Merge tag 'v3.1' into fiksgatami-devfiksgatami-dev

1 files changed, 188 insertions, 190 deletions

diff --git a/templates/web/fixmystreet-uk-councils/about/privacy.html b/templates/web/fixmystreet-uk-councils/about/privacy.html
index e7ef6b377..aee2f6978 100644
--- a/templates/web/fixmystreet-uk-councils/about/privacy.html
+++ b/templates/web/fixmystreet-uk-councils/about/privacy.html
@@ -1,12 +1,10 @@
 [% INCLUDE 'header.html',
-    title = loc('Privacy and cookies'),
+    title = 'Privacy policy',
     bodyclass = 'twothirdswidthpage' %]
 
 [% INCLUDE 'about/_sidebar.html' %]
 
-<h1>Privacy, cookies, and third party services</h1>
-
-<h2>Privacy Policy</h2>
+<h1>Privacy policy</h1>
 
 [% IF c.cobrand.moniker == 'bathnes' %]
 <p>Your email address identifies you and your report, and so it is your
@@ -18,44 +16,43 @@ else, for other purposes.
 
 <p>Further information about the Council’s treatment of personal data, and your
 privacy rights, is available in our
-<a href="http://www.bathnes.gov.uk/services/your-council-and-democracy/data-protection-and-freedom-information/council-privacy-notice">Privacy Notice</a>.
+<a href="https://www.bathnes.gov.uk/services/your-council-and-democracy/data-protection-and-freedom-information/council-privacy-notice">Privacy Notice</a>.
 The Council’s Data Protection Officer may be contacted at
 <a href="mailto:data_protection@bathnes.gov.uk">data_protection@bathnes.gov.uk</a>.
 
 <hr>
 [% END %]
 
+<h2>Who runs this service?</h2>
+
 <p>
-    FixMyStreet is run by the charity <a href="https://www.mysociety.org/">mySociety</a>.
+    This site is a service provided to [% c.cobrand.council_name %] by
+    <a href="https://www.societyworks.org/">SocietyWorks Ltd</a>, a limited
+    company (05798215). SocietyWorks is a trading subsidiary of mySociety, a
+    registered charity in England and Wales (1076346), who also run the
+    national <a href="https://www.fixmystreet.com/">fixmystreet.com</a> website
+    with which this site is linked. Henceforth this privacy policy will refer
+    to mySociety.
 </p>
 
 <p>
-    Working in the fields of transparency and accountability, mySociety thinks hard and
-    cares very much about the privacy and security of our users: the length of this
-    privacy policy is one result of that. We know no-one goes through Privacy Policies for
-    fun though, so we’ve tried to keep it a clear and reasonably quick read.
+    Reports made on this site also appear on fixmystreet.com, and vice versa.
 </p>
 
 <p>
-    We hope it covers everything you need to know, but if you still have any questions
-    please feel free to <a href="/contact">contact us</a>.
+    These reports and the associated user data are stored in a single database
+    which is hosted by mySociety. They are accessible to mySociety and
+    [% c.cobrand.council_name %] administrators.
 </p>
 
 <h2>What information we collect and how we use it</h2>
 
-<p>
-    When you submit a report, <b>we pass on your details, and details of the issue, to the
-    council contact</b> or contacts responsible for the area where you located the issue, or
-    other relevant body such as TfL.
-</p>
-
 <h3>
 When you make a report
 </h3>
 
 <p>
-    When you use FixMyStreet to send a report, you provide us with personal information
-    including:
+    You may have provided us with personal information including:
 </p>
 
 <ul>
@@ -64,74 +61,94 @@ When you make a report
 </ul>
 
 <p>
-    We <b>send this information to the body responsible for fixing your issue</b>, as per your
-    choice of category and location.
+    This information, together with details of the issue, are routed directly
+    to the contact or contacts responsible for fixing it, based on two pieces
+    of data: the issue category, and its location.
 </p>
 
 <p>
-    At the same time, <b>your report appears on the FixMyStreet website</b>. Your email address
-    and phone number are not published, and your name is only published if you have opted
-    to do so.
+    If the issue is the responsibility of [% c.cobrand.council_name %], your
+    report comes into our system. But this site also has the ability to route
+    your report to a different authority if they are the ones responsbile for
+    it. This might be a different council, or a body such as TfL or Highways
+    England.
 </p>
 
