DHDK Trainer Privacy Policy

Welcome to DHDK Trainer Privacy Policy

1. This Privacy Policy explains how we handle your information, specifically in the context of our authorization system, which is designed with privacy and data protection as top priorities. Our system complies with the EU General Data Protection Regulation (GDPR), ensuring that your data is handled securely, transparently, and only for essential purposes.

Authorization System Overview

1. Our website uses NextAuth.js for secure user authentication. The primary authentication provider is Google OAuth, configured to request only minimal permissions to safeguard your privacy.

How We Handle Your Data

1. OAuth Login: When you log in with your Google account, we only request the openid scope. This scope limits the data we access, ensuring no personal information, such as your email, name, or profile photo, is collected or stored.
2. Unique Identifier: Google provides a unique identifier (sub) for each user. We hash this identifier for added privacy and security. This hashed value is used to manage user sessions and account information without linking it to any personal data.
3. Database Interaction:
   • If you already have an account, our system identifies you by matching the hashed identifier in our database.
   • If you are a new user, we create a unique internal user ID and store it in our system, linked only to the hashed identifier—never to personal data like your email or name.

Data Collection and Storage

1. Hashed Identifier: We store only a hashed version of Google’s identifier (sub). This ensures that your identifier cannot be linked back to you.
2. Internal User ID: For internal account management, we generate a unique user ID (UUID). This ID helps us manage your session without any connection to personal details.
3. No Personal Information Stored: Our system does not store any personally identifiable information (PII), such as your email or name, in compliance with GDPR’s data minimization principle.

GDPR Compliance

• Our data practices are designed to respect and comply with GDPR. Here’s how we ensure your privacy:
1. Data Minimization: We only request the openid scope from Google OAuth, receiving a unique identifier without additional personal data.
2. Pseudonymization: We hash the Google identifier (sub) and assign a unique internal user ID. This approach pseudonymizes your data, adding an extra layer of security.
3. No Personally Identifiable Information (PII): We do not store any PII, such as your email or name, reducing risk in case of unauthorized access.
4. Your Rights:
• Right to Access: Upon request, we can provide information regarding your internal user ID without revealing any personal data.
• Right to Be Forgotten: You may request account deletion. Since we do not store personal data, deleting your internal user ID and hashed identifier will completely remove any trace of your account.
5. Data Security: We protect your data using industry-standard encryption and secure hashing methods (SHA-256). All database connections are secured, and only essential information is stored or accessed.

Summary

• Our authorization system is designed to be both user-friendly and GDPR-compliant, with a focus on:
1. Minimal data collection (only the openid scope).
2. Pseudonymization through hashed identifiers and unique internal IDs.
3. High security standards for data handling and storage.

Contact Us

If you have any questions or concerns about our privacy practices, please contact us at marylevchenko@gmail.com.