GDPR.txt for invidual folders? URI?
So, my own website would best be written a little like the below
In short - we don't use cookies nor request any user data unless you're in the /classifieds/
folder of the website.
I'd like to propose, therefore, a uri
section to this format, which makes it clear, I hope, that the only place we'll drop cookies (after explicitly asking if we may) is in that specific subfolder.
Alternatively; if I was to place a different GDPR.txt in /classifieds/
to /
that could work; however programmatically, it would be hard for a site scraper to find the various .txt files.
purpose: temporary logfiles
lawfulness: legal
uri: /*
data: IP address and useragent
required: yes
visibility: private
description:
We store access logs for up to 90 days, for technical operation and assessing site traffic.
This is only available to the site operator and contains no personally-identifiable information.
Data is held in the EU and is automatically deleted after 90 days.
We do not use cookies at all for any public pages nor ask for any personal data.
purpose: user data
lawfulness: consent
uri: /classifieds/*
data: email address, password and cookie
required: yes
visibility: private
description:
We require an email and password to log into our classifieds ads system
This uses a cookie, which is required, to allow our servers to know it's you
We verify your email address on sign-up. Passwords are stored in a one-way hashed format.