 <p>
-    Some councils use FixMyStreet on their own websites. If you make a report within the
-    boundaries of one of these councils (either through FixMyStreet.com or via the council
-    website), it will be published on both sites.
+    If the report falls within our boundaries, <b>your report appears publicly
+    on both this site and on fixmystreet.com</b>, in some cases even if it has
+    been sent to another authority. It may additionally appear on that other
+    authority’s website, if they also use FixMyStreet as their reporting
+    software.
 </p>
 
 <p>
-    FixMyStreet provides RSS/JSON feeds which allow anyone to publish reports on their own
-    website or page. Typically these feeds consist of reports made within a specific local
-    area, and are published on community or local interest sites.
+    Information that you enter in the email address and phone number fields
+    <strong>are not published</strong>, and your name is <strong>only published
+    if you have checked the box opting to do so</strong>.
 </p>
 
 <p>
-    Note that anything you include in the body of your report will be published in one or
-    all of the places listed above, so please take care to keep personal information such
-    as your contact details to the correct fields.
+    FixMyStreet provides RSS/JSON feeds, accessible from both fixmystreet.com
+    and this site, which allow anyone to publish reports on their own website
+    or page. Typically these feeds consist of reports made within a specific
+    local area, and are published on community or local interest sites.
 </p>
 
 <p>
-    We <b>store your personal details</b>, along with your password where used (passwords are
-    stored in a format that is unreadable to anyone — including us —  known as a hash) and
-    any reports or updates you make, in our own database.
+  [% IF c.cobrand.moniker == 'cheshireeast' %]
+    Anything you include in the body of your report will be published in one or
+    all of the places listed above, so <strong>keep personal information such
+        as your contact details to the correct fields</strong>.
+  [% ELSE %]
+    <strong>Note that</strong> anything you include in the body of your report
+    will be published in one or all of the places listed above, so
+    <strong>please take care to keep personal information such as your contact
+        details to the correct fields</strong>.
+  [% END %]
 </p>
 
 <p>
-    These are accessible only to FixMyStreet administrators who adhere to strict internal
-    data-handling policies, and, where a council is a <a href="https://www.fixmystreet.com/pro/">FixMyStreet Pro</a> client, to council
-    staff, whose own data-handling and security policies will apply.
+    mySociety <b>stores your personal details</b>, along with your password
+    where used (passwords are stored in a format that is unreadable to anyone —
+    including mySociety staff — known as a hash) and any reports or updates you
+    make, in our own database.
 </p>
 
-<h3>
-    When you add an update
-  [% IF c.cobrand.send_questionnaires %]
-    or respond to our ‘has your problem been fixed?’ survey
-  [% END %]
-</h3>
-
 <p>
-    When you add an update to a report,
-  [% IF c.cobrand.send_questionnaires %]
-    or click through from our ‘has your problem been fixed?’ survey,
-  [% END %]
-    we record this along with the initial report and your user data.
+    These are accessible only to mySociety’s administrators, who adhere to
+    strict data-handling policies, and to [% c.cobrand.council_name %] staff,
+    who abide by their own data-handling and security policies.
 </p>
 
-<p>
-    <b>Updates are published on the website</b> but not routinely sent to the council except in
-    cases where a council has opted for full integration. You may opt to include your
-    name; your email address is not published.
-</p>
+[% IF c.cobrand.feature('updates_allowed') != 'staff' AND c.cobrand.send_questionnaires %]
+    <h3>When you add an update or respond to the email asking whether your problem was fixed</h3>
+    <p>
+    When you add an update to a report, or click through from our ‘has your
+    problem been fixed?’ email (where this function is available), this is
+    recorded along with the initial report and your user data.
+    </p>
+[% ELSIF c.cobrand.feature('updates_allowed') != 'staff' %]
+    <h3>When you add an update</h3>
+    <p>
+    When you add an update to a report, this is recorded along with the initial
+    report and your user data.
+    </p>
+[% ELSIF c.cobrand.send_questionnaires %]
+    <h3>When you respond to the email asking whether your problem was fixed</h3>
+    <p>
+    When you click through from our ‘has your problem been fixed?’ email, this
+    is recorded along with the initial report and your user data.
+    </p>
+[% END %]
 
 <h3>
     When you subscribe to an alert by email
 </h3>
 
 <p>
-    We collect your email address, which we store with the details of whichever alert/s
-    you have subscribed to.
+    mySociety collects your email address, which they store with the details of
+    whichever alert/s you have subscribed to.
 </p>
 
