Publish privacy and cookie disclosures

css/site.css

@@ -890,6 +890,108 @@ a.speech-result.is-selected {
   color: #5c5c56;
 }
 
+.contact-sensitive-note {
+  margin: 6px 0 0;
+  color: #686862;
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.contact-privacy {
+  box-sizing: border-box;
+  margin: 2px 0;
+  padding: 12px 14px;
+  border-left: 3px solid #bf4d28;
+  background: #f5f3ef;
+  color: #4b4b47;
+  font-size: 13px;
+  line-height: 1.55;
+}
+
+/* Privacy and cookie notice. */
+.privacy-notice {
+  max-width: 760px;
+}
+
+.privacy-notice .notice-summary {
+  margin: 0 0 24px;
+  padding: 16px 18px;
+  border-left: 4px solid #bf4d28;
+  background: #f5f3ef;
+}
+
+.privacy-notice h2 {
+  margin-top: 32px;
+}
+
+.privacy-notice h3 {
+  margin-top: 22px;
+}
+
+.privacy-notice table {
+  width: 100%;
+  margin: 18px 0 24px;
+  border-collapse: collapse;
+}
+
+.privacy-notice th,
+.privacy-notice td {
+  padding: 10px 12px;
+  border: 1px solid #d8d4cc;
+  vertical-align: top;
+  text-align: left;
+}
+
+.privacy-notice th {
+  background: #f5f3ef;
+}
+
+.privacy-notice .notice-updated {
+  color: #686862;
+  font-size: 12px;
+}
+
+@media (max-width: 640px) {
+  .privacy-notice table,
+  .privacy-notice tbody,
+  .privacy-notice tr,
+  .privacy-notice th,
+  .privacy-notice td {
+    display: block;
+  }
+
+  .privacy-notice thead {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    overflow: hidden;
+    clip: rect(0 0 0 0);
+    white-space: nowrap;
+  }
+
+  .privacy-notice tr {
+    margin-bottom: 14px;
+    border: 1px solid #d8d4cc;
+  }
+
+  .privacy-notice td {
+    border: 0;
+    border-bottom: 1px solid #e5e1da;
+  }
+
+  .privacy-notice td:last-child {
+    border-bottom: 0;
+  }
+
+  .privacy-notice td::before {
+    display: block;
+    margin-bottom: 3px;
+    color: #555550;
+    font-weight: 700;
+    content: attr(data-label);
+  }
+}
+
 /* Static events calendar. */
 .events-calendar-page .entry-content {
   max-width: 100%;

docs/DATA-PROTECTION.md

@@ -0,0 +1,53 @@
+# Website data-protection operations
+
+This document supports the public Privacy and Cookie Notice. It is an
+operational checklist and must be kept aligned with the site's real
+configuration.
+
+## Controller details
+
+- Registered name: Family Federation For World Peace and Unification
+- Registered Charity Number: 20010195
+- Revenue charity number: CHY 6071
+- Address: 19 North Great Georges Street, Dublin 1, Ireland
+- Privacy contact: info@familyfed.ie
+
+## Contact form and Formspree
+
+The production form endpoint is configured in `src/config/contact.ts` or by the
+`PUBLIC_CONTACT_FORM_ENDPOINT` build variable. Formspree is a processor for the
+name, email address, topic, message, request metadata and privacy-notice version
+sent through the form.
+
+The Formspree account owner must:
+
+1. Accept or obtain Formspree's Article 28 Data Processing Addendum and retain
+   a copy with the organisation's processor records.
+2. Record Formspree's Standard Contractual Clauses and current subprocessor
+   information for the transfer assessment.
+3. Restrict the form to `familyfed.ie` in Formspree's domain-restriction
+   settings.
+4. Require multi-factor authentication and limit dashboard access to people who
+   need to handle enquiries.
+5. Delete raw Formspree submissions and related email correspondence no later
+   than 24 months after the last meaningful contact, unless a documented legal
+   or organisational reason requires longer retention. Routine messages should
+   be removed sooner where practical.
+6. Review routing, integrations, auto-replies and notification recipients at
+   least annually and after personnel changes.
+7. Record and investigate suspected unauthorised access or disclosure under the
+   organisation's personal-data breach process.
+
+The form includes `privacy_notice_version=2026-07-27` in each hosted submission
+so the notice shown at collection can be identified. This field records
+transparency, not consent.
+
+## Website providers
+
+- Cloudflare provides DNS/proxying, security, network reporting and Web
+  Analytics.
+- Formspree processes contact-form submissions.
+- Google/YouTube provides embedded video players.
+
+Review the public notice and this record whenever one of these providers,
+settings or purposes changes.

