Privacy notice

Before launch, replace everything in [SQUARE BRACKETS] and have this notice checked by someone with UK data protection knowledge.

Who we are

This website is run by Hongkongers in Leeds (列斯手足連線), an informal group of volunteers based in the United Kingdom. We are the "data controller" for the messages left on this site. You can reach us at hongkongersinleeds@gmail.com.

What we collect – and what we don't

If you leave a message, we store only:

• the message you write;
• the day you chose for it to appear;
• the name or pseudonym you give, if you choose to give one;
• the language of the page you used, and the calendar day (not the time) you sent it.

That is all. We have no user accounts. We do not ask for your email address. We do not use analytics, advertising or social media trackers, and we set no cookies for visitors. (So that a notice such as the birthday pop-up is not shown to you twice, your browser tab remembers that you have seen it until you close the tab. This never leaves your device and says nothing about you.) We do not store or log your IP address or any details of your device.

To protect the site we keep a security log for 90 days: a list of events such as "a robot was blocked" or "a wrong moderator password was tried", with the time. It contains no IP addresses and nothing about who you are or what you wrote, and events on the message form record no location at all. (Only for attempts to enter the moderators' area – which supporters never visit – it also notes the country and internet provider the attempt came from.)

Why we are allowed to use it

A message of solidarity may reveal your political opinions, which the law treats as specially protected information. We only use your message because you give us your explicit consent when you tick the box on the form (UK GDPR Articles 6(1)(a) and 9(2)(a)). You can withdraw your consent at any time – see "Your rights" below.

What happens to your message

1. A volunteer moderator reads it. Messages that are abusive, that are spam, or that contain personal details which could put someone at risk are not published.
2. If approved, it is published on the message wall on the day you chose, and stays there.

The message wall is public. Anyone in the world can read it, including the authorities in Hong Kong and mainland China. If you are in Hong Kong, travel there, or have family there, please think carefully before using your real name or including anything that could identify you.

Who helps us run the site

• Cloudflare hosts the website and the message database, protects it from attacks, and runs the "are you human?" check (Turnstile) on the message form. To deliver pages and block attacks, Cloudflare necessarily processes technical data such as your IP address for a short time. Cloudflare acts on our instructions as our processor. Cloudflare is a global company, so this technical data may be processed outside the UK under safeguards recognised by UK law. Our message database is stored in [the European Union – CHECK this matches how the database was created].
• GitHub stores the text and photos of the website itself. It never receives your messages.
• YouTube (Google) – only if you choose to play a video on the "His work" page. The preview pictures come from our own site, so nothing is requested from YouTube until you press play. The video then plays through YouTube's privacy-enhanced ("no-cookie") player, and Google receives technical data such as your IP address, as it would if you watched the video on YouTube itself.

We do not sell or share messages with anyone else.

How long we keep messages

• Published messages: for the life of the campaign, and deleted within [12 months] of the campaign ending.
• Messages we decide not to publish: permanently deleted after 30 days.

Your rights

You have the right to ask for a copy of your data, to have it corrected or erased, to restrict or object to our use of it, and to withdraw your consent. We deliberately do not collect anything that identifies you, and there is only one message for each day. So to have your message corrected or removed, simply email us at the address above and tell us which day you wrote for and roughly what you wrote. A volunteer will remove it, normally within a few days and always within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Children

If you are under 13, please ask a parent or guardian before leaving a message.