EU GDPR

Freely given, specific, informed and unambiguous consent per Art. 4(11) and Art. 7 GDPR. Each purpose is opted in separately (granularity). The signe…

Website cookie and tracker disclosure paired with the consent banner. Categories follow the standard strictly-necessary / functional / analytics / ma…

Notification to be lodged with the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after the control…

Notification to affected data subjects in clear and plain language when a personal data breach is likely to result in a high risk to their rights and…

Internal register documenting how long each category of personal data is kept, why, and how it is deleted at end of retention. Supports the storage-l…

Controller-to-processor contract mandated by Art. 28(3) GDPR. Structured to align with the Article 28 obligations and compatible with Commission SCCs…

DPIA for high-risk processing. Mandatory under Art. 35 when processing is likely to result in a high risk to the rights and freedoms of natural perso…

Response letter sent to a data subject exercising the right of access. Must be supplied without undue delay and in any case within one month of recei…

Transparency notice supplied to data subjects at collection (Art. 13) or within a reasonable period when data is obtained indirectly (Art. 14). Cover…

Article 30 GDPR register. Supports both controller records (Art. 30(1)) and processor records (Art. 30(2)) — set record_type accordingly and populate…