop this, and it is not covered by cookie regulations. When you start playing a video on this site, YouTube will then set some cookies in your browser to track your viewing habits, without asking for your consent. Again, we cannot turn this off. We have put a warning above each video so you can make an informed choice about whether to play the video or not.
+**Unfortunately this does not stop YouTube tracking your viewing habits.** Instead of a cookie, YouTube saves a snippet of data in another part of your browser, called local storage. We cannot stop this, and it is not covered by cookie regulations. When you start playing a video on this site, YouTube will then set some cookies in your browser to track your viewing habits, without asking for your consent. Again, we cannot turn this off. We have put a warning above each video so you can make an informed choice about whether to play the video or not.
+
+## Data retention
+Your anonymised data will be stored by ELIXIR in the form of generated graphs and aggregated reports indefinitely.
+
+## How to contact us
+If you wish to contact the data controller regarding any other data protection related matters, you can contact us via email (<[email protected]>) or by sending a letter to:<br>
+ELIXIR Hub<br>
+Wellcome Genome Campus<br>
+Hinxton<br>
+Cambridgeshire CB10 1SD, UK
+