GDPR compliance

Site Feedback
1

The privacy policy is short and sweet. However for GDPR compliance I (I’m not a lawyer) believe 6 operational areas need to be covered:

  1. Lawful Basis & Consent: Establish a clear legal reason (e.g., explicit consent, contract, legal obligation) before processing any personal data.
  2. Clear Privacy Notices: Inform individuals in plain language about what data you collect, why you collect it, and who you share it with.
  3. Data Minimization & Storage Limits: Collect only the minimum data necessary for your specific purpose and delete it when it is no longer needed.
  4. Data Subject Rights: Honor user requests to access, correct, export, or erase their personal data (the “right to be forgotten”).
  5. Security & Breach Notification: Implement technical safeguards (like encryption) and report data breaches to authorities within 72 hours.
  6. Vendor Agreements & Accountability: Maintain records of processing activities (RoPA) and sign Data Processing Agreements (DPAs) with any third-party tools or vendors.

I noticed that topic 4 is missing. Probably some others are, too.

2

You’re right, we’re not having a full coverage here. We are currently working towards this.

Data subject rights

Correct, we didn’t cover that completely in our current privacy policy. The rewritten policy adds the full Art. 15–22 section: access, rectification, erasure, restriction, portability, objection, how to exercise them, a one-month response commitment, and the right to complain to a supervisory authority.

We also found that two numbers in the current policy weren’t reflecting the current processes: log and backup retention were both longer than stated. The corrected figures are in the new version.

EU representative

devXY is Swiss company, so Art. 3(2) applies to us and Art. 27 requires a designated representative in an EU member state. We don’t have one. That’s being arranged now.

Sub-processor list

Split out of the privacy policy into its own document (see this PR), so changing a provider is a change to that list rather than a reissue of the policy.

Mail

Postale is a French company, but their mail servers run on AWS in the US. We hadn’t noticed this until now and never disclosed. We will move our outbound notifications to Scaleway’s transactional email service and see if we can get access to their Mailbox offering for normal mailboxes (which is still in beta).

S3 Provider

All backups we store there is encrypted on our own servers before upload, with keys Backblaze never receives, so they hold ciphertext which can’t be read. That’s the supplementary measure the EDPB describes for transfers of this kind. Using an EU storage region helps, but it isn’t what makes it lawful by itself: Backblaze is US-incorporated, so the transfer still gets disclosed and will need need a Chapter V mechanism behind it. Both are in the new sub-processor list.

On choosing Backblaze: we’ve made good experiences with them in the past and their pricing is hard to beat. We are currently not aware of a EU service that comes close to it. Hetzner did in pricing, but the stability was always a problem and the latest outage, which almost resulted in data loss on their end and an outage on our end of multiple hours, led us to the decision to move away from it.

We’re happy to reconsider this at any time or switch to another EU-owned company that provides a similar service/pricing ratio. Suggestions welcome!