fix: adopt the v3 legal texts for the account statements (US #79 follow-up)

docs/legal/privacy-statement-2026-08-18.md

@@ -0,0 +1,152 @@
+<!-- Platform Privacy Statement, version 2026-08-18. Adapted from
+     https://testing.nc3.lu/privacy/ (v3 text, undated on the page;
+     retrieved 2026-08-18), adopted provisionally until the DPO
+     delivers the v4 texts (Non-functional -> GDPR). Corrections
+     applied to the source (PR #39 review):
+     1. Collected-data sentence aligned with what the platform actually
+        collects at registration (email address, password, optional
+        display name) - the source sentence was truncated and described
+        the v3 site's collection (contact person, username, company
+        name), none of which v4 collects.
+     2. Added the platform's retention periods for user data (12-month
+        scan results with notify/extend/confirm and a 30-day grace
+        period; 24-month audit records; erasure within 30 days of
+        account deletion) - the approved specification figures.
+     3. Retention section reconciled: an explicit retention criterion
+        for user-added server data (kept while the account exists,
+        anonymized with it on deletion) and the audit-record carve-out
+        from the 30-day erasure (anonymized in the same pass, retained
+        anonymized for the remainder of their 24 months).
+     statement.content_hash is the SHA-256 of this file's bytes;
+     statement.content_uri points at this file on the public repository.
+     Do not edit: a new text is a new file and a new statement version
+     row. -->
+
+# PRIVACY STATEMENT
+
+The Luxembourg House of Cybersecurity (hereinafter referred to as LHC)
+collects and processes personal data in accordance with the applicable data protection legislations such as, but
+not
+limited to, Regulation (EU) 2016/679 on the protection of natural persons with regards to the processing of
+their
+personal data and the free movement of such data (“GDPR”) and the national law adopting GDPR.
+
+It may occur that we change or amend our Privacy Policy in order to ensure that its content accurately reflects
+regulatory developments. Any such modification, if substantial, will be clearly communicated to you, either via
+the
+website or via other appropriate means. The latest applicable version will be available on our website.
+
+Should you have any questions or remarks regarding this Privacy Policy, do not hesitate to contact us at
+[email protected]
+
+## PROCESSING OF PERSONAL DATA
+
+By “personal data” we understand any information that can identify you, both directly and indirectly.
+
+By “processing” we refer to anything we do with such personal data, including collection, recording,
+organization,
+structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
+dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
+
+By “data controller” we understand the person responsible for the processing of your personal data, this is the
+entity which determines the means and purpose of the processing activities.
+
+For our Testing Platform website and all related services, the data controller is:
+
+Luxembourg House of Cybersecurity g.i.e., 122 rue Adolphe Fischer, L-1521 Luxembourg
+
+Tel: (+352) 274 00 98 601
+
+Email: [email protected]
+
+## WHAT PERSONAL DATA DO WE COLLECT ON OUR WEBSITE AND TO WHICH END?
+
+When you are surfing our Testing Platform website, we collect and process web server logs, including IP
+addresses,
+user-agents, URLs, date and time logs. We collect those logs for our legitimate interest as these logs enable
+the
+technical and functional management of our website.
+
+When you register to the Testing Platform, we process and collect certain personal data. The personal
+information collected from you at registration is: your email address, a password, and an optional display
+name.
+
+When you contact us by mail, we process your contact information and any other details you provide us. We will
+use
+these details, if provided, for further case management around the issue resolution.
+
+Your personal data is collected for registration, billing and troubleshooting purposes.
+
+We confirm that we process your personal data in a fair and lawful manner and only for the explicit and
+legitimate
+purposes as above-mentioned. At all times, we strive to ensure that your personal data is adequate, relevant and
+not
+excessive in relation to the purposes for which they are processed.
+
+In case you enter and use one of the websites that may be linked to this website, personal data will processed
+according to the privacy policies of these respective infrastructures.
+
+## HOW LONG DO WE RETAIN YOUR PERSONAL DATA?
+
+In no circumstances, we keep your personal data for a longer period than strictly necessary to fulfil the purpose
+for which it was collected. If you decide to delete your account, or LHC decides to delete your
+account after one year of inactivity on the Testing Platform, we inform you that your related personal data will
+be
+replaced in our Database with a string called "DELETED”. The data collected about servers that have been added
+by
+you as user is retained for as long as your account exists; upon deletion of your account it is anonymized in
+the
+same pass, so it is no longer connected to you, and only the anonymized technical records may be kept for
+internal purposes.
