Public notices

This page tells how to publish the notices of a hosting provider: the accessibility statement, where the data is, and a privacy policy.

Publish the accessibility statement

The panel serves an accessibility statement at /accessibility/. The statement is an honest default for a self-assessment, and two parts of it are yours. Set them in the options of the panel component:

• accessibilityStatement.contact: a mailto: or https: URL for feedback.
• accessibilityStatement.enforcementUrl: the page of the enforcement body that applies to you. A public sector body must give this.

The statement covers the panel only. It says that it was prepared by automated tests, and that no person did a manual audit. Do a manual audit before you give the statement to a public tender. The list of problems is in the template panel/src/panel/templates/accessibility.html.

Publish where the data is

GDPR Art. 28 and Data Act Art. 28 want a hosting provider to publish where the data is and who handles it. The panel shows this on the page of each deployment and on the public page /provider/, which needs no account.

Declare it in the repository variable PROVIDER_INFO of the deployment of the hosting provider, as JSON:

{
  "legalEntity": { "name": "Example Hosting B.V.", "country": "NL" },
  "dataLocation": { "country": "NL", "dataCenter": "Example Amsterdam 1" },
  "subProcessors": [
    { "name": "Example Registrar", "purpose": "Registration of the domain names", "country": "NL" }
  ]
}

Deploy the hosting provider again after a change.

You can also declare it in the provider option of the panel, in default-config of the group hosting-provider. This value has priority over PROVIDER_INFO. In the leaf that composes the groups:

composed = panel.lib.composedGroups;
groups = composed // {
  hosting-provider = composed.hosting-provider // {
    default-config = lib.recursiveUpdate composed.hosting-provider.default-config {
      applications.panel.provider = {
        legalEntity = {
          name = "Example Hosting B.V.";
          country = "NL";
        };
        dataLocation = {
          country = "NL";
          dataCenter = "Example Amsterdam 1";
        };
        subProcessors = [
          {
            name = "Example Registrar";
            purpose = "Registration of the domain names";
            country = "NL";
          }
        ];
      };
    };
  };
};

A country is an ISO 3166-1 alpha-2 code in upper case, for example NL. The evaluation checks only the form of the code: two upper case letters. Thus check the code yourself.

Set default-config as the last step, because core.lib.foldGroupExtensions sets it again. Do not set the value in a module of the group or in extraModules: a deploy bakes default-config into the configuration of the node, but it evaluates the node from the groups of the operator tree, thus such a module does not arrive. A DEPLOYMENT that names applications.panel replaces the baked entry, thus it must hold provider as well.

A deploy of the panel node publishes a change. The statement applies to all deployments of the group, because a deployment has no site of its own. These items are not available:

• A statement for each hypervisor. The statement does not describe a group that has hypervisors at more than one site.
• A site that the operator chooses.
• A Garage region from the site. garageRegion stays a separate value.

Without provider, the deployment page and /provider/ show "Not declared".

A hosting provider with its own front-end publishes this in its own way. The API has no such route, and such a hosting provider does not need the provider option.

Publish a privacy policy

Set the deploy variable PRIVACY_POLICY_URL to the https URL of your privacy policy. The panel then links to it from each page, and each operator deployment uses it unless the operator sets privacyPolicyUrl (see the operator configuration). Without the variable, the panel shows no link and an operator deployment uses only its own privacyPolicyUrl. A change of the URL redeploys each node. An operator deployment that exists gets the new URL on its next deploy. On a mastodon node, the link replaces a policy that an administrator wrote in mastodon. That text comes back if the URL is removed.