Data Usage - Revision history

Silentwings: /* Data and usage of data */

2020-04-26T13:57:28Z

Data and usage of data

← Older revision		Revision as of 14:57, 26 April 2020
Line 28:		Line 28:
	'''We retain and process data of types A, B and C on basis of legitimate interest, to provide the above services.'''		'''We retain and process data of types A, B and C on basis of legitimate interest, to provide the above services.'''

	Users may connect to our server using external and bespoke software, known as a “client”, as specified through a publicly available protocol. This software may be outside of our control and knowledge. In such cases, whilst we may deny connections from clients that do not comply with GDPR and other legal requirements where it is technically and practically possible for us to do so, the operation and compliance of client software is the responsibility of its authors and users. The data usage policies summarised in this notice ONLY cover our usage of the data that is sent by users and users client software to our server.		Users may connect to our server using external and bespoke software, known as a “client”, as specified through a publicly available protocol. This software may be outside of our control and knowledge. In such cases, whilst we may deny connections from clients that do not comply with GDPR and other legal requirements where it is technically and practically possible for us to do so, the operation and compliance of client software is the responsibility of its authors and users. The data usage policies summarised in this notice ONLY cover our usage of the data that is sent by users and users client software to our server, running at springrts.com.

	Users are contacted via automated messages to email addresses that they provide for purposes related to item 5 when it is necessary to do so, such as when a user requests account recovery. In exceptional circumstances we may also manually contact individual users for purposes related to items 3 or 6. We do not use these email addresses to send marketing emails to our users and we do not disclose email addresses to third parties.		Users are contacted via automated messages to email addresses that they provide for purposes related to item 5 when it is necessary to do so, such as when a user requests account recovery. In exceptional circumstances we may also manually contact individual users for purposes related to items 3 or 6. We do not use these email addresses to send marketing emails to our users and we do not disclose email addresses to third parties.

Silentwings: /* Data and usage of data */

2020-04-26T13:55:44Z

Data and usage of data

← Older revision		Revision as of 14:55, 26 April 2020
Line 3:		Line 3:
	==Data and usage of data==		==Data and usage of data==

	The SpringRTS server and its managed ~~game hosts~~ process and retain information generated by users:		The SpringRTS server (springrts.com) and its managed infrastructure process and retain information generated by users:

	<ol style="list-style-type:upper-alpha">		<ol style="list-style-type:upper-alpha">

Silentwings: /* User rights under GDPR */

2020-02-08T08:20:05Z

User rights under GDPR

← Older revision		Revision as of 09:20, 8 February 2020
Line 47:		Line 47:
	==User rights under GDPR==		==User rights under GDPR==

	Users wishing to exercise their rights under GDPR should contact moderation staff, who are identifiable on the server by means of a spanner icon, and ~~also~~ contactable ~~through~~ springrts.com or by email at postmaster@springrts.com; such requests are handled on a case-by-case basis. We have procedures in place to assess numbers of moderation staff and ensure that such people are contactable and able to respond within the required time periods. Any data supplied in response will typically come in plain text form, or in the form of access to online replay files.		Users wishing to exercise their rights under GDPR should contact moderation staff, who are identifiable on the server by means of a spanner icon, and are contactable via the forum hosted at springrts.com or by email at postmaster@springrts.com; such requests are handled on a case-by-case basis. We have procedures in place to assess numbers of moderation staff and ensure that such people are contactable and able to respond within the required time periods. Any data supplied in response will typically come in plain text form, or in the form of access to online replay files.

	Note that the right to erasure under GDPR is not absolute; in particular we may refuse to fully erase data of individuals with a record of past misconduct if we believe such data may be required to prevent potential future misconduct of sufficient severity. See [http://www.privacy-regulation.eu/en/recital-49-GDPR.htm] for details.		Note that the right to erasure under GDPR is not absolute; in particular we may refuse to fully erase data of individuals with a record of past misconduct if we believe such data may be required to prevent potential future misconduct of sufficient severity. See [http://www.privacy-regulation.eu/en/recital-49-GDPR.htm] for details.