 <h3>
@@ -139,8 +156,12 @@ When you make a report
 </h3>
 
 <p>
-    Your message will be accessible to our small team of support staff, who adhere to
-    strict internal data-handling policies.
+    Your message will be accessible to [% c.cobrand.council_name %]’s support
+    staff, who adhere to our data-handling and security policies. If your issue
+    is about the use or functions of FixMyStreet, it may be passed to
+    mySociety’s support staff (including personal details, such as name and
+    email address, in order to help troubleshoot issues), whose privacy policy
+    <a href="https://www.fixmystreet.com/about/privacy">can be seen here</a>.
 </p>
 
 <p>
@@ -153,32 +174,23 @@ When you make a report
 </h2>
 
 <p>
-    We sometimes use data from FixMyStreet, or share it with trusted third parties, for
-    research. This data is completely anonymised and contains no identifying details such
-    as names, email addresses or the content of reports. Our Research Data Release policy
-    may be seen on request.
+    mySociety sometimes use report data, or share it with trusted third
+    parties, for research. This data is completely anonymised and contains
+    <strong>no identifying details</strong> such as names, email addresses or
+    the content of reports. mySociety’s Research Data Release policy may be
+    seen <a href="mailto:research@mysociety.org">on request to them</a>.
 </p>
 
-<h2>
-    What happens when you use FixMyStreet
-</h2>
-
-<h2>
-    Making a report
-</h2>
+<h2>What to expect</h2>
 
 <ul>
     <li>
-        When your council responds to your report, if you have provided us with an email
-        address, in most cases <b>their reply will go directly to your email inbox</b>. This
-        response, and any subsequent correspondence, happens outside the FixMyStreet
-        system, except in the case of some councils which have integrated with FixMyStreet
-        so that their responses and auto-updates are published on the report page. If you
-        have submitted via phone verification, you may not receive any response from the
-        council, depending on how their systems are set up.
+        When we respond to your report, if you have provided us with an email
+        address, in most cases <b>our reply will go directly to your email inbox</b>.
+        Responses and updates are also published on the report’s public webpage.
     </li>
     <li>
-        We <b>email you if someone leaves an update</b> on a report you’ve made.
+        You’ll receive an email <b>if someone leaves an update</b> on a report you’ve made.
     </li>
   [% IF c.cobrand.send_questionnaires %]
     <li>
@@ -188,13 +200,9 @@ When you make a report
     </li>
   [% END %]
     <li>
-        If your report is particularly interesting, our Communications Manager may get in
-        touch, as we like to feature notable requests on the
-        <a href="https://www.mysociety.org/blog/">mySociety blog</a> (or just
-        <a href="mailto:press@mysociety.org">let us know</a> directly!).
-    </li>
-    <li>
-        We only ever send you emails in relation to your reports or use of the site.
+        [% c.cobrand.council_name %] and/or mySociety will only ever send you
+        emails in relation to your reports or use of the site. Your personal
+        details will not be used for any other purpose.
     </li>
 </ul>
 
@@ -203,20 +211,21 @@ When you make a report
 </h3>
 
 <p>
-    We’ll send you an automated email every time someone makes a report within the area
-    you specify, or when updates are made to a report you’ve opted to follow. The
-    frequency of these emails will depend on how large your chosen area is and how many
-    reports are made within it, but you won’t get more than one an hour.
+    If you subscribe to an alert, you’ll receive an automated email every time
+    someone makes a report within the area you specify. The frequency of these
+    emails will depend on how large your chosen area is and how many reports
+    are made within it, but you won’t get more than one an hour.
+
+    If you’ve opted to follow a report, you’ll receive an email each time an
+    update is made, which could be a change in status made by our team, a
+    comment made by another member of the public, or an update from the person
+    who made the report originally.
 </p>
 
 <h2>
     Unsubscribing
 </h2>
 
-<h3>
-    How do I stop receiving emails from you?
-</h3>
-
 <p>
     Every alert email we send contains an unsubscribe link at the bottom for you to stop
     receiving that alert.
@@ -232,17 +241,43 @@ When you make a report
 
