Disclose the signup form's Cloudflare Turnstile check in the legal pages

content/data-and-legal/cookies.md

@@ -37,11 +37,32 @@ If you choose a language, we remember it so you do not have to choose again on e
 This preference is stored inside the `session` cookie above. You can change it at any time
 by choosing a different language.
 
+## Bot protection when you create an assembly manager's account
+
+The assembly manager's account signup form includes a check, provided by Cloudflare Turnstile, that tells
+people apart from automated programs. **The check sets no cookies** and stores nothing on
+your device.
+
+To work, the check sends some technical information about your browser, together with your
+IP address, to Cloudflare. This happens only on the manager signup page — no other page contacts
+Cloudflare. Cloudflare does not use this information for advertising, and it is not used to
+track you across other websites.
+
 ## Cookies from other companies
 
 OpenDLP does not set any third-party cookies, and does not embed advertising, social media
 buttons, or analytics services that would set them.
 
+Two places involve another company, and neither stores anything on your device just by
+visiting the page:
+
+- The manager signup form's bot check is provided by Cloudflare — see above. It sets no cookies.
+- An assembly's registration pages may include an embedded YouTube video. We only allow
+  YouTube's privacy-enhanced player (`youtube-nocookie.com`), which stores nothing on your
+  device unless you press play. If you do press play, YouTube (Google) receives your IP
+  address and may store information on your device, just as if you had followed a link to
+  YouTube itself.
+
 ## Managing cookies
 
 You can delete or block cookies through your browser settings. If you block the `session`
@@ -58,7 +79,7 @@ Guidance for common browsers:
 ## Changes to this page
 
 If we change the cookies we use, we will update this page. It was last reviewed on
-**10th July 2026**.
+**28th September 2026**.
 
 ## Questions
 

content/data-and-legal/data-agreement.md

@@ -68,7 +68,7 @@ The Foundation processes the personal data provided only for the purposes descri
 ### 4.4 Legal Basis for Processing
 
 - The Foundation processes personal data on the basis of consent, except in certain cases:
-  - The IP address upon site entry is recorded on the basis of the Foundation's legitimate interest (e.g. to ensure lawful operation, prevent misuse)
+  - The IP address upon site entry is recorded on the basis of the Foundation's legitimate interest (e.g. to ensure lawful operation, prevent misuse); the same legitimate interest is the basis for the bot‑protection check on the assembly manager's account signup form (see section 4.5)
   - Newsletter subscription is based on explicit, prior consent; unsubscribe is always possible
   - Complaint handling: legal obligation (for record‑keeping) or the Foundation's legitimate interest (e.g. lawful handling of disputes)
   - Direct contact with explicit consent: basis is the Data Subject's consent
@@ -77,6 +77,8 @@ The Foundation processes the personal data provided only for the purposes descri
 
 Data processors are entities engaged by the Foundation under a contract in accordance with Article 28 of the GDPR (e.g. IT providers, newsletter services). They process personal data on behalf of the Foundation only according to its instructions.
 
+- **Cloudflare, Inc.** provides the bot‑protection check (Cloudflare Turnstile) on the assembly manager's account signup form. When the check runs, Cloudflare processes the visitor's IP address and technical characteristics of their browser, solely to distinguish people from automated programs. The check sets no cookies and stores nothing on the visitor's device, and Cloudflare does not use this data for advertising or cross‑site tracking. The check runs only on the signup form, and only on deployments where it is enabled.
+
 ### 4.6 Duration of Data Processing
 
 - IP addresses: stored for up to **two weeks**
@@ -99,7 +101,7 @@ Data processors are entities engaged by the Foundation under a contract in accor
 - Data processors may include third parties providing hosting, IT support, email services, etc.
 - The processor must not act on its own regarding the data and may only use data according to instructions
 - Data may be transferred to competent authorities if required by law or court order
-- Personal data will **not** be transferred to entities in third countries (outside the EEA)
+- With one exception, personal data will **not** be transferred to entities in third countries (outside the EEA). The exception is the bot‑protection check on the assembly manager's account signup form (see section 4.5), provided by Cloudflare, Inc., a company established in the United States; this transfer is safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision
 
 ## 7. Data Security
 
@@ -153,4 +155,4 @@ For questions, remarks, requests, or exercising privacy rights, contact:
 
 If you have any questions about how we handle your data, please contact us at [privacy@sortitionfoundation.org](mailto:privacy@sortitionfoundation.org).
 
-_Last updated: October 2025_
+_Last updated: September 2026_