Assimilate pkgstats
The privacy policy explicitly mentions pkgstats in the Using (processing) your personal data, but the project is hosted on a different domain (https://pkgstats.archlinux.de/) so different people probably have access to the data (probably @pierre is responsible, but there may be more).
It should be handled differently in the policy, or maybe in the project itself. One solution would be to assimilate pkgstats into the archlinux.org domain and infrastructure.