Privacy Policy
Effective from 6 October 2026.
How the RESILAND CA+ Database website (data.resilandca.net) handles your data.
Who we are and how to contact us
The website belongs to the Regional Environmental Centre for Central Asia (CAREC, Almaty, Kazakhstan). CAREC decides what data is collected and why. Send any question about your data to database@carececo.org.
What data we receive
- Any visit. The server receives your IP address, browser details and the address of the page. To prevent abuse and to count views, the site briefly stores a hash of your IP address, not the address itself.
- Search. The last 500 search queries — without IP addresses or names.
- Sign-in. Sign-in works through the Auth0 service: with email and password or with Google. The site receives your email, name, nickname, profile picture link, account identifier and role, and creates a site account from them. The site never receives your password.
- Submitting a material. Details of the document, files and links, the form language, moderators’ decisions and their reasons. A published material is visible to everyone together with the name of your account.
- Requesting the Participant role. Your organisation, country and a description of the materials you plan to add.
- Reporting a problem. The reason, your message and your email if you gave it (for signed-in users — the account name and email). Your IP address is not stored.
- Security log. Sign-ins, actions on materials, moderation decisions and role changes are recorded with your account details, role, IP address, browser details, session identifier and device fingerprint (a code calculated from browser details).
- Statistics — only with your consent. Google Analytics receives the pages viewed, searches, downloads, approximate location (country, city), device, browser and language. By clicking “Allow” you also allow Google’s demographics features (Google signals): aggregated age, gender and interests, and a link to your Google account if you are signed in to Google and have allowed ad personalisation. There are no ads on the site. “No, thanks” turns this off too.
Why we use data and on what basis
- Running and securing the site — serving pages, protecting against bots and abuse, investigating incidents. Basis: our legitimate interest.
- Your account and materials — sign-in, accepting and moderating materials, role requests, problem reports, emails about decisions. Basis: without this data the site cannot do what you ask it to do.
- Growing the database — the search log shows what is missing. Basis: legitimate interest; the log contains no personal data.
- Visit statistics. Basis: your consent. Refusing does not limit your access to the site.
Who receives the data
We do not sell data and do not show ads. Data is processed by:
- Kinsta — hosting of the site, files and backups; Google Cloud servers in Frankfurt (Germany).
- Cloudflare — delivery and protection of the site; servers in many countries.
- Auth0 (Okta) — the sign-in service, EU region. It is administered by SCiO on behalf of CAREC.
- Google Workspace — the CAREC mailbox database@carececo.org that the site sends emails from.
- Google Analytics — only with consent; Google servers, including in the USA.
- Google Fonts — the fonts load from Google servers, so Google receives your IP address and browser details.
- The resilandca.net portal (WordPress.com) — your browser loads the images for its news on our home page from WordPress.com servers.
- Database moderators appointed by CAREC see submissions, role requests and problem reports. The site is technically maintained by the Forestry Digitalisation Centre (Tashkent, Uzbekistan) under a contract with CAREC.
The “Share” buttons are plain links: a social network receives data only if you follow one.
How long data is kept
- Your account and data from Auth0 — while the account is active.
- Materials and moderation decisions — while the material is in the database; a deleted material stays in the trash for 30 days.
- Role requests and problem reports — until a moderator deletes them.
- Security log — not deleted automatically: the records are needed to investigate incidents.
- Search log — the last 500 queries.
- Abuse-protection hashes — from 1 minute to 24 hours.
- Google Analytics event data — 14 months.
- Site backups — 14 days.
Cookies
Cookies are small files in your browser. Essential cookies are needed for the site to work; Google Analytics cookies are set only if you click “Allow”. Before consent Google Analytics stores no cookies, but the site may send Google anonymous signals without identifiers.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| rd_consent | remembers your cookie choice | 12 months | the site |
| pll_language | interface language | 1 year | the site (Polylang) |
| wordpress_logged_in_*, wordpress_sec_* | keeps you signed in | until the browser closes; a session lasts at most 2 days | the site (WordPress), after sign-in |
| wordpress_test_cookie | checks that the browser accepts cookies | until the browser closes | the site (WordPress), on the sign-in page |
| resiland_sso_retry | repeats the sign-in once after a sign-in error — without going round in circles | 2 minutes | the site, on the sign-in page after an error |
| rd_logout_lang | after you sign out, returns you to the home page in your language | 2 minutes | the site, when you sign out |
| wp-settings-*, wp-settings-time-* | dashboard preferences | 1 year | the site (WordPress), only in the moderator dashboard |
| __cf_bm | tells people from bots | 30 minutes | Cloudflare |
| _ga | distinguishes visitors for statistics | 2 years | Google Analytics, with consent |
| _ga_V25TM83PX2 | keeps the session state for statistics | 2 years | Google Analytics, with consent |
You can change your choice at any time with the “Cookie settings” link at the bottom of every page. After you refuse, statistics are no longer collected and the Google Analytics cookies are deleted; you can also delete any cookies in your browser settings.
A material page also notes in the tab’s storage that you have opened it, so that a view is not counted twice; the note is erased when the tab closes. Auth0 and Google set their own cookies on their own sites during sign-in, under their own rules.
Your rights
You can find out what data the site holds about you and get a copy; correct inaccurate data; delete your account; withdraw consent to statistics through “Cookie settings”; object to processing based on legitimate interest.
Write to database@carececo.org from the address of your account. We will delete your account on the site and pass on the request to delete it in Auth0. Materials you published may stay in the database, but no longer linked to your name. Security log records are kept: they are needed to protect the site.
Children
The site is intended for professionals, not for children. We do not knowingly collect children’s data. If a child has created an account, write to us and we will delete it.
Changes to this policy
We may update this policy, for example when the site gets new features. The new version is published on this page with a new date; we will announce significant changes on the site.