Differences

This shows you the differences between two versions of the page.

--- shared:privacy_setup [2021/12/12 22:30] – [Privacy Setup] ggmei
+++ shared:privacy_setup [2022/03/08 18:50] (current) – ggmei
@@ Line 1: / Line 1: @@
-====== Privacy Setup ======
+====== Privacy Setup (DRAFT) ======
 The scope of the [[https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en|European GDPR law]], and of the other data protection laws for other countries, is wide and affects how the company processes all kinds of personal data.
-Some of this processing happens on the website, which has to be compliant with the law. Three elements are needed:
+Some of this processing happens on the website, which has to be compliant with the law. Three elements are strictly needed:
   - The design of the website must be compliant
-  - [[#privacy_and_cookie_policies|Privacy & Cookie policies]] have to be provided
+  - [[#privacy_and_cookie_policies|Privacy & Cookie policies]], either provided by the company or via Cone
-  - [[#cookie_consent|Cookie consent]] has to be obtained by the users before placing any cookie
+  - [[#cookie_consent|Cookie consent]] and block/unblock cookies, usually but not necessarily provided by Cone
-There are also two further elements, that are less clear about the practical implementation and need:
+There are also two further elements that may be activated on company's requests:
   * [[#cookie_preference_log|Cookie preference log]]
   * [[#record_of_consents|Record of consents]]
@@ Line 16: / Line 16: @@
 These policies are meant to give transparency about the data treatments.
+**What to do**: the company can provide their texts, or both policies can be automatically generated by Cone with Iubenda. In both cases, the responsibility of the legal compliance lies on the company, which must control and approve the policies and keep them updated (directly, via third-party services, or via Cone).
+**Costs**: if the company provides the policies, then they are just editorial content and there is no cost. If Cone sets them up with a third-party service, for each language of the website there is an extra annual fee, which includes Cone and third-party's fees.
 References:
@@ Line 25: / Line 29: @@
   * separated pages [[https://www.iubenda.com/privacy-policy/40961749|BH Privacy]] and [[https://www.iubenda.com/privacy-policy/40961749/cookie-policy|BH Cookies]]
-**What to do**: the company can provide their texts, or both policies can be automatically generated by Cone with Iubenda. In both cases, the responsibility of the legal compliance lies on the company, which must control and approve the policies and keep them updated (directly or through Cone).
+==== Cookie consent ====
-**Costs**: if the company provides them they are just editorial content, and there is no cost. If Cone sets them up, for each language of the website there is an annual fee that adds to the maintenance annual fee, which includes Cone management and Iubenda's fees.
+The //cookie law// exists since before the GDPR and complements it (see [[https://www.iubenda.com/en/help/5525-cookies-gdpr-requirements|this article]]). It requires not to install any tracking cookie (or any data with tracking purposes) before having obtained an informed consent from the user.
-:!: list typical services to be included in the policies
+**What to do**: a law-compliant banner must be shown to the user before the navigation starts to block any tracking cookie installation (e.g. YouTube, marketing platforms, ...), provide detailed information, obtain consent, unblock the installation of the cookies. This technical blocking device can be implemented with third-party services, normally by Cone but the company may have their service of choice, and must be installed by Cone on the website.
-:!: add the legal text for mentioning Cone as sub-processor
+**Cost**: extra on the annual fee, which includes Cone and third-party's fees. It's a flat fee that doesn't depend on the number of languages.
+Iubenda's Cookie consent solution:
+  * [it] https://www.iubenda.com/it/help/680-introduzione-cookie-solution
+  * [en] https://www.iubenda.com/en/help/1177-cookie-solution-getting-started
-==== Cookie consent ====
+==== Cookie preference log ====
-  * Cookie law
+Registro Preferenze Cookie
-    * [it] https://www.iubenda.com/it/help/680-introduzione-cookie-solution
-    * [en] https://www.iubenda.com/en/help/1177-cookie-solution-getting-started
+https://cookie-script.com/record-visitor-consents.html
+==== Record of consents ====
-https://www.iubenda.com/en/help/5525-cookies-gdpr-requirements
+It is also a broad requirement to keep a record of all the given consents. How this applies to the website processing in general is less clear.
-https://www.iubenda.com/en/help/6469-consent-solution-getting-started
+One approach is to keep a record of a case by case processing, such as:
+  * keep a screenshot of the information and registration forms
+  * keep a list of registration and information requests with date and IP
+  * see case by case for every other service used (newsletters, CRM etc.)
-==== Cookie preference log ====
+There are on the market also systems to cover this organically (see for example [[https://www.iubenda.com/en/help/6469-consent-solution-getting-started|Iubenda Consent solution]]) which also need to be integrated manually with every processing source.
-Registro Preferenze Cookie
+**Cost**: extra on the annual fee
-==== Record of consents ====
+==== GDPR references ====
+  * Iubenda on GDPR and other privacy laws [it] https://www.iubenda.com/it/help/5424-guida-gdpr
+  * Frequent cases (blog, ecommerce, newsletter) [it] https://www.iubenda.com/it/help/9113-blog-gdpr-come-adeguarsi