+
+On the Testing Platform specifically, scan results are retained for
+twelve (12) months by default; you are notified before this period
+lapses and may extend it, export the data, or confirm deletion, after
+which the data is permanently deleted following a thirty (30) day grace
+period. Audit records are retained for twenty-four (24) months on their
+own legal basis (security monitoring and abuse investigation). If you
+delete your account, all personal data associated with it is permanently
+removed or irreversibly anonymized as described above within thirty (30)
+days; audit records are not exempt from that anonymization — the
+identifiers connecting them to you are replaced in the same pass — but
+the anonymized records remain for the rest of their twenty-four (24)
+months.
+
+However, if requested by local and national law, certain personal data may be retained for a longer period. For
+instance, for accounting purposes, such as, but limited to, payment of the services fees, data will be retained
+for
+the time required by the national law and for no longer than ten years).
+
+## SHARING PERSONAL DATA
+
+We formally confirm that we will not sell, rent or otherwise commercially transfer to or share with a third party
+any personal data.
+
+The data submitted will only be made available to LHC personnel for the above mentioned
+purposes.
+
+As our web server is hosted and managed in Luxembourg, your personal data is in no circumstances transferred to
+third countries outside the EU.
+
+## SECURITY OF YOUR PERSONAL DATA
+
+We are striving to keep your personal data secure. To that end, we have adopted the appropriate legal,
+organizational and technical precautions to prevent any unauthorized access and use of your personal data. These
+measures include but are not limited to the encryption of all traffic between our website and your browser.
+YOUR RIGHTS AS A DATA SUBJECT
+
+At LHC we aim to be transparent, not only about how we process personal data about you, but also
+about
+your rights that are linked to such processing.
+
+In particular, you have the right to access your personal data, to obtain the updating, the adjustment and the
+erasure of the personal data and you can exercise the rights to restrict and to object the processing. You can
+exercise the rights provided by articles 15 and the following of the GDPR contacting the following email address
+[email protected] .
+In order to avoid unlawful access to your personal data, we will request you to provide a proof of your
+identity. If
+you have any queries about this Privacy Notice or experiencing any other privacy issue, we are striving to
+promptly
+dealing with any privacy-related complaints.
+If you have a complaint related to the processing of your personal data by LHC, please contact
+us.

docs/legal/terms-of-service-2026-08-18.md

@@ -0,0 +1,184 @@
+<!-- Platform Terms of Service, version 2026-08-18. Adapted from
+     https://testing.nc3.lu/terms-conditions/ (v3 text, last updated
+     October 2024 per the page; retrieved 2026-08-18), adopted
+     provisionally until the DPO delivers the v4 texts (Non-functional
+     -> GDPR). Corrections applied to the source (PR #39 review):
+     1. Your Account: privacy-policy link fixed from the mistyped
+        https://testing.c3.lu/privacy to https://testing.nc3.lu/privacy/.
+     2. Your Content: malformed sentence repaired to 'Licenses related
+        to statistical data derived from your content will continue
+        after your content is removed.'
+     3. Termination: undefined 'Data Shared' removed from the survival
+        list; capitalization aligned to the section names.
+     4. Your Account: the account-creation data list aligned with what
+        registration actually collects (a valid e-mail address and a
+        password, with an optional display name) - the source required
+        first and last name and a company or affiliation address, none
+        of which v4 collects.
+     statement.content_hash is the SHA-256 of this file's bytes;
+     statement.content_uri points at this file on the public repository.
+     Do not edit: a new text is a new file and a new statement version
+     row. -->
+
+# Terms of Service
+
+These terms govern use of the website https://testing.nc3.lu . To use the
+website, you must agree to these terms with
+Luxembourg House of Cybersecurity (hereinafter referred to as LHC) the company that runs the website.
+LHC may offer other products and services, under different terms. These terms apply only to use of
+the
+website.
+
+Skip to:
+
+- Your Permission to Use the Website
+
+- Conditions for Use of the Website
+
+- Acceptable Use
+
+- Content Standards
+
+- Your Account
+
+- Your Content
+
+- Termination
+
+- Disputes
+
+- Contact
+
+- Changes
+
+## Your Permission to Use the Website
+
+Subject to these terms, LHC gives you permission to use the website. You can't transfer it to
+anyone
+else. Others need to agree to these terms for themselves to use the website.
+
+## Conditions for Use of the Website
+Your permission to use the website is subject to the following conditions:
+
+- You must be at least thirteen years old.
+
+- You may no longer use the website if LHC contacts you directly to say that you may not.
+
+- You must use the website in accordance with Acceptable Use and Content Standards.
+
+## Acceptable Use
+
+- You may not break the law using the website.
+
+- You may not use or try to use another's account on the website without their specific permission.
