====== Privacy Setup (DRAFT) ======

The scope of the [[https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en|European GDPR law]], and of the other data protection laws for other countries, is wide and affects how the company processes all kinds of personal data. 

Some of this processing happens on the website, which has to be compliant with the law. Three elements are strictly needed:

  - The design of the website must be compliant
  - [[#privacy_and_cookie_policies|Privacy & Cookie policies]], either provided by the company or via Cone
  - [[#cookie_consent|Cookie consent]] and block/unblock cookies, usually but not necessarily provided by Cone

There are also two further elements that may be activated on company's requests:
  * [[#cookie_preference_log|Cookie preference log]]
  * [[#record_of_consents|Record of consents]]

==== Privacy and Cookie policies ====

These policies are meant to give transparency about the data treatments.

**What to do**: the company can provide their texts, or both policies can be automatically generated by Cone with Iubenda. In both cases, the responsibility of the legal compliance lies on the company, which must control and approve the policies and keep them updated (directly, via third-party services, or via Cone).

**Costs**: if the company provides the policies, then they are just editorial content and there is no cost. If Cone sets them up with a third-party service, for each language of the website there is an extra annual fee, which includes Cone and third-party's fees.

References:
  * [it] https://www.iubenda.com/it/help/467-generare-privacy-policy
  * [en] https://www.iubenda.com/en/help/463-generate-privacy-policy

Examples:
  * single page [[https://www.iubenda.com/privacy-policy/657257/full-legal|Privacy and Cookie Apposta]]
  * separated pages [[https://www.iubenda.com/privacy-policy/40961749|BH Privacy]] and [[https://www.iubenda.com/privacy-policy/40961749/cookie-policy|BH Cookies]]

==== Cookie consent ====

The //cookie law// exists since before the GDPR and complements it (see [[https://www.iubenda.com/en/help/5525-cookies-gdpr-requirements|this article]]). It requires not to install any tracking cookie (or any data with tracking purposes) before having obtained an informed consent from the user. 

**What to do**: a law-compliant banner must be shown to the user before the navigation starts to block any tracking cookie installation (e.g. YouTube, marketing platforms, ...), provide detailed information, obtain consent, unblock the installation of the cookies. This technical blocking device can be implemented with third-party services, normally by Cone but the company may have their service of choice, and must be installed by Cone on the website.

**Cost**: extra on the annual fee, which includes Cone and third-party's fees. It's a flat fee that doesn't depend on the number of languages.
 
Iubenda's Cookie consent solution:
  * [it] https://www.iubenda.com/it/help/680-introduzione-cookie-solution
  * [en] https://www.iubenda.com/en/help/1177-cookie-solution-getting-started

==== Cookie preference log ====

Registro Preferenze Cookie

https://cookie-script.com/record-visitor-consents.html
==== Record of consents ====

It is also a broad requirement to keep a record of all the given consents. How this applies to the website processing in general is less clear. 

One approach is to keep a record of a case by case processing, such as:
  * keep a screenshot of the information and registration forms
  * keep a list of registration and information requests with date and IP 
  * see case by case for every other service used (newsletters, CRM etc.)

There are on the market also systems to cover this organically (see for example [[https://www.iubenda.com/en/help/6469-consent-solution-getting-started|Iubenda Consent solution]]) which also need to be integrated manually with every processing source.

**Cost**: extra on the annual fee


==== GDPR references ====

  * Iubenda on GDPR and other privacy laws [it] https://www.iubenda.com/it/help/5424-guida-gdpr
  * Frequent cases (blog, ecommerce, newsletter) [it] https://www.iubenda.com/it/help/9113-blog-gdpr-come-adeguarsi