src/components/SiteFooter.astro

@@ -1,17 +1,27 @@
+---
+const currentYear = new Date().getFullYear();
+---
+
 <footer id="footer" role="contentinfo">
   <div id="colophon"></div>
 
   <div id="footer2">
     <div id="footer2-inner">
       <div id="site-copyright">
-        <b>Family Federation for World Peace and Unification (FFWPU) Ireland</b>
+        <b>Family Federation For World Peace and Unification</b>
         <br />
-        Charity no. CHY 6071 All Rights Reserved 2013
+        Registered Charity Number (RCN) 20010195 · CHY 6071
         <br />
-        <a href="/speeches/" target="_blank">Speeches</a>
+        19 North Great Georges Street, Dublin 1, Ireland
+        <br />
+        <a href="/privacy">Privacy Notice</a>
+        <span aria-hidden="true"> · </span>
+        <a href="/privacy#cookies">Cookie Notice</a>
+        <span aria-hidden="true"> · </span>
+        <a href="/contact">Contact</a>
       </div>
       <div style="text-align:center;padding:5px 0 2px;text-transform:uppercase;font-size:12px;margin:1em auto 0;">
-        Family Federation for World Peace and Unification Ireland
+        © {currentYear} Family Federation for World Peace and Unification Ireland
       </div>
     </div>
   </div>

src/components/SiteLayout.astro

@@ -79,7 +79,7 @@ const metaTitle = title
     <link rel="stylesheet" id="parabola-fonts-css" href="/assets/theme/parabola/fonts/fontfaces.css?ver=2.4.1-perf1" type="text/css" media="all" />
     <link rel="stylesheet" id="parabola-style-css" href="/assets/theme/parabola/style.css?ver=2.4.1" type="text/css" media="all" />
     <link rel="stylesheet" id="familyfedie-theme-css" href="/css/theme.css" type="text/css" media="all" />
-    <link rel="stylesheet" id="familyfedie-site-css" href="/css/site.css?ver=20260715-1" type="text/css" media="all" />
+    <link rel="stylesheet" id="familyfedie-site-css" href="/css/site.css?ver=20260727-1" type="text/css" media="all" />
     <link rel="stylesheet" id="parabola-mobile-css" href="/assets/theme/parabola/styles/style-mobile.css?ver=2.4.1" type="text/css" media="all" />
     {plausibleDomain && <script defer data-domain={plausibleDomain} src={plausibleScriptSrc}></script>}
     <script is:inline defer src="/js/site-20260715.js"></script>

src/content/pages/contact.html

@@ -37,8 +37,16 @@
   <div class="contact-field">
     <label for="contact-message">Message</label>
     <textarea id="contact-message" name="message" rows="7" required></textarea>
+    <p class="contact-sensitive-note">
+      Please do not include sensitive personal information unless it is necessary for us to respond to your enquiry.
+    </p>
   </div>
 
+  <p class="contact-privacy">
+    We use the details you provide to respond to your enquiry. The form is processed for us by Formspree and may
+    involve a transfer to the United States. Read our <a href="/privacy">Privacy Notice</a>.
+  </p>
+
   <div class="contact-actions">
     <button class="button" type="submit">Send message</button>
     <p id="contact-form-status" class="contact-form-status" aria-live="polite"></p>

