Add privacy policy and cookies for software package

_software/cookies.md

@@ -0,0 +1,19 @@
+---
+layout: software
+title: Cookies
+excerpt: "This page explains the use of cookies on this software"
+category: Policy
+---
+
+Cookies are small files saved on your phone, tablet or computer when you visit a website.
+
+We use cookies to make the Mentor Matcher work.
+
+## Essential cookies
+
+We use some cookies to make the Mentor Matcher work properly. We do not need to ask permission to use them.
+
+| Name | Purpose | Expires |
+|------|---------|---------|
+| `data-folder` |	This unique string is the name of the folder where your uploaded data is stored | 30 minutes |
+| `matching_func` | Stores the choice you make about how mentors and mentees should be matched together | 30 minutes | 

_software/privacy.md

@@ -0,0 +1,76 @@
+---
+layout: software
+title: Privacy
+excerpt: "This page explains the privacy and data policy for this service"
+category: Policy
+---
+
+Mentor Matching Online's **Mentor Matcher** software is a free to use, volunteer-led project. It was originally developed for use by the [Civil Service LGBT+ Network](//www.civilservice.lgbt/mentoring). This software can be used to automate the process of matching mentors and mentees who have signed up to a structured mentoring programme. 
+
+The software is available as a hosted service to use online, or as a software package that you can install locally.
+
+This policy explains how data is collected and processed when it is uploaded to the hosted service available at [www.mentormatching.online](//mentormatching.online).
+
+We take your privacy seriously and will handle your data with care and respect.
+
+## How to contact us
+
+If you have any questions about this software, or our privacy policy, you can contact us by emailing <software@mentormatching.online>, or [raise an issue on Github](//github.com/mentor-matching-online/mentor-match/issues).
+
+## Lawful basis for processing
+
+**You must identify a lawful basis to process the data you input to this service.** If you have not done this, you are not permitted to use this service. The volunteers providing this software accept no responsibility or liability for your compliance with relevant data protection legislation. 
+
+The UK Information Commissioner's Office has published [guidance on identifying a lawful basis to collect and process data](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/). 
+
+## What data is collected
+
+This software collects and processes:
+
+- structured data that you provide to us about participants in your programme
+- analytics data to help us understand how this service is used
+
+## How data is collected, and why we have it
+
+### Structured data
+
+All of the data we process as part of the matching process is provided to us directly by you. We collect the data so that we can provide you with matches for your use in a structured mentoring programme.
+
+### Analytics
+
+We use analytics tools to collect usage information for this software.
+
+## How we will use the data we collect
+
+### Structured data 
+
+We collect this data so that we can match participants with one or more potential mentoring matches. We do not use the data for any other purpose.
+
+### Analytics
+
+We collect this information so that we can understand how this software package is used. Data you upload to the service is not included in these analytics. 
+
+The analytics tools are provided by a third party provider ([Cloudflare](https://www.cloudflare.com/en-gb/web-analytics/)). The analytics tools are non-invasive and respect your privacy. The analytics tools do not use any client-side state, such as cookies or localStorage, to collect usage metrics. The analytics tools do not “fingerprint” you via your IP address, User Agent string, or any other data for the purpose of collecting analytics. The analytics tools do not collect personal information, or track you across sites.
+
+## How we store your information
+
+### Structured data
+
+Data you provide to us for the matching process is retained only for as long as is strictly necessary to enable the software to work. As soon as you have downloaded the matching results, or after 30 minutes of inactivity, the data you upload is deleted.
+
+### Analytics
+
+Data we collect for analytical purposes is only kept in aggregate form. We do not collect or retain personally identifiable information.
+
+## Changes to this policy
+
+We keep this policy under review. Any updates to this policy will be published on this website. This policy was last updated on 14 August 2023.
+
+<details markdown=1>
+<summary>Updates to this policy</summary>
+
+### 14 August 2023
+
+Policy published
+
+</details>