From 5068caa1e69cac16af19652516d126ac42c58c8c Mon Sep 17 00:00:00 2001 From: Gergely Gazda Date: Thu, 24 Sep 2026 17:40:02 +0200 Subject: [PATCH 1/3] Disclose the signup form's Cloudflare Turnstile check in the legal pages opendlp PR #316 adds a Cloudflare Turnstile bot check to the account signup form. The widget runs in non-pre-clearance mode, so it sets no cookies and the no-cookie-banner position still holds - but the signup page now loads a script and challenge iframe from Cloudflare, and the visitor's IP address and browser characteristics reach a US company. Two public pages claimed neither of those things happens. The cookies page gets a section describing the check (no cookies, what is sent to Cloudflare, signup page only) and its "Cookies from other companies" section now also covers the privacy-enhanced YouTube embeds on registration pages, which predate this change but were likewise undisclosed. The user data agreement names Cloudflare as a processor in section 4.5, extends the legitimate-interest basis in 4.4 to the bot check, and qualifies the section 6 claim that no data leaves the EEA, citing Cloudflare's EU-US Data Privacy Framework certification. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01CV1KJkfe2FGmDg6dJkCnou --- content/data-and-legal/cookies.md | 23 ++++++++++++++++++++++- content/data-and-legal/data-agreement.md | 8 +++++--- 2 files changed, 27 insertions(+), 4 deletions(-) diff --git a/content/data-and-legal/cookies.md b/content/data-and-legal/cookies.md index fad5ce0..2e70ac7 100644 --- a/content/data-and-legal/cookies.md +++ b/content/data-and-legal/cookies.md @@ -37,11 +37,32 @@ If you choose a language, we remember it so you do not have to choose again on e This preference is stored inside the `session` cookie above. You can change it at any time by choosing a different language. +## Bot protection when you create an account + +The account signup form includes a check, provided by Cloudflare Turnstile, that tells +people apart from automated programs. **The check sets no cookies** and stores nothing on +your device. + +To work, the check sends some technical information about your browser, together with your +IP address, to Cloudflare. This happens only on the signup page — no other page contacts +Cloudflare. Cloudflare does not use this information for advertising, and it is not used to +track you across other websites. + ## Cookies from other companies OpenDLP does not set any third-party cookies, and does not embed advertising, social media buttons, or analytics services that would set them. +Two places involve another company, and neither stores anything on your device just by +visiting the page: + +- The signup form's bot check is provided by Cloudflare — see above. It sets no cookies. +- An assembly's registration pages may include an embedded YouTube video. We only allow + YouTube's privacy-enhanced player (`youtube-nocookie.com`), which stores nothing on your + device unless you press play. If you do press play, YouTube (Google) receives your IP + address and may store information on your device, just as if you had followed a link to + YouTube itself. + ## Managing cookies You can delete or block cookies through your browser settings. If you block the `session` @@ -58,7 +79,7 @@ Guidance for common browsers: ## Changes to this page If we change the cookies we use, we will update this page. It was last reviewed on -**10th July 2026**. +**24th September 2026**. ## Questions diff --git a/content/data-and-legal/data-agreement.md b/content/data-and-legal/data-agreement.md index 39a946a..14debd0 100644 --- a/content/data-and-legal/data-agreement.md +++ b/content/data-and-legal/data-agreement.md @@ -68,7 +68,7 @@ The Foundation processes the personal data provided only for the purposes descri ### 4.4 Legal Basis for Processing - The Foundation processes personal data on the basis of consent, except in certain cases: - - The IP address upon site entry is recorded on the basis of the Foundation's legitimate interest (e.g. to ensure lawful operation, prevent misuse) + - The IP address upon site entry is recorded on the basis of the Foundation's legitimate interest (e.g. to ensure lawful operation, prevent misuse); the same legitimate interest is the basis for the bot‑protection check on the account signup form (see section 4.5) - Newsletter subscription is based on explicit, prior consent; unsubscribe is always possible - Complaint handling: legal obligation (for record‑keeping) or the Foundation's legitimate interest (e.g. lawful handling of disputes) - Direct contact with explicit consent: basis is the Data Subject's consent @@ -77,6 +77,8 @@ The Foundation processes the personal data provided only for the purposes descri Data processors are entities engaged by the Foundation under a contract in accordance with Article 28 of the GDPR (e.g. IT providers, newsletter services). They process personal data on behalf of the Foundation only according to its instructions. +- **Cloudflare, Inc.** provides the bot‑protection check (Cloudflare Turnstile) on the account signup form. When the check runs, Cloudflare processes the visitor's IP address and technical characteristics of their browser, solely to distinguish people from automated programs. The check sets no cookies and stores nothing on the visitor's device, and Cloudflare does not use this data for advertising or cross‑site tracking. The check runs only on the signup form, and only on deployments where it is enabled. + ### 4.6 Duration of Data Processing - IP addresses: stored for up to **two weeks** @@ -99,7 +101,7 @@ Data processors are entities engaged by the Foundation under a contract in accor - Data processors may include third parties providing hosting, IT support, email services, etc. - The processor must not act on its own regarding the data and may only use data according to instructions - Data may be transferred to competent authorities if required by law or court order -- Personal data will **not** be transferred to entities in third countries (outside the EEA) +- With one exception, personal data will **not** be transferred to entities in third countries (outside the EEA). The exception is the bot‑protection check on the account signup form (see section 4.5), provided by Cloudflare, Inc., a company established in the United States; this transfer is safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision ## 7. Data Security @@ -153,4 +155,4 @@ For questions, remarks, requests, or exercising privacy rights, contact: If you have any questions about how we handle your data, please contact us at [privacy@sortitionfoundation.org](mailto:privacy@sortitionfoundation.org). -_Last updated: October 2025_ +_Last updated: September 2026_ From 9c82005a4b72d8b06a5cef3ede878c54aea7676c Mon Sep 17 00:00:00 2001 From: Nick Gill <33941845+nickpgill@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:15:40 +0100 Subject: [PATCH 2/3] Update cookies.md Changed references to "signup page" to "assembly manager's signup page". --- content/data-and-legal/cookies.