src/content/pages/privacy.html

@@ -0,0 +1,194 @@
+<div id="post-privacy" class="page type-page status-publish hentry">
+  <h1 class="entry-title">Privacy and Cookie Notice</h1>
+
+  <div class="entry-content privacy-notice">
+    <p class="notice-updated">Last updated: 27 July 2026</p>
+
+    <div class="notice-summary">
+      <p>
+        This notice explains how Family Federation For World Peace and Unification uses personal data when you
+        visit familyfed.ie, contact us, or interact with content supplied by another service.
+      </p>
+    </div>
+
+    <h2>Who we are</h2>
+    <p>
+      Family Federation For World Peace and Unification is the controller of personal data described in this
+      notice. We are an Irish registered charity, RCN 20010195 and CHY 6071.
+    </p>
+    <p>
+      Our address is 19 North Great Georges Street, Dublin 1, Ireland. For privacy questions or to exercise your
+      data protection rights, email <a href="mailto:info@familyfed.ie">info@familyfed.ie</a>.
+    </p>
+
+    <h2>Information we collect and why</h2>
+
+    <h3>Contact enquiries</h3>
+    <p>
+      If you use our contact form or email us, we receive the name, email address, topic, message and other
+      information you choose to provide. We use this information to read, route, respond to and keep an
+      appropriate record of your enquiry.
+    </p>
+    <p>
+      Our lawful basis is normally our legitimate interest in answering enquiries and administering the
+      organisation. Where your request concerns a service or arrangement you may enter into with us, processing
+      may also be necessary to take steps at your request before entering into that arrangement.
+    </p>
+
+    <h3>Sensitive information</h3>
+    <p>
+      We do not ask you to state your religious beliefs or provide other special-category information in the
+      contact form. Please do not include sensitive information unless it is necessary for us to respond. Where
+      an enquiry does contain special-category information, we limit its use to the enquiry and apply an
+      appropriate condition under Article 9 of the GDPR, including explicit consent or the legitimate activities
+      of a not-for-profit body with a religious aim, where applicable.
+    </p>
+
+    <h3>Website delivery, security and logs</h3>
+    <p>
+      When you visit the site, our hosting and network provider Cloudflare processes technical request
+      information needed to deliver and protect the site. This may include an IP address, date and time, requested
+      page, browser or device information, referring page and security information. We use this processing for
+      our legitimate interests in providing a secure, reliable website and preventing abuse.
+    </p>
+
+    <h3>Website performance information</h3>
+    <p>
+      We use Cloudflare Web Analytics to understand page use and technical performance. Cloudflare states that
+      this service does not use cookies, local storage or cross-site tracking to collect its usage metrics.
+      Reports available to us are aggregated.
+    </p>
+
+    <h3>Embedded YouTube videos</h3>
+    <p>
+      The Videos and Founders pages contain players provided by YouTube, a Google service. When a page containing
+      a player loads, your browser connects to YouTube. Google may receive technical information such as your IP
+      address, device and browser details, the page containing the player and identifiers associated with your
+      browser or Google account. Google may use cookies or similar technologies for functionality, security,
+      analytics, personalisation and advertising according to your Google settings.
+    </p>
+    <p>
+      You can find further information in
+      <a href="https://policies.google.com/privacy" rel="noopener noreferrer">Google's Privacy Policy</a>.
+    </p>
+
+    <h2>Service providers and international transfers</h2>
+    <p>We use the following providers in operating the website:</p>
+    <ul>
+      <li>
+        <strong>Formspree, Inc.</strong> receives and stores contact-form submissions and sends notifications to
+        our authorised email recipients. Formspree hosts its service on Amazon Web Services in the United States
+        and states that it relies on the European Commission's Standard Contractual Clauses for transfers as a
+        processor.
+      </li>
+      <li>
+        <strong>Cloudflare, Inc.</strong> provides content delivery, security, network reporting and website
+        performance analytics. Information may be processed outside the European Economic Area subject to
+        applicable transfer safeguards.
+      </li>
+      <li>
+        <strong>Google/YouTube.</strong> provides embedded video players and may process information outside the
+        European Economic Area under Google's applicable transfer arrangements.
+      </li>
+    </ul>
+    <p>
+      We also use email and technical service providers where necessary to operate the organisation. We require
+      processors acting for us to protect personal data and process it only under appropriate instructions and
+      contractual terms.
+    </p>
+
+    <h2>How long we keep information</h2>
+    <p>
+      Contact-form submissions and related correspondence are normally kept for no longer than 24 months after
