Publish privacy and cookie disclosures

docs/DATA-PROTECTION.md

@@ -0,0 +1,53 @@
+# Website data-protection operations
+
+This document supports the public Privacy and Cookie Notice. It is an
+operational checklist and must be kept aligned with the site's real
+configuration.
+
+## Controller details
+
+- Registered name: Family Federation For World Peace and Unification
+- Registered Charity Number: 20010195
+- Revenue charity number: CHY 6071
+- Address: 19 North Great Georges Street, Dublin 1, Ireland
+- Privacy contact: info@familyfed.ie
+
+## Contact form and Formspree
+
+The production form endpoint is configured in `src/config/contact.ts` or by the
+`PUBLIC_CONTACT_FORM_ENDPOINT` build variable. Formspree is a processor for the
+name, email address, topic, message, request metadata and privacy-notice version
+sent through the form.
+
+The Formspree account owner must:
+
+1. Accept or obtain Formspree's Article 28 Data Processing Addendum and retain
+   a copy with the organisation's processor records.
+2. Record Formspree's Standard Contractual Clauses and current subprocessor
+   information for the transfer assessment.
+3. Restrict the form to `familyfed.ie` in Formspree's domain-restriction
+   settings.
+4. Require multi-factor authentication and limit dashboard access to people who
+   need to handle enquiries.
+5. Delete raw Formspree submissions and related email correspondence no later
+   than 24 months after the last meaningful contact, unless a documented legal
+   or organisational reason requires longer retention. Routine messages should
+   be removed sooner where practical.
+6. Review routing, integrations, auto-replies and notification recipients at
+   least annually and after personnel changes.
+7. Record and investigate suspected unauthorised access or disclosure under the
+   organisation's personal-data breach process.
+
+The form includes `privacy_notice_version=2026-07-27` in each hosted submission
+so the notice shown at collection can be identified. This field records
+transparency, not consent.
+
+## Website providers
+
+- Cloudflare provides DNS/proxying, security, network reporting and Web
+  Analytics.
+- Formspree processes contact-form submissions.
+- Google/YouTube provides embedded video players.
+
+Review the public notice and this record whenever one of these providers,
+settings or purposes changes.