 <p>
     In using FixMyStreet for any of the functions listed above (sending a
-    report, leaving an update, email alerts or site registration), we are
-    processing your data under the legal basis 6(1)(f) – legitimate interests.
-    We assert that we have a legitimate charitable and commercial interest in
-    giving people an easy and public way to report street problems, even if they
-    don't know who the problems should go to, and in sending them updates or
-    alerts. The benefits of reporting problems publicly are that others can
-    quickly see what has already been reported, so it prevents the council from
-    having to deal with duplicates. It also creates a snapshot for local
-    communities, so it's easy to see what the common problems are in a given
-    area, and how quickly they get fixed. Other local residents can browse, read
-    and comment on problems – and perhaps even offer a solution.
+    report, leaving an update, email alerts or site registration), your data is
+    processed by both [% c.cobrand.council_name %] and mySociety.
+</p>
+<p>
+    [% c.cobrand.council_name %] is the data controller and mySociety is a data
+    processor.
+</p>
+[% IF c.cobrand.moniker == 'hackney' %]
+<p>
+    Your data is processed by [% c.cobrand.council_name %] under the legal
+    basis 6(1)(a) – consent.
+</p>
+[% ELSE %]
+<p>
+    Your data is processed by [% c.cobrand.council_name %] under the legal
+    basis 6(1)(e) – <strong>public task</strong>. [% c.cobrand.council_name %]
+    asserts that the processing of users’ personal information is necessary for
+    us to perform a task in the public interest or for our official functions,
+    and the task or function has a clear basis in law. Our obligation to keep
+    highways in good order and to keep public areas safe and functional are set
+    in law.
+</p>
+[% END %]
+
+<p>
+    mySociety also runs a service called FixMyStreet. If you report a problem
+    that [% c.cobrand.council_name %] is responsible for directly on
+    FixMyStreet, rather than this site, mySociety will share your report (and
+    personal details if provided) with us.
+</p>
+
+<p>
+    This sharing is in accordance with the FixMyStreet
+    <a href="https://www.fixmystreet.com/faq">terms of service</a> and their
+    <a href="https://www.fixmystreet.com/about/privacy">privacy statement</a>.
+    When [% c.cobrand.council_name %] receives this information we will hold it
+    as explained on this page.
 </p>
 
 <h2>
@@ -254,51 +289,69 @@ When you make a report
 </h3>
 
 <p>
-    Except in exceptional circumstances, we do not delete reports or updates made through
-    FixMyStreet. Historic FixMyStreet reports provide an invaluable resource for
+    Except in exceptional circumstances, reports or updates made through this site
+    or FixMyStreet are not deleted. Historic reports provide an invaluable resource for
     researchers into the quantity and type of street problems made across the UK during
     the years the site has been running. This research can help inform civic planners,
     developers, coders, historians and social scientists, among others.
 </p>
 
 <p>
-    Therefore, <b>if you ask for a report to be removed, in most cases we will instead invite
-    you to anonymise it</b>, so that there is no public connection between the content and
+    Therefore, <b>if you ask for a report to be removed, in most cases you will instead be
+    invited to anonymise it</b>, so that there is no public connection between the content and
     your name. You can anonymise reports singly, or in bulk, by logging in to your account
-    and clicking on the ‘“Hide your name” link beside the time and date of your report.
-    From here you may anonymise this report or all reports you have made.
+    on either this site or on fixmystreet.com and clicking on the ‘“Hide your
+    name” link beside the time and date of your report. From here you may
+    anonymise this report or all reports you have made.
 </p>
 
-<h3>
-    Your personal information
-</h3>
-
 <p>
-    As well as your report or update appearing on the FixMyStreet website, your details,
-    including name and email address, are stored in our admin system.
+    If you do not already have an account, it is simple to register, and once
+    you have done so you will have access to all the reports you have made
+    under that email address.
 </p>
 
 <p>
-    If you submit a report but do not click on the confirmation email, your report will
-    not be sent to the council; however, the report and your details remain in our system
-    and are accessible to site administrators.
+    Changes you make to your reports will apply immediately on this site, on
+    fixmystreet.com and will also be reflected, sometimes with a delay,
+    anywhere else they appear (see “What information we collect and how we use
+    it”, above, for more details about where reports are published). If you do
+    not see the changes, please ‘hard refresh’ your browser by eg pressing the
+    Ctrl and F5 keys simultaneously.
 </p>
 
 <p>
-    Please <a href="/contact">contact us</a> if you would like your details to be removed from our admin
-    database.
+    Search engines such as Google often take a little time to reflect changes
+    to content, but anonymising your report should also remove your name from
+    their search results once the pages have been recrawled by their robots.
 </p>
 
