How [Organisation name] processes the personal data of the members of this community, and what the members can
do about it.
*Version 1.0, effective [date].*
## 1. Who is responsible
[Organisation name], [address], is the controller of the personal data processed in this community. Questions
and requests: [email address], [or: our data protection officer, [name], [email address]].
Technical hosting is provided by CUZY, 80 St. Columbanus Road, Dundrum, Dublin 14, D14 WP98, Ireland, as our
processor under a data processing agreement: CUZY stores, backs up and keeps the software running on our
instructions and accesses the community only for support at our request, which is logged, or when the law
requires it.
## 2. What data, why, on which basis
| Purpose | Data | Legal basis |
|---|---|---|
| Your account | name, email address, password (stored hashed), profile picture, the profile fields you fill in, language | [the contract between you and us / our legitimate interest in running the community / your consent] |
| Using the community | posts, comments, messages, files, calendar entries, reactions, the spaces you join | the same |
| Security and operation | IP address and browser in the server logs (kept 14 days at most), login times, security events | our legitimate interest (security) |
| Notifications | the email address, for the notifications you enabled in your settings | the same basis as your account |
| [Optional: newsletters, surveys, specific modules] | [data] | [basis] |
We do not sell personal data, do not use it for advertising and do not profile members.
## 3. Who sees it
- The other members of the community, to the extent of the visibility you choose for each post (a space, the
whole community, or public if the administrators allow public content).
- The administrators and moderators, for running the community.
- CUZY, as processor, and its own sub-processors listed on
[cuzy.app/privacy](https://www.cuzy.app/privacy): the servers (Hetzner, in [Germany (EU) / the USA / Singapore
(APAC)]), encrypted backups (Backblaze, in the same region, except Singapore communities whose backups are stored
in the United States), email delivery (SMTP2GO), DNS (Cloudflare). Data stays in the region we chose; for a
region outside the EU the transfer rests on Standard Contractual Clauses.
- Nobody else, unless the law requires it.
## 4. How long
- Your account and content: for the duration of your membership, then deleted within [N] months after your
account is closed [or: anonymised: your name is removed, your posts stay for the other members].
- Server logs: 14 days at most.
- Backups: kept by the hosting schedule published at [cuzy.app/security](https://www.cuzy.app/security); a
deletion reaches the backups as they expire, within 12 months at most.
- When the community itself closes, its data is deleted at the latest 6 months after the end of our hosting
subscription.
## 5. Your rights
You may access your data, correct it (most of it from your profile settings), have it deleted, receive a copy
(we send it to you on request), restrict or object to some processing, and withdraw a consent at any
time. Write to [email address]; we answer within one month. You may complain to the supervisory authority of
[country]: [authority name and website].
## 6. Cookies
The community sets only the cookies it needs to work: see the cookie notice.
## 7. Security
One isolated environment per community, encryption in transit and of every backup, least-privilege access,
monitoring and tested restores, described by the host at [cuzy.app/security](https://www.cuzy.app/security). On our
side: [two-factor authentication for administrators, access reviews, a named person for data protection].
## 8. Changes
We announce a change of this policy in the community and apply it from the date the new version states. The
previous versions are available on request.