Privacy Policy

1. General Information

We do not want to need your data. We therefore want to be fully transparent about how we use it, and are always open to viable suggestions on how to reduce your data footprint on our infrastructure. We try to use privacy-friendly open source software and privacy-friendly third parties as much as possible.

This document outlines our responsibilities and duties regarding the processing of your personal data, as defined by Art. 13 of the European Union’s General Data Protection Regulation (GDPR), and provides information on the rights that you have as a data subject.

2. Contact

Controller and Data Protection Officer:

Vancouver Linux User Group (VanLUG)
Email: contact@vanlug.ca

If you want to report a privacy concern, please contact the data protection officer at the address above.

Should you wish to report a complaint or if you feel that the Vancouver Linux User Group (VanLUG) has not addressed your concern in a satisfactory manner, you may contact the responsible Information Commissioner’s Office: the Office of the Information and Privacy Commissioner for British Columbia.

3. Data Processing Reasons & Legal Basis

3.1 Data of Website Visitors

When accessing our website, the following information is processed for the reasons outlined below:

  1. Technical metadata for the purpose of providing the website and avoiding misuse of our resources.
    • Data is processed during regular use of our website and includes the IP address of the requesting computer, the browser and operating system you are using, the date and time of access, the URLs requested on our website, as well as the previously visited website where applicable (referrer URL).
    • Our website does NOT use cookies or other techniques for user-targeted analytics or advertisements.
    • Legal basis for processing this data is a legitimate interest of the website operator (Art. 6.1.f GDPR).

3.2 VanLUG Forgejo Data

When accessing the Vancouver Linux User Group’s Forgejo instance at git.vanlug.ca, the following information is processed for the reasons outlined below:

  1. Account details (username, e-mail addresses, name, linked accounts), for the purpose of providing you with an account on our Forgejo instance.
    • Registration is closed; accounts are only created for Vancouver Linux User Group board members on an invite-only basis, as described in our terms of service.
    • Data can be changed on the user account page at git.vanlug.ca/user/settings.
    • Pseudonyms can be used in the public profile, there is no requirement to use real personal information besides a reachable e-mail address.
    • Legal basis for processing this data is the user’s consent to either share the data on our platform or to receive notifications (Art. 6.1.a GDPR).
  2. Voluntarily provided author details (name, e-mail address) when using e.g. the third-party software “Git” (https://git-scm.com) to create/upload “commits” to our Forgejo instance, for the purpose of being able to reconstruct the original authorship of uploaded code for copyright & licensing reasons.
    • Data is provided voluntarily by the user, usually during setup, and is then automatically included in newly created commits.
    • Legal basis for processing this data is the license of the project as a legal contract (Art. 6.1.b GDPR).
    • Attention: Most licenses permitted by our terms of service are irrevocable and apply indefinitely, to the extent permitted by copyright law. Such licenses are considered to be legal contracts. As a distributor of open-source content, the Vancouver Linux User Group (VanLUG) reserves the right to maintain a copy of commit authorship records indefinitely. Additionally, the Vancouver Linux User Group (VanLUG) reserves the right to distribute such authorship records to all parties that wish to download, view or otherwise inspect content published using an allowed license. Such parties possess a legitimate interest to this information, as commit authorship records are necessary for adhering to the legal terms stipulated by the project license.
  3. Technical metadata for the purpose of providing the platform services and avoiding misuse of our resources.
    • Data is processed during regular use of our Forgejo instance, and includes the IP address of the requesting computer, the browser and operating system you are using, the date and time of access, the Uniform Resource Locators (URL) requested on our Forgejo instance, as well as the previously visited website (referrer URL).
    • Further metadata includes technically necessary cookies to identify the session of a logged-in user or to protect users from so-called CSRF attacks. Our Forgejo instance does NOT use cookies or other techniques for user-targeted analytics or advertisements.
    • Legal basis for processing this data is a legitimate interest of the platform operator (Art. 6.1.f GDPR).
  4. When projects hosted on our Forgejo instance process personal data using our resources (e.g. within our CI, by using repositories as storage, or through a website hosted on our Git Pages), the project owner is primarily responsible for the data processing and must make sure to adhere to the GDPR as well as their local legislature independently from these terms.

3.3 Luma Event Data

Our home page and events page fetch event data from Luma’s API and images from Luma’s CDN via our proxy. Your browser connects to our proxy, not directly to Luma. No data is sent to Luma from your browser. We also provide the RSS/Atom feed of upcoming events and their images via the same proxy.

Luma, Inc.
548 Market St PMB 36143
San Francisco, CA 94104
United States
Privacy policy: https://luma.com/privacy-policy

3.4 Mastodon Feed Data

Our home page fetches recent posts and media from our Mastodon account via our proxy. Your browser connects to our proxy, not directly to thecanadian.social. No data is sent to thecanadian.social from your browser. We also link to the public Mastodon RSS feed at thecanadian.social/@vanlug.rss; if you subscribe to it, your feed reader connects directly to thecanadian.social.

The Canadian (thecanadian.social)
Kelowna and Burnaby, British Columbia
Canada
Privacy policy: https://thecanadian.social/privacy-policy

4. Data Handling by Association Bodies & Third Parties

Personal data may only be processed by the association bodies which are responsible for their respective tasks. This specifically means that:

  • Tech committee members can access all resources and personal information stored on our servers. This is required for maintaining the infrastructure necessary for providing the Vancouver Linux User Group’s services.

Our website, Luma and Mastodon API proxy and Forgejo are hosted by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany
Privacy policy: https://www.hetzner.com/legal/privacy-policy/

This company is based in Germany. Data transfers to the European Union are based on appropriate safeguards according to Art. 46 GDPR.

5. Data Retention

  1. Account details are stored until the deletion of the account.
  2. Technical metadata like IP addresses are processed, not stored or retained by us directly, but rather by the third parties specified in section 4. Please see each provider’s privacy policy for details.
  3. Personal data may exist in encrypted backups for up to 1 year. If the data retention period is exceeded at the time of restoration of a backup, affected personal data will be purged.
  4. Personal data is stored in accordance with the statutory archiving obligations in British Columbia, Canada.

6. Data Subject Rights

As a subject of personal data processing, you have the following rights:

  1. Right to access: You can request copies of your personal data, as defined in Art. 15 GDPR.
  2. Right to rectification: You can request that we correct any information you believe is inaccurate, or complete any information you believe is incomplete, as defined in Art. 16 GDPR.
  3. Right to erasure: You can request that we erase your personal data, under the condition that the retention and processing of the information is not required by law and is not necessary due to the reasons outlined in Art. 17 (3) GDPR.
  4. Right to restrict processing: You can request that we restrict the processing of your personal data, as defined in Art. 18 GDPR.
  5. Right to object to processing: You can object to and withdraw consent to our processing of your personal data, as defined in Art. 21 GDPR.
  6. Right to data portability: You can request that we transfer the data that we have collected to another organization, or directly to you, as defined in Art. 20 GDPR.
  7. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us using the information in section 2.

7. Licence

This privacy policy is inspired by the Codeberg Privacy Policy. You can freely use and modify this text under the CC BY-SA 4.0 licence.