Differences

This shows you the differences between two versions of the page.

--- shared:privacy_setup [2021/12/13 07:47] – [Cookie consent] ggmei
+++ shared:privacy_setup [2022/03/08 18:50] (current) – ggmei
@@ Line 1: / Line 1: @@
-====== Privacy Setup ======
+====== Privacy Setup (DRAFT) ======
 The scope of the [[https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en|European GDPR law]], and of the other data protection laws for other countries, is wide and affects how the company processes all kinds of personal data.
-Some of this processing happens on the website, which has to be compliant with the law. Three elements are needed:
+Some of this processing happens on the website, which has to be compliant with the law. Three elements are strictly needed:
   - The design of the website must be compliant
-  - [[#privacy_and_cookie_policies|Privacy & Cookie policies]] have to be provided
+  - [[#privacy_and_cookie_policies|Privacy & Cookie policies]], either provided by the company or via Cone
-  - [[#cookie_consent|Cookie consent]] has to be obtained by the users before placing any cookie
+  - [[#cookie_consent|Cookie consent]] and block/unblock cookies, usually but not necessarily provided by Cone
-There are also two further elements, that are less clear about the practical implementation and need:
+There are also two further elements that may be activated on company's requests:
   * [[#cookie_preference_log|Cookie preference log]]
   * [[#record_of_consents|Record of consents]]
@@ Line 16: / Line 16: @@
 These policies are meant to give transparency about the data treatments.
+**What to do**: the company can provide their texts, or both policies can be automatically generated by Cone with Iubenda. In both cases, the responsibility of the legal compliance lies on the company, which must control and approve the policies and keep them updated (directly, via third-party services, or via Cone).
+**Costs**: if the company provides the policies, then they are just editorial content and there is no cost. If Cone sets them up with a third-party service, for each language of the website there is an extra annual fee, which includes Cone and third-party's fees.
 References:
@@ Line 24: / Line 28: @@
   * single page [[https://www.iubenda.com/privacy-policy/657257/full-legal|Privacy and Cookie Apposta]]
   * separated pages [[https://www.iubenda.com/privacy-policy/40961749|BH Privacy]] and [[https://www.iubenda.com/privacy-policy/40961749/cookie-policy|BH Cookies]]
-**What to do**: the company can provide their texts, or both policies can be automatically generated by Cone with Iubenda. In both cases, the responsibility of the legal compliance lies on the company, which must control and approve the policies and keep them updated (directly, via third-party services, or via Cone).
-**Costs**: if the company provides the policies, then they are just editorial content and there is no cost. If Cone sets them up with a third-party service, for each language of the website there is an extra annual fee, which includes Cone and third-party's fees.
 ==== Cookie consent ====
@@ Line 37: / Line 37: @@
 **Cost**: extra on the annual fee, which includes Cone and third-party's fees. It's a flat fee that doesn't depend on the number of languages.
-** Cookie consent solution **
+Iubenda's Cookie consent solution:
   * [it] https://www.iubenda.com/it/help/680-introduzione-cookie-solution
   * [en] https://www.iubenda.com/en/help/1177-cookie-solution-getting-started
@@ Line 45: / Line 45: @@
 Registro Preferenze Cookie
+https://cookie-script.com/record-visitor-consents.html
 ==== Record of consents ====
+It is also a broad requirement to keep a record of all the given consents. How this applies to the website processing in general is less clear.
+One approach is to keep a record of a case by case processing, such as:
+  * keep a screenshot of the information and registration forms
+  * keep a list of registration and information requests with date and IP
+  * see case by case for every other service used (newsletters, CRM etc.)
+There are on the market also systems to cover this organically (see for example [[https://www.iubenda.com/en/help/6469-consent-solution-getting-started|Iubenda Consent solution]]) which also need to be integrated manually with every processing source.
+**Cost**: extra on the annual fee
+==== GDPR references ====
+  * Iubenda on GDPR and other privacy laws [it] https://www.iubenda.com/it/help/5424-guida-gdpr
+  * Frequent cases (blog, ecommerce, newsletter) [it] https://www.iubenda.com/it/help/9113-blog-gdpr-come-adeguarsi
-https://www.iubenda.com/en/help/6469-consent-solution-getting-started