This Privacy Policy describes how the Carolina State Department of Transportation ("CSDOT," "we," "us," or "our") collects, uses, stores, and protects information when you access or use the CSDOT staff portal (the "Portal"), including our website, authentication services, duty timeclock, promotion tools, administrative dashboards, and related Discord integration.
By creating an account, signing in, or otherwise using the Portal, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, do not use the Portal.
1. Who This Policy Applies To
This Policy applies to:
- Current, prospective, and former CSDOT department members who use the Portal;
- Department administrators and leadership with elevated access; and
- Visitors to public areas of the Portal, such as the landing page.
The Portal is intended for authorized department use only. It is not directed at children under the age of 13, and we do not knowingly collect personal information from children.
2. Information We Collect
2.1 Information from Discord (Authentication)
The Portal uses Discord OAuth for sign-in. When you authenticate with Discord, we may receive information made available through your Discord account and the scopes you authorize, which may include:
- Discord user ID;
- Discord username and display name;
- Email address associated with your Discord account;
- Profile image / avatar URL; and
- Guild membership information relevant to department role verification.
We do not receive or store your Discord password. Authentication is handled by Discord and our authentication provider.
2.2 Account and Department Information
After sign-in, we create and maintain an internal Portal account that may include:
- Assigned department role and permission settings;
- Current rank and rank assignment date;
- Account status (for example, Pending, Active, or Suspended);
- Date you joined the Portal; and
- Administrative notes or changes made by authorized staff.
2.3 Duty and Operational Data
If you are approved to use staff features, we collect operational records including:
- Shift type selected at clock-in;
- Clock-in and clock-out timestamps;
- Calculated shift duration;
- Weekly and historical duty totals; and
- Promotion requirement progress derived from your duty records.
2.4 Technical and Session Information
We automatically collect certain technical information necessary to operate the Portal, such as:
- Session identifiers and authentication tokens;
- Browser type, device information, and general usage logs;
- IP address and request metadata for security and abuse prevention; and
- Theme or display preferences stored locally in your browser where applicable.
2.5 Discord Bot Integration
If you are a member of the official CSDOT Discord server, our Discord bot may read your guild role assignments to synchronize Portal access. The bot does not collect private messages or content unrelated to department role management.
3. How We Use Your Information
We use collected information to:
- Authenticate you and maintain secure sessions;
- Verify eligibility for department membership and Portal access;
- Assign and enforce role-based permissions;
- Record, calculate, and display duty hours and shift history;
- Evaluate promotion requirements and rank progress;
- Operate administrative tools for user approval, RBAC, and rank management;
- Synchronize Portal roles with Discord guild roles where configured;
- Protect the Portal against fraud, abuse, and unauthorized access;
- Improve reliability, security, and functionality of the Portal; and
- Communicate with you regarding account status, access, or policy changes.
4. Legal Bases for Processing
Depending on context, we process information based on one or more of the following:
- Legitimate interests in operating a secure internal department portal, managing staffing records, and preventing misuse;
- Performance of department operations related to membership, duty tracking, and promotions;
- Consent, where you choose to sign in through Discord or use optional features; and
- Legal or policy compliance where required by applicable rules or department governance.
5. How We Share Information
We do not sell your personal information. We may share information only as follows:
- Within CSDOT leadership and administration: Authorized users with appropriate permissions may view member accounts, duty logs, and promotion data as necessary for department operations.
- Service providers: We use infrastructure and software providers (such as hosting, database, and authentication services) that process data on our behalf under contractual safeguards.
- Discord:Authentication and role synchronization involve communication with Discord's services subject to Discord's own privacy policy.
- Legal requirements: We may disclose information if required by law, valid legal process, or to protect the rights, safety, and integrity of CSDOT, its members, or the Portal.
6. Data Retention
We retain information for as long as necessary to provide the Portal, fulfill department operational needs, resolve disputes, enforce policies, and comply with legal obligations. Retention periods may vary by data type:
- Account and role data is retained while your membership is active and for a reasonable period thereafter;
- Duty logs and promotion records may be retained for departmental recordkeeping and audit purposes;
- Session and security logs are retained for a limited period unless needed for investigations.
We may anonymize or delete information when it is no longer required, subject to legitimate operational or legal needs.
7. Security
We implement administrative, technical, and organizational measures designed to protect information, including access controls, encrypted transport (HTTPS), environment-based secrets management, and role-based authorization. No system is completely secure; you are responsible for safeguarding your Discord account and reporting suspected unauthorized access promptly.
8. Your Choices and Rights
Depending on your jurisdiction, you may have rights to:
- Request access to personal information we hold about you;
- Request correction of inaccurate information;
- Request deletion of information, subject to operational and legal limitations;
- Object to or restrict certain processing; and
- Withdraw consent where processing is consent-based.
To exercise these rights, contact department administration using the contact method listed below. We may need to verify your identity before responding. You may also disconnect Portal access by revoking the application's authorization in your Discord account settings, though certain records may be retained as described above.
9. Third-Party Services
The Portal integrates with third-party services, including Discord. Your use of those services is governed by their respective terms and privacy policies. We are not responsible for the practices of third parties outside our control.
10. International Users
If you access the Portal from outside the United States, you understand that information may be processed and stored in jurisdictions where our servers or service providers operate, which may have different data protection laws than your location.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when changes were last made. Material changes may be communicated through the Portal or department channels. Continued use after changes become effective constitutes acceptance of the revised Policy.
12. Contact
For privacy-related questions, requests, or concerns regarding the CSDOT staff portal, contact the CSDOT administration team through your official department Discord server or the designated Sys Admin contact for the Portal.