+
+- You may not buy, sell, or otherwise trade in user names or other unique identifiers on the website.
+
+- You may not send advertisements, chain letters, or other solicitations through the website, or use the
+website to
+gather addresses for commercial mailing lists.
+
+- You may not automate access to the website, or monitor the website, such as with a web crawler, browser
+plug-in
+or add-on, or other computer program that is not a web browser. You may crawl the website to index it for a
+publicly
+available search engine.
+
+- You may not use the website to send e-mail to distribution lists, newsgroups, or group mail aliases.
+
+- You may not falsely imply that you're affiliated with or endorsed by LHC.
+
+- You may not hyperlink to images or other non-hypertext content on the website.
+
+- You may not remove any marks showing proprietary ownership from materials you download from the website.
+
+- You may not show any part of the website on other websites with
+<iframe>.
+
+- You may not disable, avoid, or circumvent any security or access restrictions of the website.
+
+- You may not strain infrastructure of the website with an unreasonable volume of requests, or requests
+designed to impose an unreasonable load on information systems underlying the website.
+
+- You may not encourage or help anyone in violation of these terms.
+
+- You may not impersonate others through the website.
+
+## Content Standards
+
+- You may not submit content to the website that is illegal, offensive, or otherwise harmful to others. This
+includes content that is harassing, inappropriate, or abusive.
+
+- You may not submit content to the website that violates the law, infringes anyone's intellectual property
+rights, violates anyone's privacy, or breaches agreements you have with others.
+
+- You may not submit content to the website containing malicious computer code, such as computer viruses or
+spyware.
+
+## Your Account
+
+You must create and log into an account to use some features of the website.
+
+For this purpose, you agree to:
+
+-Provide true, accurate, correct and complete information when required to register as a user of the Website
+(“Personal Information”; and notify immediately LHC of any change of Personal Information).
+
+You agree that you will not impersonate any other person or entity or use a false name or a name that you are
+not authorized to use, or disclose your password or username to any other person, or allow your password or user
+name to be used by any other person to access the Services. You will be responsible for use of the Website
+and/or Services via your username and so will be liable for breach by anyone to whom you provide the details. To
+create an account, you must provide some information about yourself. If you create an account, you agree to
+provide a valid e-mail address and to choose a password; you may additionally provide an optional display name.
+
+You may delete your account on the website at any time. The deletion means the permanent anonymization of all
+your account and personal data.
+Your personal data is processed according to Testing Platform Privacy Policy
+( https://testing.nc3.lu/privacy/ )
+LHC reserves the right to decline any application from you to register as a user of the platform
+in their sole discretion.
+You agree to be responsible for all action taken using your account, whether authorized by you or not, until you
+either close your account or notify LHC that your account has been compromised. You agree to
+notify LHC immediately if you suspect your account has been compromised. You agree to select a
+secure password for your account, and keep it secret.
+LHC will at its own discretion decide to close your account on the website after one year on
+inactivity on the website. LHC will notify you immediately about this decision.
+
+## Your Content
+
+Nothing in these terms gives LHC any ownership rights in intellectual property that you share with
+the website, such as your account information or other content you submit to the website. Nothing in these terms
+gives you any ownership rights in LHC's intellectual property, either.
+Between you and LHC, you remain solely responsible for content you submit to the website. You
+agree not to wrongly imply that the content you submit to the website is sponsored or approved by the company.
+These terms do not obligate LHC to store, maintain, or provide copies of content you submit.
+The content you submit to the website belongs to you, and you decide what permission to give others for it.
+However, by submitting content to this website, you agree to grant to LHC a non-exclusive,
+non-transferable, royalty-free, license to use your content for statistical and analysis purposes.
+When the content you submit is removed from the website, whether by you or by LHC,
+LHC's special license ends when the last copy disappears from LHC's backups,
+caches, and other systems. Licenses related to statistical data derived from your content will continue after your
+content is removed.
+
+## Termination
+
+Either you or LHC may end the agreement written out in these terms at any time. When our agreement
+ends, your permission to use the website also ends.
+The following provisions survive the end of our agreement: Your Account, Your Content.
+
+## Disputes
+
+Luxembourg law will govern any dispute, including any legal proceedings, related to these terms or your use of
+the website.
+
+## Contact
+
+You may notify LHC these terms, and send questions at [email protected]. LHC may notify
+you under these terms using the e-mail address you provide for your account on the website, or by posting a
+message to the homepage of the website or your account page.
+
+## Changes
+
+LHC last updated these terms in October 2024, and may update these terms again. LHC
+will post all updates to the website.
+LHC may also announce updates with special messages or alerts on the website.