Silentwings: /* Disclosure of data to third parties and other users */

2020-02-08T08:17:00Z

Disclosure of data to third parties and other users

← Older revision		Revision as of 09:17, 8 February 2020
Line 59:		Line 59:
	When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.		When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.

	Non-public information supplied to us on login, pertaining to all type A data excluding usernames, may be visible to our moderators and developers when there is a need under items 3 or 6. Hashed passwords are accessible only to developers with a need to access the live user database. Type A data is not disclosed to third parties or other users, except to battle hosts as described above, and except where we judge it necessary for purposes of verifying the authenticity of users; we use external GDPR compliant services to assist in automated detection of potentially malicious users attempting to conceal their own identities.		Non-public information supplied to us on login, pertaining to all type A data excluding usernames, may be visible to our moderators and developers when there is a need under items 3 or 6. Hashed passwords are accessible only to developers with a need to access the live user database. Type A data excluding usernames is not disclosed to third parties or other users, except to battle hosts as described above, and except where we judge it necessary for purposes of verifying the authenticity of users; we use external GDPR compliant services to assist in automated detection of potentially malicious users attempting to conceal their own identities.

	We reserve the right to pass ANY data that we hold to relevant law enforcement agencies if we believe that it may contain indications or evidence of illegal action.		We reserve the right to pass ANY data that we hold to relevant law enforcement agencies if we believe that it may contain indications or evidence of illegal action.

Silentwings: /* Disclosure of data to third parties and other users */

2020-02-07T08:25:24Z

Disclosure of data to third parties and other users

← Older revision		Revision as of 09:25, 7 February 2020
Line 57:		Line 57:
	Type B.2 data is supplied to other users only when these other users are present or have access to the private context, such as a passworded chat channel or passworded game host, in which the data was created. This data is not disclosed to third parties, but it is retained to provide persistent chat functionality and is accessible to server administrators whilst it is retained.		Type B.2 data is supplied to other users only when these other users are present or have access to the private context, such as a passworded chat channel or passworded game host, in which the data was created. This data is not disclosed to third parties, but it is retained to provide persistent chat functionality and is accessible to server administrators whilst it is retained.

	When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles~~, but they do not become aware of any other type A data of these users~~. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.		When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.

	Non-public information supplied to us on login, pertaining to all type A data excluding usernames, may be visible to our moderators and developers when there is a need under items 3 or 6. Hashed passwords are accessible only to developers with a need to access the live user database. Type A data is not disclosed to third parties or other users, except to battle hosts as described above, and except where we judge it necessary for purposes of verifying the authenticity of users; we use external GDPR compliant services to assist in automated detection of potentially malicious users attempting to conceal their own identities.		Non-public information supplied to us on login, pertaining to all type A data excluding usernames, may be visible to our moderators and developers when there is a need under items 3 or 6. Hashed passwords are accessible only to developers with a need to access the live user database. Type A data is not disclosed to third parties or other users, except to battle hosts as described above, and except where we judge it necessary for purposes of verifying the authenticity of users; we use external GDPR compliant services to assist in automated detection of potentially malicious users attempting to conceal their own identities.

Silentwings: /* Disclosure of data to third parties and other users */

2019-03-07T09:17:42Z

Disclosure of data to third parties and other users

← Older revision		Revision as of 10:17, 7 March 2019
Line 59:		Line 59:
	When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles, but they do not become aware of any other type A data of these users. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.		When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles, but they do not become aware of any other type A data of these users. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.

	Non-public information supplied to us on login, pertaining to all type A data excluding usernames, may be visible to our moderators and developers when there is a need under items 3 or 6. Hashed passwords are accessible only to developers with a need to access the live user database. Type A data is not disclosed to third parties or other users, except to battle hosts as described above, and except where we judge it necessary for purposes of verifying the authenticity of users; we use ~~the~~ external GDPR compliant ~~service IPHub~~ to assist in automated detection of potentially malicious users attempting to conceal their own identities.		Non-public information supplied to us on login, pertaining to all type A data excluding usernames, may be visible to our moderators and developers when there is a need under items 3 or 6. Hashed passwords are accessible only to developers with a need to access the live user database. Type A data is not disclosed to third parties or other users, except to battle hosts as described above, and except where we judge it necessary for purposes of verifying the authenticity of users; we use external GDPR compliant services to assist in automated detection of potentially malicious users attempting to conceal their own identities.

