1. Data controller
- Controller
- [PENDING: legal name or business name]
- Address
- [PENDING: country and full address]
- Tax identification
- [PENDING: NIF, CIF or VAT number, if applicable]
- Privacy contact
- [PENDING: email address for privacy requests and data rights]
The controller's identity, establishment and contact channel must be confirmed before this draft is replaced with a publishable notice.
2. Personal data processed
An API access request may collect the following categories:
- first name and last name;
- email address;
- country, occupation and stated purpose of use;
- additional free text when “Other” is selected; and
- operational request data, such as status, timestamps, email delivery identifiers and technical logs needed for security and diagnostics.
The queue uses keyed hashes to limit abuse. The reviewed queue code does not persist the raw IP address, but a pseudonymous identifier should not automatically be treated as anonymous. Vercel and other provider logs require separate review.
Do not enter health data, political opinions, religious beliefs, biometric data or other special-category data in the free-text field. That field should be minimized and its necessity validated before launch.
3. Purposes and legal basis
The implemented flow has these separate purposes:
- receive and review an API access request;
- send operational messages about receipt and the decision;
- prevent abuse, apply limits and protect the service; and
- administer the queue and check delivery status.
[PENDING: validate a specific legal basis for each purpose, its necessity and any balancing assessment. A generic consent checkbox has not been assumed to be the appropriate basis.]
Receipt, approval and denial messages are operational. They must not be reused for marketing without a separate decision and legal basis.
4. Providers and disclosures
The audited implementation uses or may use these services:
- Vercel: hosting and server-side route execution; its logs may contain request metadata.
- Turso: storage for access requests and delivery status.
- Resend: operational email delivery to the applicant and administrator, including the data needed for each message.
- Nager.Date: server-side source for the form's country list; its terms and logs require review.
- Image servers: the browser may request an HTTPS image URL returned by the API. That request may disclose network metadata to the relevant host.
[PENDING: verify the legal entities, controller or processor roles, regions, subprocessors, retention periods, contracts and safeguards for transfers outside the EEA for each provider.]
5. Retention and deletion
The application retains pending and decided requests, together with delivery metadata, in the queue. The reviewed code does not yet implement an automatic retention or deletion flow.
[PENDING BEFORE PUBLICATION: define and apply periods or criteria for pending, approved and denied requests; email content and metadata; rate-limiting identifiers; technical logs; backups; and data retained by providers.]
6. Data rights
People must have a channel to request, where applicable, access, rectification, erasure, restriction, objection and portability, as well as to withdraw consent when processing relies on it. The controller must define identity verification, applicable exceptions and the response procedure.
[PENDING: publish the operational channel for exercising data rights and confirm whether a data protection officer or EU representative exists.]
A complaint may also be filed with the Spanish Data Protection Agency where it has jurisdiction.
7. Automated decisions and security
The request is described as manually reviewed; no automated decision has been identified that determines access approval on its own. This must be checked against actual operation and documented before publication.
The application uses protected administrator sessions, cookies with security attributes and keyed hashes to limit abuse. These measures do not replace reviews of access, secrets, logs, backups, providers, incident management and risk analysis.
8. Changes
[PENDING: effective date, version and procedure for communicating changes to the final notice.]