Merge pull request #2093 from alphagov/privacy-page

Privacy page

app/main/views/index.py

@@ -37,6 +37,11 @@ def cookies():
     return render_template('views/cookies.html')
 
 
+@main.route('/privacy')
+def privacy():
+    return render_template('views/privacy.html')
+
+
 @main.route('/trial-mode')
 def trial_mode():
     return redirect(url_for('.using_notify') + '#trial-mode', 301)

app/navigation.py

@@ -170,6 +170,7 @@ class HeaderNavigation(Navigation):
         'old_using_notify',
         'organisation_dashboard',
         'organisation_settings',
+        'privacy',
         'public_agreement',
         'public_download_agreement',
         'received_text_messages_callback',
@@ -418,6 +419,7 @@ class MainNavigation(Navigation):
         'organisations',
         'platform_admin',
         'pricing',
+        'privacy',
         'public_agreement',
         'public_download_agreement',
         'redact_template',
@@ -585,6 +587,7 @@ class OrgNavigation(Navigation):
         'organisations',
         'platform_admin',
         'pricing',
+        'privacy',
         'public_agreement',
         'public_download_agreement',
         'received_text_messages_callback',

app/templates/admin_template.html

@@ -109,6 +109,7 @@
 {% block footer_support_links %}
   <nav class="footer-nav">
     Built by the <a href="https://www.gov.uk/government/organisations/government-digital-service">Government Digital Service</a>
+    <a href="{{ url_for("main.privacy") }}">Privacy</a>    
     <a href="{{ url_for("main.cookies") }}">Cookies</a>
     {% if current_service.research_mode %}
     <span id="research-mode" class="research-mode">research mode</span>

