familyfedie-website/docs/DATA-PROTECTION.md
Loyyd 89745d3eec
All checks were successful
Publish static bundles / publish (push) Successful in 3m18s
Simplify footer privacy policy
2026-07-27 19:02:17 +02:00

2.2 KiB

Website data-protection operations

This document supports the public Privacy Policy. It is an operational checklist and must be kept aligned with the site's real configuration.

Controller details

  • Registered name: Family Federation For World Peace and Unification
  • Registered Charity Number: 20010195
  • Revenue charity number: CHY 6071
  • Address: 19 North Great Georges Street, Dublin 1, Ireland
  • Privacy contact: info@familyfed.ie

Contact form and Formspree

The production form endpoint is configured in src/config/contact.ts or by the PUBLIC_CONTACT_FORM_ENDPOINT build variable. Formspree is a processor for the name, email address, topic, message, request metadata and privacy-notice version sent through the form.

The Formspree account owner must:

  1. Accept or obtain Formspree's Article 28 Data Processing Addendum and retain a copy with the organisation's processor records.
  2. Record Formspree's Standard Contractual Clauses and current subprocessor information for the transfer assessment.
  3. Restrict the form to familyfed.ie in Formspree's domain-restriction settings.
  4. Require multi-factor authentication and limit dashboard access to people who need to handle enquiries.
  5. Delete raw Formspree submissions and related email correspondence no later than 24 months after the last meaningful contact, unless a documented legal or organisational reason requires longer retention. Routine messages should be removed sooner where practical.
  6. Review routing, integrations, auto-replies and notification recipients at least annually and after personnel changes.
  7. Record and investigate suspected unauthorised access or disclosure under the organisation's personal-data breach process.

The form includes privacy_policy_version=2026-07-27 in each hosted submission so the policy shown at collection can be identified. This field records transparency, not consent.

Website providers

  • Cloudflare provides DNS/proxying, security, network reporting and Web Analytics.
  • Formspree processes contact-form submissions.
  • Google/YouTube provides embedded video players.

Review the public notice and this record whenever one of these providers, settings or purposes changes.