This Privacy policy explains how WardPane Community (“we”, “us”) processes personal data when you use wardpane.com, its subdomains and the download service, including the install script (the “Site”). It is written with the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection and the Russian Federal Law No. 152-FZ “On Personal Data” in mind.
1. Who is responsible
The controller (operator) of your personal data is WardPane Community, the group of developers behind the WardPane open source project. We handle all requests by email: write to [email protected] about your data and to [email protected] about vulnerabilities. We do not accept requests by post.
We have not appointed a data protection officer. People in the EU or the EEA can exercise all their rights by writing to [email protected].
2. What data we process
| Data | When |
|---|---|
| Email address | When you request a download (by the form or the install script) or subscribe to the newsletter |
| IP address | With every request to the Site; it is also stored with a download request, a consent record and the first use of a download link |
| User agent (browser or client name and version) | With a download request and a consent record |
| Interface language | With a download request and a consent record |
| Country reported by Cloudflare | With a download request, to decide in which database your data is stored (see section 4) |
| Consent records | Which documents and versions you accepted, when, from which IP address and user agent, in which language, and whether through the web form or the install script |
| Newsletter status | Whether you asked for the newsletter, confirmed it or unsubscribed, and when |
| Download records | When a link or code was issued and used, and the IP address that used it |
We do not use analytics or advertising cookies, and we do not build profiles. The cookies and browser storage the Site uses are described in the Cookie policy.
3. Why we process it and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Sending the download link or code and delivering the release | Performance of the service you requested, Art. 6(1)(b) |
| Recording your acceptance of the Terms and your consents, so we can prove them | Legal obligation and legitimate interest, Art. 6(1)(c) and (f) |
| Preventing abuse: rate limits, binding a link to one address, blocking attacks | Legitimate interest in a working, secure service, Art. 6(1)(f) |
| Notices about security problems in a version you downloaded | Legitimate interest in keeping installations safe, Art. 6(1)(f) |
| Newsletter with news about releases and security fixes | Your consent, Art. 6(1)(a), given by ticking the box and confirming by email |
Under 152-FZ, we process your data on the basis of your consent to the processing of personal data, given as a separate document: the Consent.
4. Where the data is stored
If you connect from an IP address in Russia, the records about you (email address, consents, newsletter status and downloads) are stored in a database on our server in Russia (Moscow). Otherwise they are stored on our server in Switzerland. We learn the country of your IP address from Cloudflare.
The Site itself runs on our server in Switzerland. Every request, from any country, is processed there, and the web server logs described in section 5, including the IP addresses of visitors from Russia, are kept there.
The Site is served through Cloudflare as a CDN and security provider. Cloudflare sees IP addresses and request data in order to deliver and protect the Site, and may process them outside your country, including in the United States. It acts as our processor or as an independent controller, as set out in its own terms and its privacy policy.
We send emails from our own mail server at mail.wardpane.com and use no third-party email service.
Switzerland is recognised by the European Commission as providing an adequate level of data protection. Where data reaches other countries through Cloudflare, Cloudflare’s own safeguards apply, as described in its terms.
5. How long we keep it
| Data | Retention |
|---|---|
| Download links and confirmation codes | Valid for 24 hours (a link) or 15 minutes (a code); the records of them are deleted 30 days after they expire |
| Email address, IP address, user agent, language, country, consent records, newsletter status and download records | While you are active (you request a download, give a consent or have a newsletter subscription) and for 3 years after your last activity, then deleted together |
| Web server access and error logs | Up to 30 days, then deleted |
A confirmed newsletter subscription counts as activity, so your data is kept while you are subscribed. After you unsubscribe, the 3 years count from that moment.
The web server logs hold the IP address, the time, the requested URL, the user agent and the status code. We use them only for security and troubleshooting.
6. Who receives the data
We do not sell personal data and do not share it for advertising. Apart from our own servers in Switzerland and Russia, only Cloudflare processes the data, as described in section 4. We may disclose data when the law requires it.
7. Your rights
You have the right to:
- get a copy of your data and information about how it is processed;
- have incorrect data corrected;
- have your data deleted, or its processing restricted;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting processing before the withdrawal (unsubscribe links in every email withdraw the newsletter consent);
- receive your data in a portable format;
- lodge a complaint with a supervisory authority: in the EU or the EEA, the data protection authority of your country; in Switzerland, the FDPIC; in Russia, Roskomnadzor.
To use these rights, write to [email protected] from the address concerned. We answer within one month (under 152-FZ, within the time limits it sets).
8. Security
Access to the databases is limited to the people who run the service. Connections to the Site use HTTPS. Download links and codes are random, short-lived and stored so that a database leak does not reveal working links.
9. Children
The Site and the downloads are not aimed at children under 16. We do not knowingly collect their data, and we delete it on request.
10. Changes
New versions of this policy are published on the Site with a new version number and date, shown at the top. If a change affects a consent you gave, we ask for it again where the law requires.