	We reserve the right to pass ANY data that we hold to relevant law enforcement agencies if we believe that it may contain indications or evidence of illegal action.		We reserve the right to pass ANY data that we hold to relevant law enforcement agencies if we believe that it may contain indications or evidence of illegal action.

Silentwings: /* Data and usage of data */

2019-03-07T09:17:10Z

Data and usage of data

← Older revision		Revision as of 10:17, 7 March 2019
Line 7:		Line 7:
	<ol style="list-style-type:upper-alpha">		<ol style="list-style-type:upper-alpha">
	<li>		<li>
	Registration & login details: email address, IP~~/MAC~~ address, chosen username, (hashed) password.		Registration & login details: email address, IP address, chosen username, (hashed) password.
	</li>		</li>
	<li>		<li>
Line 37:		Line 37:
	Type B.1 data is generated exclusively by individuals within in publicly accessible contexts, in which an expectation exists that this data will be shared with any number of other users. Type B.2 data is generated by individual in contexts where an expectation of privacy from other users exists. Such data is of a nature that is not expected to carry significant risk to an individual’s rights and freedoms, however steps are taken to respect this privacy as detailed below; this data is used only for purposes relating to items 3 and 6. The retention and processing of type B data carries a low risk of inhibiting individual’s rights and freedoms.		Type B.1 data is generated exclusively by individuals within in publicly accessible contexts, in which an expectation exists that this data will be shared with any number of other users. Type B.2 data is generated by individual in contexts where an expectation of privacy from other users exists. Such data is of a nature that is not expected to carry significant risk to an individual’s rights and freedoms, however steps are taken to respect this privacy as detailed below; this data is used only for purposes relating to items 3 and 6. The retention and processing of type B data carries a low risk of inhibiting individual’s rights and freedoms.

	Type A data contains information (particularly: email, IP ~~and MAC addresses~~) provided in private contexts that could, in some cases, and when supplemented with external sources of related information, be used to identify a real individual from their online footprint and consequently requires appropriate protection as detailed below; since otherwise the data held by SpringRTS concerning such individuals is of a non-sensitive nature the associated impact on individuals interests, rights and freedoms is low.		Type A data contains information (particularly: email, IP) provided in private contexts that could, in some cases, and when supplemented with external sources of related information, be used to identify a real individual from their online footprint and consequently requires appropriate protection as detailed below; since otherwise the data held by SpringRTS concerning such individuals is of a non-sensitive nature the associated impact on individuals interests, rights and freedoms is low.

	Developers and other users who provide data of type C may also provide licenses for such data. Authors may choose to include their own contact details; the risk to the individual’s rights and freedoms is low. For details on how we handle such content see our policies on licensing, forking, and on how the GPL license of the spring engine affects game content.		Developers and other users who provide data of type C may also provide licenses for such data. Authors may choose to include their own contact details; the risk to the individual’s rights and freedoms is low. For details on how we handle such content see our policies on licensing, forking, and on how the GPL license of the spring engine affects game content.

Silentwings: /* Disclosure of data to third parties and other users */

2019-02-12T13:18:28Z

Disclosure of data to third parties and other users

← Older revision		Revision as of 14:18, 12 February 2019
Line 55:		Line 55:
	When information is supplied to us within a publicly visible medium, such as through a public chat channel or public game host, we may and typically will make this information publicly available to other users and to GDPR compliant third parties. This pertains to type all type B.1 data, plus usernames.		When information is supplied to us within a publicly visible medium, such as through a public chat channel or public game host, we may and typically will make this information publicly available to other users and to GDPR compliant third parties. This pertains to type all type B.1 data, plus usernames.

