Adding privacy statement

_data/footer_menu.yml

@@ -4,3 +4,5 @@
   link: https://twitter.com/hashtag/BioHackEU24
 - name: GitHub
   link: https://github.com/elixir-europe/biohackathon-europe-2024
+- name: Privacy
+  link: /privacy/

_includes/youtube-video.html

@@ -1,8 +1,12 @@
-<figure class="image is-16by9 my-6"> 
+
+<div class="block has-background-light p-4">
+<p class="has-text-weight-bold my-2">Please be aware that YouTube videos load cookies when you start playing them. Unfortunately we cannot stop this. See the <a href="/privacy/">website privacy statement</a>.</p>
+<figure class="image is-16by9 mt-4"> 
     <iframe class="has-ratio" 
         src="https://www.youtube-nocookie.com/embed/{{ include.video }}?start={{ include.time | default: 0 }}&showinfo=0" 
         frameborder="0" 
         allowfullscreen
         >
     </iframe>
-</figure>
+</figure>
+</div>

privacy.md

@@ -0,0 +1,41 @@
+---
+title: Privacy
+subtitle: 
+description: The privacy statement of the BioHackathon Europe website.
+layout: page
+show_sidebar: false
+hero_image: /img/heroes/hero-discussion.webp
+hero_darken: true
+---
+
+This Privacy Policy explains what personal data is collected by the BioHackathon website.
+
+## What data we collect
+We collect data about activity on the site, such as:
+
+  * which pages have been visited
+  * how long people spend on each page
+  * which browsers and devices people use to view the site
+  * which country people view the site from.
+
+The information is collected anonymously and aggregated. We cannot identify you from the information gathered, or track your web browsing outside of this site.
+
+## How we collect the data
+We use [Matomo Analytics](https://matomo.org/) to collect this data. We have our own instance of Matomo, hosted in Germany, and we use Matomo **without setting cookies**. See the Matomo statement on its [GDPR compliance](https://matomo.org/gdpr-analytics/).
+
+## Why we collect the data
+We collect the data so that we can then generate reports about the site for our funders. We also collect the date to help us improve the site, and ensure we design the site for the browsers and devices that most people are using.
+
+## Who has access to the data
+The data collected by Matomo is sent to our servers in Germany, and is only accessible by the website administrator.
+
+## If you have concerns about your data
+Please contact <[email protected]> if you have any queries concerning the data we may have.
+
+## Data collected by GitHub 
+The website is hosted on GitHub, and GitHub collects the IP addresses of site visitors for security purposes (see their [Data Collection statement](https://docs.github.com/en/pages/getting-started-with-github-pages/about-github-pages#data-collection)). This enables them to detect and block attacks on the sites hosted by them e.g. by blocking the IP address of the attacker.
+
+## YouTube videos and privacy
+The YouTube videos embedded in this site are embedded using [privacy-enhanced mode](https://support.google.com/youtube/answer/171780?hl=en-GB#zippy=%2Cturn-on-privacy-enhanced-mode). 
+
+**Unfortunately this does not stop YouTube tracking your viewing habits.** Instead of a cookie, YouTube save a snippet of data in another part of your browser, called local storage. We cannot stop this. When you start playing a video on this site, YouTube will then set some cookies in your browser to track your viewing habits. Again, we cannot turn this off. We have put a warning above each video so you can make an informed choice about whether to play the video.