Privacy Policy Considerations

When building a portal with APD, you should implement a privacy policy that complies with applicable regulations. This page provides guidance on privacy considerations specific to APD portals.

Why Privacy Matters

Regulatory Requirements

Portals that collect user data may be subject to:

GDPR (EU General Data Protection Regulation)
CCPA (California Consumer Privacy Act)
LGPD (Brazil's Lei Geral de Proteção de Dados)
Other regional privacy laws

User Trust

A clear privacy policy:

Builds user confidence
Demonstrates professionalism
Reduces legal risk

Data APD Collects

User Account Data

APD User table stores:

Data	Purpose
User ID	Account identification
Email	Contact, authentication
Name	Personalization
Password Hash	Authentication
Company	Multi-company access

Session Data

The APD Session table stores (real fields from the source):

Field	Purpose
SessionID	Session management
UserID	Track logged-in user
IP	Source IP address (security logging)
Company	User's current company
Language	User's UI language
User Authenticated	Whether the session has authenticated
Security Profiles filter	Profiles in effect for this session
Navision type / Navision number	BC entity link (Customer, Vendor, etc.)
Uploaded File / Uploaded File Name	Holds the file body during an in-progress upload
SystemModifiedAt	Used to derive session timeout (no separate "Last Activity" field)

Activity Data

Depending on configuration:

Data	Purpose
Page views	Usage analytics
Actions performed	Audit trail
Errors	Troubleshooting

Privacy Policy Topics

Data Collection

Document what data is collected:

Information users provide (registration)
Information collected automatically (IP, browser)
Information from Business Central (orders, invoices)

Data Use

Explain how data is used:

Providing portal services
Processing transactions
Communication
Improving services

Disclose data sharing:

With Business Central system
With third parties (if any)
With service providers

Data Retention

Specify retention periods:

User accounts
Session data
Transaction history
Logs

User Rights

Depending on jurisdiction:

Right to access
Right to correction
Right to deletion
Right to data portability
Right to object

Security Measures

Describe protection:

Password hashing
HTTPS encryption
Access controls
Session management

Cookies

If using cookies:

Session cookies
Persistent cookies
Third-party cookies
Cookie consent

Implementing Privacy Features

APD does not include a built-in <?if(not <?getvalue?>)?> form (and tag-nesting is not allowed). Use <?hasvalue?> (a conditional block that opens only when a session-memory key exists) combined with <?else?>, or drive the banner from client-side JavaScript using a cookie. Example using <?hasvalue?>:

<!-- Cookie consent banner: show only when cookie_consent has NOT been recorded -->
<?hasvalue(cookie_consent)?>
    <!-- Consent recorded — render nothing here -->
<?else?>
    <div class="cookie-banner">
        <p>We use cookies to provide portal functionality.</p>
        <button onclick="acceptCookies()">Accept</button>
        <a href="<?action(PRIVACY-POLICY)?>">Learn More</a>
    </div>
<?endif?>

The acceptCookies() function would then POST to a Script/Codeunit action that calls <?setvalue(cookie_consent,...)?> (or its scripting equivalent) to record the consent in session memory.

Data Access Request

Create an action with Require Authentication set to Yes, and have its template render the user's data. Use <?auth?> if you want a graceful "please sign in" branch within the template itself:

<?auth?>
<h2>Your Data</h2>

<h3>Account Information</h3>
<p>User ID: <?userid?></p>

<h3>Transaction History</h3>
<!-- List relevant BC data here, fenced by Security Filters so users only see their own records -->
<?else?>
<p>Please <a href="<?action(LOGIN)?>">sign in</a> to view your data.</p>
<?endif?>

Data Deletion Request

Implement account deletion:

User requests deletion
Verify identity
Process deletion
Confirm completion

Privacy Policy Page

Create a PRIVACY-POLICY action:

<h1>Privacy Policy</h1>

<h2>1. Information We Collect</h2>
<p>...</p>

<h2>2. How We Use Your Information</h2>
<p>...</p>

<h2>3. Data Sharing</h2>
<p>...</p>

<!-- Full policy content -->

Lawful Basis

Document lawful basis for processing:

Consent
Contract performance
Legal obligation
Legitimate interests

Data Protection Officer

If required, designate a DPO.

Data Processing Records

Maintain records of processing activities.

Breach Notification

Have process for 72-hour notification.

Privacy by Design

Implement data protection from the start.

Sample Privacy Policy Structure

1. Introduction
   - Who we are
   - What this policy covers

2. Information We Collect
   - Information you provide
   - Information we collect automatically
   - Information from other sources

3. How We Use Your Information
   - Providing services
   - Communication
   - Improvement
   - Legal compliance

4. Legal Basis for Processing
   - Consent
   - Contract
   - Legitimate interest
   - Legal requirement

5. Data Sharing
   - Service providers
   - Business partners
   - Legal requirements

6. Data Security
   - Technical measures
   - Organizational measures

7. Data Retention
   - Retention periods
   - Deletion criteria

8. Your Rights
   - Access
   - Rectification
   - Erasure
   - Restriction
   - Portability
   - Objection

9. Cookies
   - What cookies we use
   - How to manage cookies

10. International Transfers
    - Where data is processed
    - Safeguards

11. Children's Privacy
    - Age requirements
    - Parental consent

12. Changes to This Policy
    - How we notify changes

13. Contact Us
    - Contact information
    - Complaints

Best Practices

Transparency

Use clear, plain language
Explain data practices simply
Avoid legal jargon

Accessibility

Easy to find privacy policy
Mobile-friendly format
Available in relevant languages

Updates

Review regularly
Notify users of changes
Keep version history

Documentation

Document data flows
Maintain processing records
Record consent

Disclaimer

This page provides general guidance only. Consult with legal professionals to ensure your privacy policy meets all applicable legal requirements for your jurisdiction and use case.