	Type B.2 data is supplied to other users only when these other users are present of have access to the private context, such as a passworded chat channel or passworded game host, in which the data was created. This data is not disclosed to third parties, but it is retained to provide persistent chat functionality and is accessible to server administrators whilst it is retained.		Type B.2 data is supplied to other users only when these other users are present or have access to the private context, such as a passworded chat channel or passworded game host, in which the data was created. This data is not disclosed to third parties, but it is retained to provide persistent chat functionality and is accessible to server administrators whilst it is retained.

	When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles, but they do not become aware of any other type A data of these users. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.		When users choose to act as battle hosts, or provide automated battle hosts, the IP address of this host becomes publicly available information, necessarily to allow our users to make a (direct) connection to the battle, and for the battle host to accept or decline this connection. Battle hosts receive usernames plus type B data associated to the battles that they host and will typically distribute this data to other connected users. Battle hosts also necessarily become aware of the IP addresses of users attempting to connect to their battles, but they do not become aware of any other type A data of these users. On a technical level, the distributed nature of battle hosting amongst our users arises from a need for more computational resources and connectivity than the Spring server alone provides. Consequently, battle hosts take on responsibilities of their own under the GDPR and are required to comply fully with the policies set out in this document.

Silentwings: /* Data and usage of data */

2019-02-12T08:05:53Z

Data and usage of data

← Older revision		Revision as of 09:05, 12 February 2019
Line 13:		Line 13:
	<ol style="list-style-type:decimal">		<ol style="list-style-type:decimal">
	<li> Data created in publicly accessible contexts, such as non-passworded chat channels and battle hosts. </li>		<li> Data created in publicly accessible contexts, such as non-passworded chat channels and battle hosts. </li>
	<li> Data created in private contexts, such as passworded chat channels and passworded battle hosts. </li>		<li> Data created in private contexts, such as private messages, passworded chat channels and passworded battle hosts. </li>
	</ol>		</ol>
	<li>		<li>

Silentwings: /* Legitimate Interest */

2019-02-12T08:05:04Z

Legitimate Interest

← Older revision		Revision as of 09:05, 12 February 2019
Line 33:		Line 33:

	====Legitimate Interest====		====Legitimate Interest====
	We would be unable to provide the above services without retention and processing of the above data. Items 1 and 2 consist wholly of retaining and processing data of types B and C. Data retained and processed relating to item 3 consists of type B and C data, primarily communications occurring between users during their cooperative usage of our services, plus games and other content files for these services. Item 4 requires no retention of data, but requires on-the-fly processing of type B data. Item 5 requires type A data to correctly associate a login attempts to user accounts and to help protect the server and battle hosts from malicious activity. Item 6 requires both type A and B data, to support moderator actions identifying, discouraging and preventing misconduct.		We would be unable to provide the above services without retention and processing of the above data. Items 1 and 2 consist wholly of retaining and processing data of types B and C. Data retained and processed relating to item 3 consists of type B and C data, primarily communications occurring between users during their cooperative usage of our services, plus games and other content files for these services. Item 4 requires no retention of data, but requires on-the-fly processing of type B data. Item 5 requires type A data to correctly associate login attempts to user accounts and to help protect the server and battle hosts from malicious activity. Item 6 requires both type A and B data, to support moderator actions identifying, discouraging and preventing misconduct.

	Type B.1 data is generated exclusively by individuals within in publicly accessible contexts, in which an expectation exists that this data will be shared with any number of other users. Type B.2 data is generated by individual in contexts where an expectation of privacy from other users exists. Such data is of a nature that is not expected to carry significant risk to an individual’s rights and freedoms, however steps are taken to respect this privacy as detailed below; this data is used only for purposes relating to items 3 and 6. The retention and processing of type B data carries a low risk of inhibiting individual’s rights and freedoms.		Type B.1 data is generated exclusively by individuals within in publicly accessible contexts, in which an expectation exists that this data will be shared with any number of other users. Type B.2 data is generated by individual in contexts where an expectation of privacy from other users exists. Such data is of a nature that is not expected to carry significant risk to an individual’s rights and freedoms, however steps are taken to respect this privacy as detailed below; this data is used only for purposes relating to items 3 and 6. The retention and processing of type B data carries a low risk of inhibiting individual’s rights and freedoms.