+      the last meaningful contact. We may delete routine enquiries sooner. We may keep information longer where
+      necessary to meet a legal obligation, resolve a dispute, protect legal rights or retain an appropriate
+      organisational record. Security and technical logs are kept only for the period reasonably required for
+      security, troubleshooting and service administration.
+    </p>
+
+    <h2 id="cookies">Cookie Notice</h2>
+    <p>
+      Cookies are small pieces of information stored on or read from your device. Similar technologies include
+      local storage, pixels and identifiers used by embedded services.
+    </p>
+
+    <table>
+      <thead>
+        <tr>
+          <th scope="col">Provider or technology</th>
+          <th scope="col">Purpose</th>
+          <th scope="col">When it is used</th>
+        </tr>
+      </thead>
+      <tbody>
+        <tr>
+          <td data-label="Provider or technology">Familyfed.ie</td>
+          <td data-label="Purpose">
+            The public site does not currently set first-party advertising or marketing cookies.
+          </td>
+          <td data-label="When it is used">No first-party advertising or marketing cookie is set by us.</td>
+        </tr>
+        <tr>
+          <td data-label="Provider or technology">Cloudflare security technologies</td>
+          <td data-label="Purpose">
+            Protecting the site, managing traffic, detecting malicious activity and maintaining network
+            reliability. Cloudflare may set strictly necessary cookies when a security feature requires them.
+          </td>
+          <td data-label="When it is used">Only when required by the applicable security or network feature.</td>
+        </tr>
+        <tr>
+          <td data-label="Provider or technology">Cloudflare Web Analytics</td>
+          <td data-label="Purpose">Aggregated page-use and website performance measurement.</td>
+          <td data-label="When it is used">
+            On site visits. Cloudflare states that this service does not use cookies or local storage for its
+            usage metrics.
+          </td>
+        </tr>
+        <tr>
+          <td data-label="Provider or technology">YouTube</td>
+          <td data-label="Purpose">
+            Displaying videos; service functionality, security, analytics, personalisation and advertising may
+            be provided by Google.
+          </td>
+          <td data-label="When it is used">
+            When pages containing an embedded YouTube player load and when you interact with a player. Cookie
+            names and lifetimes are controlled by Google and may depend on your Google settings.
+          </td>
+        </tr>
+      </tbody>
+    </table>
+
+    <p>
+      You can delete or block cookies through your browser settings. Blocking third-party content may prevent
+      embedded videos from working. If we introduce another optional analytics, advertising or marketing
+      technology, we will update this notice and request consent before using it where required.
+    </p>
+
+    <h2>Your data protection rights</h2>
+    <p>Subject to the GDPR and applicable limitations, you may ask us to:</p>
+    <ul>
+      <li>give you access to your personal data;</li>
+      <li>correct inaccurate or incomplete information;</li>
+      <li>delete your information;</li>
+      <li>restrict how we use it;</li>
+      <li>provide portable information where the right applies; or</li>
+      <li>stop processing based on legitimate interests.</li>
+    </ul>
+    <p>
+      Where processing is based on consent, you may withdraw that consent at any time without affecting earlier
+      lawful processing. Contact <a href="mailto:info@familyfed.ie">info@familyfed.ie</a> to make a request. We
+      may need to verify your identity before responding.
+    </p>
+    <p>
+      You may also complain to the
+      <a href="https://www.dataprotection.ie/" rel="noopener noreferrer">Data Protection Commission</a>, Ireland's
+      supervisory authority.
+    </p>
+
+    <h2>Changes to this notice</h2>
+    <p>
+      We will update this page when our processing or service providers change. The date at the top shows when
+      the notice was last revised.
+    </p>
+  </div>
+</div>

src/pages/contact.astro

@@ -98,6 +98,7 @@ const contactArticleHtml = articleHtml
         message.formData.set("_subject", message.subject);
         message.formData.set("_replyto", message.email);
         message.formData.set("site", "familyfed.ie");
+        message.formData.set("privacy_notice_version", "2026-07-27");
 
         try {
           const response = await fetch(config.endpoint, {

src/pages/privacy.astro

@@ -0,0 +1,15 @@
+---
+import SiteLayout from "../components/SiteLayout.astro";
+import TwoColumnPage from "../components/TwoColumnPage.astro";
+import articleHtml from "../content/pages/privacy.html?raw";
+---
+
+<SiteLayout
+  title="Privacy and Cookie Notice &#8211; FFWPU Ireland"
+  description="How FFWPU Ireland uses personal data, contact form submissions, cookies, website analytics and embedded media."
+  bodyClass="page-template-default page privacy-page custom-background tribe-no-js metaslider-plugin parabola-image-three caption-light meta-light parabola_triagles parabola-menu-left"
+  pathname="/privacy"
+  canonical="/privacy"
+>
+  <TwoColumnPage articleHtml={articleHtml} />
+</SiteLayout>