updating the data protection information

Author: Christian Förster

ckanext/eaw_theme/templates/disclaimer/snippets/dataprotection.html

@@ -1,26 +1,64 @@
 <h1 class="mb-4">Privacy Policy</h1>
+
 <h2 class="mb-3">What data do we collect?</h2>
-This service records and retains a record of http requests as logged
-by our webserver. These records include the originating IP-address,
-a timestamp, the requested URL, the user-agent string, and the
-address of the previous web page from which a link to our service
-was followed. We have modified the logging-procedure of our
-webserver with the tool <i>AnonIP</i>
-(<a href="https://pypi.org/project/anonip/" target="_blank">https://pypi.org/project/anonip/</a>) such that the
-last 12 bits and the last 84 bits of IPv4 and IPv6 addresses,
-respectively, are masked in the logs and cannot be used to identify
-individual users or clients. These data are stored on a secured
-server within the Eawag network.
+<p>
+    This service records and retains a record of HTTP requests as logged
+    by our webserver. These records include the originating IP-address,
+    a timestamp, the requested URL, the user-agent string, and the
+    address of the previous web page from which a link to our service
+    was followed. These data are stored on a secured server within the Eawag network.
+</p>
+
+<h2 class="mb-3 mt-4">Bot Protection System</h2>
+<p>
+    This service is protected by <strong>Anubis</strong> 
+    (<a href="https://github.com/TecharoHQ/anubis" target="_blank">https://github.com/TecharoHQ/anubis</a>), 
+    an advanced bot detection and protection system. Anubis may collect and process 
+    the following additional data for security and access control purposes:
+</p>
+<ul>
+    <li>IP addresses and network information</li>
+    <li>Browser fingerprints and HTTP request metadata</li>
+    <li>Access patterns and behavioral analysis data</li>
+    <li>Challenge-response interactions for bot detection</li>
+    <li>Session cookies for security and access management</li>
+</ul>
+<p>
+    This information is processed to protect the service from automated abuse, 
+    ensure legitimate access, and maintain service availability for human users.
+</p>
+
 <h2 class="mb-3 mt-4">How will we use your data?</h2>
-We use these data to track technical problems. We might derive
-anonymous summary statistics about the usage of our services from
-these data and publish them. Any such published statistic will be
-aggregated such that no inferences about individual clients or users
-can be drawn.
+<p>
+    We use these data to:
+</p>
+<ul>
+    <li>Track and resolve technical problems</li>
+    <li>Protect against automated abuse and malicious traffic</li>
+    <li>Ensure service availability and performance</li>
+    <li>Generate anonymous summary statistics about service usage</li>
+</ul>
+<p>
+    Any published statistics will be aggregated such that no inferences about 
+    individual clients or users can be drawn.
+</p>
+
 <h2 class="mb-3 mt-4">Cookies and tracking technology</h2>
-This service does not use cookies. This service does not employ any
-other tracking technology and does not leak information to any third
-parties.
+<p>
+    This service may use session cookies as part of our bot protection system (Anubis) 
+    to distinguish legitimate users from automated traffic. These cookies are essential 
+    for the security and proper functioning of the service. We do not use tracking 
+    cookies for advertising or analytics purposes, and we do not share information 
+    with third parties for marketing purposes.
+</p>
+
+<h2 class="mb-3 mt-4">Data retention</h2>
+<p>
+    Server logs and security-related data are retained for operational and security 
+    purposes. Data collected by our bot protection system may be retained for the 
+    duration necessary to ensure service security and prevent abuse.
+</p>
+
 <h2 class="mb-3 mt-4">How to contact us</h2>
 <p>
     If you have any questions about the privacy policy regarding this
@@ -44,7 +82,7 @@ <h2 class="mb-3 mt-4">How to contact us</h2>
     <br />
     fax: +41 (0)58 765 50 28
     <br />
-    email: <a href="mailto:info@eawag.ch">info@eawag.ch</a>
+    email: <a href="mailto:rdm@eawag.ch">rdm@eawag.ch</a>
     <br />
     web: <a href="https://www.eawag.ch">https://www.eawag.ch</a>
 </p>