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/data-and-legal/cookies.md b/content/data-and-legal/cookies.md index 2e70ac7..ad0c5bf 100644 --- a/content/data-and-legal/cookies.md +++ b/content/data-and-legal/cookies.md @@ -37,14 +37,14 @@ If you choose a language, we remember it so you do not have to choose again on e This preference is stored inside the `session` cookie above. You can change it at any time by choosing a different language. -## Bot protection when you create an account +## Bot protection when you create an assembly manager's account -The account signup form includes a check, provided by Cloudflare Turnstile, that tells +The assembly manager's account signup form includes a check, provided by Cloudflare Turnstile, that tells people apart from automated programs. **The check sets no cookies** and stores nothing on your device. To work, the check sends some technical information about your browser, together with your -IP address, to Cloudflare. This happens only on the signup page — no other page contacts +IP address, to Cloudflare. This happens only on the manager signup page — no other page contacts Cloudflare. Cloudflare does not use this information for advertising, and it is not used to track you across other websites. @@ -56,7 +56,7 @@ buttons, or analytics services that would set them. Two places involve another company, and neither stores anything on your device just by visiting the page: -- The signup form's bot check is provided by Cloudflare — see above. It sets no cookies. +- The manager signup form's bot check is provided by Cloudflare — see above. It sets no cookies. - An assembly's registration pages may include an embedded YouTube video. We only allow YouTube's privacy-enhanced player (`youtube-nocookie.com`), which stores nothing on your device unless you press play. If you do press play, YouTube (Google) receives your IP @@ -79,7 +79,7 @@ Guidance for common browsers: ## Changes to this page If we change the cookies we use, we will update this page. It was last reviewed on -**24th September 2026**. +**28th September 2026**. ## Questions From 162e6b5794ad4e66f2044b81e4c8c52377378259 Mon Sep 17 00:00:00 2001 From: Nick Gill <33941845+nickpgill@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:17:50 +0100 Subject: [PATCH 3/3] Update data-agreement.md Changed "account signup form" to "assembly manager's account signup form". --- content/data-and-legal/data-agreement.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/data-and-legal/data-agreement.md b/content/data-and-legal/data-agreement.md index 14debd0..fb51e8e 100644 --- a/content/data-and-legal/data-agreement.md +++ b/content/data-and-legal/data-agreement.md @@ -68,7 +68,7 @@ The Foundation processes the personal data provided only for the purposes descri ### 4.4 Legal Basis for Processing - The Foundation processes personal data on the basis of consent, except in certain cases: - - The IP address upon site entry is recorded on the basis of the Foundation's legitimate interest (e.g. to ensure lawful operation, prevent misuse); the same legitimate interest is the basis for the bot‑protection check on the account signup form (see section 4.5) + - The IP address upon site entry is recorded on the basis of the Foundation's legitimate interest (e.g. to ensure lawful operation, prevent misuse); the same legitimate interest is the basis for the bot‑protection check on the assembly manager's account signup form (see section 4.5) - Newsletter subscription is based on explicit, prior consent; unsubscribe is always possible - Complaint handling: legal obligation (for record‑keeping) or the Foundation's legitimate interest (e.g. lawful handling of disputes) - Direct contact with explicit consent: basis is the Data Subject's consent @@ -77,7 +77,7 @@ The Foundation processes the personal data provided only for the purposes descri Data processors are entities engaged by the Foundation under a contract in accordance with Article 28 of the GDPR (e.g. IT providers, newsletter services). They process personal data on behalf of the Foundation only according to its instructions. -- **Cloudflare, Inc.** provides the bot‑protection check (Cloudflare Turnstile) on the account signup form. When the check runs, Cloudflare processes the visitor's IP address and technical characteristics of their browser, solely to distinguish people from automated programs. The check sets no cookies and stores nothing on the visitor's device, and Cloudflare does not use this data for advertising or cross‑site tracking. The check runs only on the signup form, and only on deployments where it is enabled. +- **Cloudflare, Inc.** provides the bot‑protection check (Cloudflare Turnstile) on the assembly manager's account signup form. When the check runs, Cloudflare processes the visitor's IP address and technical characteristics of their browser, solely to distinguish people from automated programs. The check sets no cookies and stores nothing on the visitor's device, and Cloudflare does not use this data for advertising or cross‑site tracking. The check runs only on the signup form, and only on deployments where it is enabled. ### 4.6 Duration of Data Processing @@ -101,7 +101,7 @@ Data processors are entities engaged by the Foundation under a contract in accor - Data processors may include third parties providing hosting, IT support, email services, etc. - The processor must not act on its own regarding the data and may only use data according to instructions - Data may be transferred to competent authorities if required by law or court order -- With one exception, personal data will **not** be transferred to entities in third countries (outside the EEA). The exception is the bot‑protection check on the account signup form (see section 4.5), provided by Cloudflare, Inc., a company established in the United States; this transfer is safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision +- With one exception, personal data will **not** be transferred to entities in third countries (outside the EEA). The exception is the bot‑protection check on the assembly manager's account signup form (see section 4.5), provided by Cloudflare, Inc., a company established in the United States; this transfer is safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision ## 7. Data Security