 <h3>
-    Support mail
+    Your personal information
 </h3>
 
 <p>
-    If you contact FixMyStreet via our support email address we keep your message for two
-    years at which point they will be automatically deleted.. This is to aid continuity
-    and so that we can view any historic context which may have bearing on subsequent
-    support mail, even if members of the support staff change. Support staff adhere to
-    internal privacy policies which may be viewed on request.
+    As well as your report or update appearing on this site and the FixMyStreet
+    website, your details, including name and email address, are stored in
+    FixMyStreet’s admin system.
+</p>
+
+<p>
+    If you submit a report but do not click on the confirmation email, your
+    report will not be sent or published; however, the report and your details
+    remain in our system and are accessible to site administrators.
+</p>
+
+<p>
+    Personal details will automatically be removed from the database after two
+    years of inactivity of the associated account.
+  [% IF c.cobrand.moniker == 'cheshireeast' %]
+    <a href="/contact">Contact us</a>
+  [% ELSE %]
+    Please <a href="/contact">contact us</a>
+  [% END %]
+    if you would like your details to be removed from our admin database sooner
+    than that.
 </p>
 
 <h2>
@@ -313,12 +366,14 @@ When you make a report
     contact us</a>, giving specific reasons why you are objecting to the processing of
     your personal data. These reasons should be based upon your particular situation.
 </p>
+
 <h2>
     Your right to access
 </h2>
 
 <p>
-    You may <a href="/contact">contact us</a> at any time to ask to see what personal data we hold about you.
+    You may <a href="/contact">contact us</a> at any time to ask to see what
+    personal data we hold about you.
 </p>
 
 <h2>
@@ -326,34 +381,12 @@ When you make a report
 </h2>
 
 <p>
-    If you believe that we have mishandled your data, you have the right to lodge a
-    complaint with the Information Commissioner’s Office.
+    If you believe that we have mishandled your data, you have the right to
+    lodge a complaint with the Information Commissioner’s Office.
     <a href="https://ico.org.uk/concerns/handling/">You can report a concern here</a>
     (but do contact us first, so that we can try and help).
 </p>
 
-<h3>
-    Who we are
-</h3>
-
-<p>
-    FixMyStreet is run by mySociety, a UK not-for-profit social enterprise. Our registered
-    address is:
-</p>
-
-<p>
-mySociety<br>
-483 Green Lanes<br>
-London<br>
-N13 4BS<br>
-United Kingdom<br>
-</p>
-
-<p>
-    …and we can also be <a href="/contact">contacted here</a>.
-</p>
-
-
 <h2 id="cookies">Cookies</h2>
 
 <p>To make our service easier or more useful, we sometimes place small data
@@ -372,43 +405,8 @@ the cookies and services that this site can use.
     <tr>
         <td>fixmystreet_app_session</td>
         <td nowrap>A random unique identifier</td>
-        <td>When browser is closed, or four weeks if &ldquo;Keep me signed in&rdquo; is ticked</td>
+        <td>When browser is closed</td>
     </tr>
 </table>
 
-<h3>Measuring website usage (Google Analytics)</h3>
-
-<p>We use Google Analytics software to collect information about how you use
-this site. We do this to help make sure the site is meeting the needs of its
-users and to help us make improvements.
-
-<p>Google Analytics stores information such as what
-pages you visit, how long you are on the site, how you got here, what you click
-on, and information about your web browser. IP addresses are masked (only a
-portion is stored) and personal information is only reported in aggregate. We
-do not allow Google to use or share our analytics data for any purpose besides
-providing us with analytics information, and we recommend that any user of
-Google Analytics does the same.
-
-<h3>Opting out</h3>
-<p>You can <a href="https://tools.google.com/dlpage/gaoptout">opt out of Google
-Analytics cookies</a>.
-
-<p>If you want to disable advertising-based tracking, you can
-<a href="https://www.google.com/settings/ads">adjust your Google Ads
-Settings</a>, or opt out of advertising-based tracking across a
-number of providers in one go using the
-<a href="http://www.networkadvertising.org/choices/">Network
-Advertising Initiative’s opt-out form</a>.
-
-<p>Rest assured, we only track usage data for one reason: to help us
-understand how we can make the site work better for you, our
-users.
-
-<h2>Credits</h2>
-
-<p>Bits of wording taken from the <a
-href="https://www.gov.uk/help/cookies">gov.uk cookies page</a> (under the Open
-Government Licence).
-
 [% INCLUDE 'footer.html' pagefooter = 'yes' %]