GDPR Art. 30 — Records of Processing Activities
Processing record
This record fulfills the GDPR Article 30 obligation to maintain a record of processing activities. The public version here is an extended copy of the internal record kept for production to Datatilsynet (the Danish DPA) on request.
Processing activities
Receiving and responding to inquiries submitted via the website contact form.
- Legal basis
- Art. 6(1)(b) (steps prior to contract) and Art. 6(1)(f) (legitimate interest in responding to inquiries).
- Data subjects
- Individuals who voluntarily submit the contact form.
- Personal data
- Name (first/last or company name), email, any attached files, optional company name, message content.
- Recipients
- Resend (email provider, US — EU-US Data Privacy Framework certified), self-hosted contact service + PostgreSQL database on a Hetzner server (Nuremberg, Germany, EU).
- Retention
- Until inquiry resolved or max 5 years (Bookkeeping Act §12 if the inquiry results in a paid engagement).
Payment processing via Stripe Checkout — collecting payment, issuing receipts, bookkeeping and VAT settlement.
- Legal basis
- Art. 6(1)(b) (contract performance) and Art. 6(1)(c) (legal obligation — Bookkeeping Act and VAT Act).
- Data subjects
- Customers who have completed a payment.
- Personal data
- Name, email, billing address, country, optional VAT/CVR number, payment method type (card/MobilePay/Link), Stripe identifiers (charge ID, session ID, receipt nr), amount, description of services delivered. NO card data — Stripe handles that in their PCI-DSS environment.
- Recipients
- Stripe (PCI-DSS-certified payment processor, US/EU — EU-US Data Privacy Framework + EEA SCCs), Resend (receipt email), self-hosted checkout service + PostgreSQL database on a Hetzner server (Nuremberg, Germany, EU).
- Retention
- 5 years from end of accounting year (Bookkeeping Act §12). Erasure of personal data from invoice records is not possible until this period expires — legal obligation overrides Art. 17 right to erasure.
Anonymised first-party usage analytics on philipsloth.com — pageviews, sources, performance — to understand audience and optimise the site. Cookieless and aggregated. The processing is opt-in (consent-gated): nothing is collected and no visitor/session ID is created until the visitor clicks Accept on the first-visit notice; consent can be withdrawn at any time via the banner toggle, the /legal/cookies page, the browser's Do-Not-Track header, or by clearing site data.
- Legal basis
- Art. 6(1)(a) (consent — the visitor opts in via the first-visit notice before any analytics identifier is created; consent is withdrawable at any time).
- Data subjects
- Visitors to philipsloth.com who have consented to analytics on the first-visit notice.
- Personal data
- Locally generated pseudonymous ID (UUID in localStorage, no national identifier), session ID, page path, referrer, browser, OS, device type, language, viewport, scroll depth, duration, geographic country/city/region (server-side derived from IP, IP itself is NOT stored).
- Recipients
- Self-hosted analytics service + PostgreSQL database on a Hetzner server (Nuremberg, Germany, EU) — country/city is derived in memory from the IP against a local GeoLite2 database on the server; the IP itself is not stored. NO third-party analytics tools (no Google Analytics, Meta Pixel, Plausible cloud, etc.).
- Retention
- Raw events: 30 days (auto-deleted thereafter). Aggregated daily rollups: 24 months. Visitor rows: erased on opt-out.
Access control to the admin panel (owner only) via self-hosted GoTrue magic-link.
- Legal basis
- Art. 6(1)(f) (legitimate interest in secure access).
- Data subjects
- Owner (Philip Sloth) — the only account on the allowlist.
- Personal data
- Email address, login timestamp, session token (JWT), IP address at login moment (auth audit log on the self-hosted server).
- Recipients
- GoTrue auth (self-hosted on a Hetzner server, Nuremberg, EU), Resend (magic-link email).
- Retention
- Session data: 30 days. Audit log: 90 days (automated purge job on the self-hosted server).
Sub-processors
The following third-party providers process personal data on our behalf. All have a signed data-processing agreement (DPA) or equivalent contractual safeguard.
| Provider | Purpose | Region | Safeguards |
|---|
| Cloudflare Inc. | Hosting (Pages), DNS, anti-bot (Turnstile), R2 backup | EU edge (data primarily flows through EU data centres) | EU-US Data Privacy Framework certified + Standard Contractual Clauses |
| Hetzner Online GmbH | Cloud server hosting the self-managed PostgreSQL database, authentication (GoTrue), and API | EU (Nuremberg, Germany) | EU processor — data does not leave Germany/EU; data processing agreement (AVV/DPA) concluded with Hetzner |
| Stripe Inc. | Payment processing, receipts, OSS reporting | EU (Stripe Payments Europe in Ireland) + US (Stripe Inc.) | EU-US Data Privacy Framework certified + EEA SCCs (Modules 2 and 3) |
| Resend | Transactional email (receipts, magic-link, invoice link) | US | EU-US Data Privacy Framework certified + DPA on file |
| EU VIES (Europa-Kommissionen) | Validation of customers' VAT numbers | EU | Public EU service, no DPA required |
Security measures (Art. 32)
- TLS 1.3 on all endpoints (Cloudflare-managed on the site; Caddy-managed with automatic Let's Encrypt certificates on the API host).
- Row Level Security (RLS) enabled on every Postgres table — customers cannot read each other's data.
- Service-role keys server-side only (environment secrets on the backend server), never in browser bundles.
- Cloudflare Turnstile + honeypot + per-IP rate-limiting on public forms.
- Magic-link authentication for admin (no passwords to steal), allowlist-based access.
- MIME allowlist + filename sanitisation on file uploads.
- Stripe webhook signatures verified via HMAC-SHA256 (rejects forged webhooks).
- Backup: daily automated database backup, client-side encrypted (age) and shipped off-site to Cloudflare R2, with e-mail alerting on failure and verified restoration.
Your rights
As a data subject, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). Email philipsloth1@gmail.com — we respond within 30 days.
Note: For data subject to the 5-year retention obligation under the Danish Bookkeeping Act (invoice-related personal data), we CANNOT erase until the statutory period expires. The legal obligation overrides Art. 17.
Last updated: May 2026. Versions of this record are kept in the bookkeeping folder for Datatilsynet inspection.
