GDPR Compliance Documentation

OrangeCone Platform

Last Updated: February 16, 2026

Executive Summary

This document outlines OrangeCone's compliance with the General Data Protection Regulation (GDPR) and demonstrates our commitment to protecting user privacy and data rights. Our platform has implemented comprehensive technical and organizational measures to ensure full compliance with GDPR requirements.

1. Legal Basis for Data Processing

Contract Performance (Art. 6(1)(b))

Processing necessary to provide our civic engagement services, including account management, report submission, and community features.

Consent (Art. 6(1)(a))

User consent obtained for optional features such as analytics cookies, marketing communications, and location tracking.

Legitimate Interest (Art. 6(1)(f))

Platform security, fraud prevention, and service improvement based on our legitimate business interests.

2. Data Subject Rights Implementation

GDPR Right	Implementation	Status
Right to Access	Settings → Download My Data (JSON export)	✓ Implemented
Right to Rectification	Settings → Profile editing functionality	✓ Implemented
Right to Erasure	Settings → Delete Account (soft delete with 30-day grace period)	✓ Implemented
Right to Data Portability	Machine-readable JSON export with 7-day download link	✓ Implemented
Right to Restrict Processing	Contact privacy@orangecone.app for manual processing	✓ Implemented
Right to Object	Settings → Notification preferences, marketing opt-out	✓ Implemented
Right to Withdraw Consent	Cookie banner, notification settings, account deletion	✓ Implemented

3. Consent Management

Cookie Consent Banner

• Displays on first visit before non-essential cookies are set
• Provides clear options: Accept All, Essential Only, Customize
• Links to Privacy Policy for detailed information
• Stores user preferences in localStorage
• Allows users to change preferences anytime

4. Data Minimization Principles

OrangeCone collects only data necessary for platform functionality:

Required Data: Email, username, password (authentication)
Optional Data: Profile photo, location preferences, notification settings
User-Generated: Reports, comments (publicly submitted content)
Automatic: Device info, IP address (security and analytics only)

5. Data Security Measures

Technical Measures

• End-to-end encryption (TLS/SSL)
• Encrypted data storage
• Secure authentication (bcrypt)
• Role-based access control
• Regular security audits

Organizational Measures

• Staff privacy training
• Data breach response plan
• Access logging and monitoring
• Vendor management procedures
• Regular compliance reviews

6. Data Retention Policy

Data Type	Retention Period	Reason
Active Account Data	While account is active	Service provision
Deleted Account Data	30 days (grace period), then anonymized	Account recovery option
Public Reports	Indefinitely (anonymized after account deletion)	Community benefit
Analytics Data	24 months	Platform improvement
Security Logs	12 months	Security and fraud prevention

7. Third-Party Data Processors

OrangeCone uses the following third-party processors, all with GDPR-compliant Data Processing Agreements:

Base44 Platform: Hosting, database, backend services
Email Service Provider: Transactional emails and notifications
Cloud Storage: Image and video file storage
Analytics Provider: Aggregated usage analytics (anonymized)

8. Data Breach Procedures

Breach Response Protocol

Immediate detection and containment of breach
Assessment of scope and risk to individuals
Notification to supervisory authority within 72 hours (if required)
Communication to affected individuals (if high risk)
Documentation of breach and response actions
Implementation of corrective measures

9. International Data Transfers

If data is transferred outside the EEA, we ensure appropriate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission, or by processing data only in countries with adequacy decisions.

10. Documentation and Records

As required by Article 30 GDPR, we maintain records of processing activities including:

Purpose of processing
Categories of data subjects and personal data
Categories of recipients of personal data
International data transfers and safeguards
Retention periods
Technical and organizational security measures

11. User Rights Exercise Process

How Users Can Exercise Their Rights

In-App Tools:

Settings page provides direct access to data download, profile editing, and account deletion.

Email Contact:

privacy@orangecone.app - Responses within 30 days as required by GDPR

Identity Verification:

Users must be logged in or provide verification details to exercise rights

12. Supervisory Authority

Users have the right to lodge a complaint with their local data protection authority. For more information, visit your country's data protection authority website.

13. Compliance Monitoring

OrangeCone conducts regular compliance reviews including:

Quarterly privacy policy reviews
Annual data protection impact assessments (DPIAs)
Ongoing monitoring of data subject rights requests
Regular security audits and penetration testing
Staff training on GDPR compliance

GDPR Compliance Status: Fully Compliant

This documentation demonstrates OrangeCone's comprehensive compliance with GDPR requirements through technical implementations, organizational procedures, and transparent user communication.

Contact for Compliance Inquiries:
Email: privacy@orangecone.app
Data Protection Officer: dpo@orangecone.app