Privacy notice: contributor onboarding

Version: v0.1-draft

Aegion Partners Pte Ltd (UEN 202218646H), of 160 Robinson Road, Singapore 068914, Singapore (we) runs this contributor onboarding page. This notice explains what we record when you sign in and accept the contributor agreement, why, and who can see it.

What we record

When you sign in with GitHub, we read your GitHub account number, your login, your verified primary email address and whether two-factor authentication is turned on for your account. We do not keep your GitHub access token once we have read these details.

When you accept the agreement, we record:

• your GitHub account number and login;
• your email address, and the time we saw it as verified;
• whether your GitHub account has two-factor authentication turned on;
• that you ticked the box and clicked the button, with the exact wording of both;
• the time of acceptance, in Coordinated Universal Time;
• the version of the agreement and a fingerprint (SHA-256 hash) of its exact text;
• the version of this page;
• your IP address, and the chain of forwarding addresses if your connection passed through a proxy;
• your browser details (the user agent string);
• a scrambled (hashed) form of your session identifier;
• the country where you told us you live; and
• the reference number of the confirmation email we send you.

If you click "I do not accept (log out)", we record only that your login declined, and the time. If sign-in is refused, we record your login, the reason and the time.

Why we record it

We record these details to prove that you signed the agreement, which version you signed, and when, and to send you a copy. Your email address is also the address for notices under the agreement. Your country of residence decides whether the additional Australian provisions in Schedule 3 of the agreement apply to you. We use these details for no other purpose.

Where it is kept

The record is kept in a database and, as a second copy, in a separate storage bucket that does not allow records to be changed or deleted, both run for us by Cloudflare. The confirmation email is sent through Resend. Sign-in is through GitHub. Each of these providers may process the details on servers outside Singapore.

Records are never edited or deleted. If a record needs correcting, we add a new record that refers to the old one.

Who can see it

Only our directors and the onboarding system itself can read the records. We log every read by a director, with the director's login and the time.

How long we keep it

The record proves our ownership of the work you contribute, so we keep it, and the agreement text it points to, for the life of the copyright in that work plus six years.

Cookies

The page sets two cookies, both needed for it to work: one that keeps you signed in for up to 8 hours, and one that protects the GitHub sign-in step for up to 10 minutes. There are no analytics or advertising cookies.

The law that applies

Your IP address, browser details and email address are personal data under Singapore's Personal Data Protection Act 2012, and possibly under Australia's Privacy Act 1988 (Cth). We handle them for the purpose set out above.

Your rights and how to reach us

You may ask to see the personal data we hold about you, or to correct it, by writing to cp@aegionpartners.com. Because the record is evidence of a signed agreement, a correction is added as a new record rather than by changing the old one.