app/templates/views/privacy.html

@@ -0,0 +1,140 @@
+{% extends "withoutnav_template.html" %}
+
+{% block per_page_title %}
+  Privacy notice
+{% endblock %}
+
+{% block maincolumn_content %}
+
+<div class="grid-row">
+  <div class="column-two-thirds">
+    <h1 class="heading-large">Privacy notice</h1>
+
+    <p>Date last modified: 23 May 2018</p>
+
+    <h2 class="heading-medium">Who we are</h2>
+
+    <p>GOV.UK Notify is provided by the Government Digital Service (GDS) which is part of the Cabinet Office.
+      Our job is the digital transformation of government.</p>
+
+    <p>We are a centre of excellence in digital, technology and data, collaborating with departments to help
+      them with their own transformation. We work with them to build platforms, standards and digital services.</p>
+
+    <p>GOV.UK Notify is a service that lets public service teams in the UK send emails, text messages, and letters
+      to users of their service.</p>
+
+    <p>Organisations sending notifications using GOV.UK Notify are the data controller and Cabinet Office is the data processor.</p>
+
+    <p>For the credentials used to access GOV.UK Notify, Cabinet Office is both the data controller and data processor.</p>
+
+    <p>For more information see the Information Commissioner’s Office (ICO) <a href="https://ico.org.uk/esdwebpages/search">Data Protection Public Register</a>.
+      The Cabinet Office registration number is: Z7414053</p>
+
+    <h2 class="heading-medium">What data we need</h2>
+
+    <p>The personal data we collect from public sector employees that create a GOV.UK Notify account will include:</p>
+
+    <ul class="list list-bullet">
+        <li>Your name</li>
+        <li>Your email address</li>
+        <li>Your mobile phone number</li>
+        <li>The IP address you use to access GOV.UK Notify</li>
+    </ul>
+
+    <p>The legal basis for processing this data is public task – allowing you to access GOV.UK Notify to send notifications
+      to users of your public service.</p>
+
+    <h2 class="heading-medium">Why we need your data</h2>
+
+    <p>We require your personal data to ensure only legitimate users of GOV.UK Notify can use it to send notifications.</p>
+
+    <h2 class="heading-medium">What we do with your data</h2>
+
+    <p>We use your data to check that you are allowed to access GOV.UK Notify and to record your activity when using it.</p>
+
+    <p>We will not:</p>
+
+    <ul class="list list-bullet">
+        <li>sell or rent your data to third parties</li>
+        <li>share your data with third parties for marketing purposes</li>
+    </ul>
+
+    <p>We will share your data if we are required to do so by law – for example, by court order, or to prevent fraud or other crime.</p>
+
+    <h2 class="heading-medium">How long we keep your data</h2>
+
+    <p>We will retain your personal data for as long as you have a GOV.UK Notify account.</p>
+
+    <h2 class="heading-medium">Where your data might go</h2>
+
+    <p>Our IT infrastructure and technology has been validated from inception to delivery with supporting contracts to ensure
+      compliance with all data sharing activities.</p>
+
+    <p>Your personal data will not be transferred outside of the European Economic Area (EEA) throughout the course of its
+      processing at GDS or any third party suppliers.</p>
+
+    <h2 class="heading-medium">How we protect your data and keep it secure</h2>
+
+    <p>We are committed to doing all that we can to keep your data secure. To prevent unauthorised access or disclosure we have
+      put in place technical and organisational procedures to secure the data we collect about you – for example, we protect your
+      data using varying levels of encryption. We also make sure that any third parties that we deal with have an obligation to
+      keep all personal data they process on our behalf secure.</p>
+
+    <h2 class="heading-medium">Children’s privacy protection</h2>
+
+    <p>We understand the importance of protecting children’s privacy online. Our services are not designed for, or intentionally
+      targeted at, children 13 years of age or younger. It is not our policy to intentionally collect or maintain data about anyone
+      under the age of 13.</p>
+
+    <h2 class="heading-medium">What are your rights</h2>
+
+    <p>You have the right to:</p>
+
+    <ul class="list list-bullet">
+        <li>request information about how your personal data are processed and to request a copy of that personal data</li>
+        <li>request that any inaccuracies in your personal data are rectified without delay</li>
+        <li>request that any incomplete personal data are completed, including by means of a supplementary statement</li>
+        <li>request that your personal data are erased if there is no longer a justification for them to be processed</li>
+        <li>request that the processing of your personal data is restricted in certain circumstances – for example, where accuracy is contested</li>
+        <li>request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format</li>
+    </ul>
+
+    <h2 class="heading-medium">Changes to this notice</h2>
+
+    <p>We may modify or amend this privacy notice at our discretion at any time. When we make changes to this notice, we will
+      amend the last modified date at the top of this page. Any modification or amendment to this privacy notice will be applied
+      to you and your data as of that revision date. We encourage you to periodically review this privacy notice to be informed
+      about how we are protecting your data.</p>
+
+    <h2 class="heading-medium">How to contact us</h2>
+
+    <p>If you have any questions about anything in this document or if you consider that your personal data has been misused or
+      mishandled you can contact the Data Protection Officer (DPO) at: DPO@cabinetoffice.gov.uk</p>
+
+    <p>Or by post at:</p>
+
+    <p>
+    Data Protection Officer<br>
+    Cabinet Office<br>
+    70 Whitehall<br>
+    London SW1A 2AS
+    </p>
+
+    <p>You may also make a complaint to the Information Commissioner, who is an independent regulator. The Information
+      Commissioner can be contacted at: casework@ico.org.uk or on 0303 123 1113.</p>
+
+    <p>Or by post at:</p>
+
+    <p>
+    Information Commissioner’s Office<br>
+    Wycliffe House<br>
+    Water Lane<br>
+    Wilmslow<br>
+    Cheshire SK9 5AF
+    </p>
+
+
+  </div>
+</div>
+
+{% endblock %}

tests/app/main/views/test_index.py

@@ -41,7 +41,7 @@ def test_logged_in_user_redirects_to_choose_account(
 
 
 @pytest.mark.parametrize('view', [
-    'cookies', 'using_notify', 'pricing', 'terms', 'integration_testing', 'roadmap',
+    'cookies', 'privacy', 'using_notify', 'pricing', 'terms', 'integration_testing', 'roadmap',
     'features', 'callbacks', 'documentation', 'security'
 ])
 def test_static_pages(