Privacy policy / Terms of service [GDPR]

[nfreear]

GDPR / privacy

• — draft initial Privacy policy / source;
• — heading/ link in README;

---

Hi @timcoughlan,

I'm not sure how 'our-journey' is going to be presented to students yet ...

However, we should probably draft a user/ student-facing Privacy Policy, that is specific to the OU, and explicit about:

0. 'Our Journey' is prototype (Beta or whatever?) software, and functionality may change at any time;
1. The 'Our Journey' software (Javascript) runs entirely on the user's local computer/machine/device, and in their browser software;
2. Not sending/ transmitting/ storing contents of a "journey" or any personal data on any server;
3. Not sharing, unless you explicitly save a HTML or PDF file, and posting those somewhere;
4. That the HTML/ PDFs don't contain your name/OUCU/personally identifiable data etc. (unless you add those yourself);
5. Using Google Analytics including GA cooies to collect anonymised usage patterns;
6. Probably with links to the OU-wide Terms / Privacy policy?
7. That users/ students agree to abide by the OU's policies when creating/ sharing journeys (no derogatory, offensive, bullying language in their journeys, etc.);
8. That the OU may at its own discretion take down journeys shared on OU web sites and properties, if they breach OU policies;
9. That the OU won't be held liable for the content of users/ students journeys whether shared publicly or privately;
10. ... Anything else ...?

---

OU pages

• https://www.open.ac.uk/privacy
• https://www.open.ac.uk/conditions
• https://help.open.ac.uk/documents/policies
• https://help.open.ac.uk/documents/policies/computing/files/45/student-computing-policy.pdf
• https://www.open.ac.uk/copyright
• ... ?

---

DONE: I suggest that it is added to src/config.js:

module.exports.DEFAULTS = {

  //...

  privacyUrl: 'https://iet-ou.github.io/our-journey/privacy.html'
};

---

[iet:10993886]

[timcoughlan]

Hi Nick,

This would be important to add and I agree with the points you have thought of for this. Nothing else comes to mind but I have no experience of writing these.

Definitely a need for flexibility for different uses as suggested by the config approach. E.g. if we run a research trial and get consent from participants we may link journeys to particular persons. So in this instance a different text would be needed.

Happy to try putting this in to a html file and working from there.

Tim.