-pp revision

1 files changed, 51 insertions, 13 deletions

diff --git a/contrib/pp/pp.rst b/contrib/pp/pp.rst
index a8ff838..8972028 100644
--- a/contrib/pp/pp.rst
+++ b/contrib/pp/pp.rst
@@ -1,7 +1,7 @@
 Privacy Policy
 ==============
 
-Last Updated: 07.09.2021
+Last Updated: 22.09.2021
 
 This Privacy Policy describes the policies and procedures of Anastasis
 SARL (“we,” “our,” or “us”) pertaining to the collection, use, and
@@ -45,30 +45,32 @@ information (i.e., information that cannot be used to identify who you are)
 will tell you how we might collect and use each type.
 
 We do our best to not collect any Personal Information from Anastasis
-users.  The detailed Personal Information Anastasis asks from you during
-the regular backup and recovery process at the beginning is never shared
-with us and only used to create a cryptographic account identifier which
-does not allow us to recover any of your details.
+users.  The detailed Personal Information Anastasis asks from you
+during the regular backup and recovery process at the beginning is
+never shared with us and only used to create a cryptographic account
+identifier which does not allow us to recover any of your
+details. This data will always remain on your own device without the
+possibility of access from our side.
 
 That being said, when using our Services to recover key material, we may
 inherently receive the following information (depending on your choice of
 authentication method):
 
-   * Bank account details necessary when receiving funds from you to authenticate via a SEPA transfer. We will store these as part of our business records for accounting, and our bank will also be legally obliged to store the details for many years.
+   * Bank account details necessary when receiving funds from you to authenticate via a SEPA transfer. We will store these as part of our business records for accounting, and our bank will also be legally obliged to store the details for many years according to legal retention periods.
 
-   * Your phone number when using SMS authentication. We rely on third party providers (such as your mobile network operator) to deliver the SMS to you. These third parties will see the SMS message sent to you and could thus learn that you are using Anastasis. SMS is inherently insecure, and you should expect many governments and private parties to be able to observe these messages.  However, we do not store your SMS number on our systems, except maybe in short-term logs to diagnose errors.
+   * Your phone number when using SMS authentication. We rely on third party providers (such as your mobile network operator) to deliver the SMS to you. These third parties will see the SMS message sent to you and could thus learn that you are using Anastasis. SMS is inherently insecure, and you should expect many governments and private parties to be able to observe these messages.  However, we do not store your phone number for SMS communication on our systems, except maybe in short-term logs to diagnose errors.
 
    * Your e-mail address when using E-mail authentication. We rely on the Internet and your E-mail provider to deliver the E-mail to you. Internet service providers will see the E-mail message sent to you and could thus learn that you are using Anastasis. E-mail is inherently insecure, and you should expect many governments and private parties to be able to observe these messages.  However, we do not store your E-mail address on our systems, except maybe in short-term logs to diagnose errors.
 
    * Your physical address when using postal mail authentication. We rely on external providers for printing and sending the letter to you. These providers will need to learn your address and could learn that you are using Anastasis. Physical mail has strict privacy protections by law, but governments are known to break postal secrecy. We do not store your physical address on our systems, except maybe in short-term logs to diagnose errors.
 
-   * When you contact us. We may collect certain information if you choose to contact us, for example to report a bug or other error with the Taler Wallet. This may include contact information such as your name, email address or phone number depending on the method you choose to contact us.
+   * When you contact us. We may collect certain information if you choose to contact us, for example to report a bug or other error with the Taler Wallet. This may include contact information such as your name, email address or phone number depending on the method you choose to contact us. We strictly only use the information provided by you in these instances to answer your request or to deliver the services requested by you.
 
 
-How we collect and process information
+How we collect and process personal data
 --------------------------------------
 
-We may process your information for the following reasons:
+We may process your personal data for the following reasons:
 
    * to authenticate you during secret recovery
    * to support you using Anastasis when you contact us
@@ -96,8 +98,7 @@ Agents or third party partners
 We may provide your Personal Information to our employees, contractors,
 agents, service providers, and designees (“Agents”) to enable them to perform
 certain services for us exclusively, including: improvement and maintenance of
-our software and Services. By accepting this Privacy Policy, as outlined
-above, you consent to any such transfer.
+our software and Services.
 
 
 Protection of us and others
@@ -124,6 +125,43 @@ needed for purposes specified in the “How We Use the Information We
 Gather” section will be deleted after ninety (90) days.
 
 
+What are your data protection rights?
+-------------------------------------
+
+Anastasis would like to make sure you are fully aware of all of your
+data protection rights. Every user is entitled to the following:
+
+**The right to access**: You have the right to request Anastasis for
+ copies of your personal data. We may charge you a small fee for this
+ service.
+
+**The right to rectification**: You have the right to request that
+Anastasis correct any information you believe is inaccurate. You also
+have the right to request Anastasis to complete information you
+believe is incomplete.  The right to erasure - You have the right to
+request that Anastasis erase your personal data, under certain
+conditions.
+
+**The right to restrict processing**: You have the right to request
+ that Anastasis restrict the processing of your personal data, under
+ certain conditions.
+
+**The right to object to processing**: You have the right to object to
+ Anastasis's processing of your personal data, under certain
+ conditions.
+
+**The right to data portability**: You have the right to request that
+ Anastasis transfer the data that we have collected to another
+ organization, or directly to you, under certain conditions.
+
+If you make a request, we have one month to respond to you. If you
+would like to exercise any of these rights, please contact us at our
+email: privacy@anastasis.lu
+
+You can always contact your local data protection authority to enforce
+your rights.
+
+
 Data retention
 --------------
 
@@ -170,7 +208,7 @@ International users and visitors
 --------------------------------
 
 Our Services are (currently) hosted in Germany. If you are a user
-accessing the Services from the Switzerland, Asia, US, or any other
+accessing the Services from Switzerland, Asia, US, or any other
 region with laws or regulations governing personal data collection,
 use, and disclosure that differ from the laws of Germany, please be
 advised that through your continued use of the Services, which is