From d45c0f54687204756717615ad1c1204828f364a0 Mon Sep 17 00:00:00 2001 From: Loyyd Date: Mon, 27 Jul 2026 18:51:08 +0200 Subject: [PATCH] Publish privacy and cookie disclosures --- css/site.css | 102 +++++++++++++++++ docs/DATA-PROTECTION.md | 53 +++++++++ src/components/SiteFooter.astro | 18 ++- src/components/SiteLayout.astro | 2 +- src/content/pages/contact.html | 8 ++ src/content/pages/privacy.html | 194 ++++++++++++++++++++++++++++++++ src/pages/contact.astro | 1 + src/pages/privacy.astro | 15 +++ 8 files changed, 388 insertions(+), 5 deletions(-) create mode 100644 docs/DATA-PROTECTION.md create mode 100644 src/content/pages/privacy.html create mode 100644 src/pages/privacy.astro diff --git a/css/site.css b/css/site.css index 65aca63d..39b435b9 100644 --- a/css/site.css +++ b/css/site.css @@ -890,6 +890,108 @@ a.speech-result.is-selected { color: #5c5c56; } +.contact-sensitive-note { + margin: 6px 0 0; + color: #686862; + font-size: 12px; + line-height: 1.5; +} + +.contact-privacy { + box-sizing: border-box; + margin: 2px 0; + padding: 12px 14px; + border-left: 3px solid #bf4d28; + background: #f5f3ef; + color: #4b4b47; + font-size: 13px; + line-height: 1.55; +} + +/* Privacy and cookie notice. */ +.privacy-notice { + max-width: 760px; +} + +.privacy-notice .notice-summary { + margin: 0 0 24px; + padding: 16px 18px; + border-left: 4px solid #bf4d28; + background: #f5f3ef; +} + +.privacy-notice h2 { + margin-top: 32px; +} + +.privacy-notice h3 { + margin-top: 22px; +} + +.privacy-notice table { + width: 100%; + margin: 18px 0 24px; + border-collapse: collapse; +} + +.privacy-notice th, +.privacy-notice td { + padding: 10px 12px; + border: 1px solid #d8d4cc; + vertical-align: top; + text-align: left; +} + +.privacy-notice th { + background: #f5f3ef; +} + +.privacy-notice .notice-updated { + color: #686862; + font-size: 12px; +} + +@media (max-width: 640px) { + .privacy-notice table, + .privacy-notice tbody, + .privacy-notice tr, + .privacy-notice th, + .privacy-notice td { + display: block; + } + + .privacy-notice thead { + position: absolute; + width: 1px; + height: 1px; + overflow: hidden; + clip: rect(0 0 0 0); + white-space: nowrap; + } + + .privacy-notice tr { + margin-bottom: 14px; + border: 1px solid #d8d4cc; + } + + .privacy-notice td { + border: 0; + border-bottom: 1px solid #e5e1da; + } + + .privacy-notice td:last-child { + border-bottom: 0; + } + + .privacy-notice td::before { + display: block; + margin-bottom: 3px; + color: #555550; + font-weight: 700; + content: attr(data-label); + } +} + /* Static events calendar. */ .events-calendar-page .entry-content { max-width: 100%; diff --git a/docs/DATA-PROTECTION.md b/docs/DATA-PROTECTION.md new file mode 100644 index 00000000..d72fb661 --- /dev/null +++ b/docs/DATA-PROTECTION.md @@ -0,0 +1,53 @@ +# Website data-protection operations + +This document supports the public Privacy and Cookie Notice. It is an +operational checklist and must be kept aligned with the site's real +configuration. + +## Controller details + +- Registered name: Family Federation For World Peace and Unification +- Registered Charity Number: 20010195 +- Revenue charity number: CHY 6071 +- Address: 19 North Great Georges Street, Dublin 1, Ireland +- Privacy contact: info@familyfed.ie + +## Contact form and Formspree + +The production form endpoint is configured in `src/config/contact.ts` or by the +`PUBLIC_CONTACT_FORM_ENDPOINT` build variable. Formspree is a processor for the +name, email address, topic, message, request metadata and privacy-notice version +sent through the form. + +The Formspree account owner must: + +1. Accept or obtain Formspree's Article 28 Data Processing Addendum and retain + a copy with the organisation's processor records. +2. Record Formspree's Standard Contractual Clauses and current subprocessor + information for the transfer assessment. +3. Restrict the form to `familyfed.ie` in Formspree's domain-restriction + settings. +4. Require multi-factor authentication and limit dashboard access to people who + need to handle enquiries. +5. Delete raw Formspree submissions and related email correspondence no later + than 24 months after the last meaningful contact, unless a documented legal + or organisational reason requires longer retention. Routine messages should + be removed sooner where practical. +6. Review routing, integrations, auto-replies and notification recipients at + least annually and after personnel changes. +7. Record and investigate suspected unauthorised access or disclosure under the + organisation's personal-data breach process. + +The form includes `privacy_notice_version=2026-07-27` in each hosted submission +so the notice shown at collection can be identified. This field records +transparency, not consent. + +## Website providers + +- Cloudflare provides DNS/proxying, security, network reporting and Web + Analytics. +- Formspree processes contact-form submissions. +- Google/YouTube provides embedded video players. + +Review the public notice and this record whenever one of these providers, +settings or purposes changes. diff --git a/src/components/SiteFooter.astro b/src/components/SiteFooter.astro index f7b2140f..2cb2b35b 100644 --- a/src/components/SiteFooter.astro +++ b/src/components/SiteFooter.astro @@ -1,17 +1,27 @@ +--- +const currentYear = new Date().getFullYear(); +--- +