Record of Processing Activities

Art. 30 of Regulation (EU) 2016/679 (GDPR)

Last updated: 22 February 2026

Data Controller

IDCERT S.r.l. Societa Benefit

Registered office: Italy

Email: privacy@idcert.io

Certified email (PEC): available on registroimprese.it

The Controller has not appointed a DPO as the processing does not fall within the cases provided by Art. 37 GDPR. For any request regarding data protection, please contact privacy@idcert.io.

T-01Technical operation of the portal

Purpose (Art. 30.1.b): Ensure the correct operation, security, and performance of the LifeComp Explorer web portal
Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR)
Categories of data subjects (Art. 30.1.c): All portal visitors
Categories of personal data (Art. 30.1.c): Navigation data: IP address (anonymised via SHA-256 hash with daily rotating salt), requested URLs, access time, browser user agent (truncated to 500 chars)
Recipients (Art. 30.1.d): Vercel Inc. (hosting/CDN), Supabase Inc. (database)
Transfers outside EU (Art. 30.1.e): Vercel Inc.: EU servers (fra1) and USA — Standard Contractual Clauses (SCCs). Supabase Inc.: EU servers (AWS eu-central-1)
Erasure deadlines (Art. 30.1.f): Technical logs: 90 days. IP hash: not reversible after 24 hours (rotating salt)
Security measures (Art. 30.1.g / Art. 32): HTTPS/TLS, HSTS preload, Content Security Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, restrictive Permissions-Policy, IP anonymisation with SHA-256 + daily salt

T-02Cookie consent management (GDPR accountability)

Purpose (Art. 30.1.b): Record user cookie choices to demonstrate GDPR compliance (accountability principle, Art. 5(2))
Legal basis: Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR)
Categories of data subjects (Art. 30.1.c): All visitors interacting with the cookie banner
Categories of personal data (Art. 30.1.c): Anonymous session ID (UUID, lc_session_id cookie), consent preferences (necessary/analytics/marketing), anonymised IP hash (SHA-256 + salt), user agent (truncated), accepted policy versions, timestamp, action (accept/reject/customise)
Recipients (Art. 30.1.d): Supabase Inc. (database, consent_logs table)
Transfers outside EU (Art. 30.1.e): Supabase Inc.: EU servers (AWS eu-central-1). No transfers outside the EU
Erasure deadlines (Art. 30.1.f): 24 months from consent recording. lc_consent browser cookie: 12 months. lc_session_id cookie: 12 months
Security measures (Art. 30.1.g / Art. 32): UUID not traceable to identity, IP anonymised with SHA-256 + daily rotating salt (not reversible after 24h), Row Level Security (RLS) on Supabase, CSRF origin check, parameterised queries

T-03Contact request management

Purpose (Art. 30.1.b): Respond to requests submitted by users via the portal contact form
Legal basis: User consent (Art. 6(1)(a) GDPR) — mandatory privacy policy acceptance checkbox
Categories of data subjects (Art. 30.1.c): Users who voluntarily fill in the contact form
Categories of personal data (Art. 30.1.c): Name, email address, message subject, message content, anonymised IP hash, user agent, timestamp, locale
Recipients (Art. 30.1.d): Supabase Inc. (database, contact_requests table)
Transfers outside EU (Art. 30.1.e): Supabase Inc.: EU servers (AWS eu-central-1). No transfers outside the EU
Erasure deadlines (Art. 30.1.f): 12 months from the request date
Security measures (Art. 30.1.g / Art. 32): Input validation with max lengths (name 100, email 254, subject 200, message 5000), honeypot anti-spam, rate limiting (max 3 requests/hour per IP), CSRF origin check, parameterised queries, IP anonymised with SHA-256 + salt

T-04LifeComp self-assessment

Purpose (Art. 30.1.b): Allow users to perform an anonymous self-assessment of their LifeComp competences and save results
Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR) — data is completely anonymous
Categories of data subjects (Art. 30.1.c): Users who voluntarily use the self-assessment tool
Categories of personal data (Art. 30.1.c): Anonymous session ID (UUID, lc_assessment_session cookie), scores per competence (1-5 scale), locale, timestamp. NO identifying data: it is not possible to trace back to the user's identity
Recipients (Art. 30.1.d): Supabase Inc. (database, self_assessments table)
Transfers outside EU (Art. 30.1.e): Supabase Inc.: EU servers (AWS eu-central-1). No transfers outside the EU
Erasure deadlines (Art. 30.1.f): Retained indefinitely in completely anonymous and non-identifiable form. lc_assessment_session browser cookie: 24 hours
Security measures (Art. 30.1.g / Art. 32): UUID not traceable to identity, no personal data collected, CSRF origin check, parameterised queries, RLS on Supabase

T-05Traffic statistical analysis (Google Analytics)

Purpose (Art. 30.1.b): Collect aggregate and anonymous statistical data on portal usage to improve the service
Legal basis: User consent (Art. 6(1)(a) GDPR) — loaded ONLY after explicit consent to 'analytics' category via cookie banner
Categories of data subjects (Art. 30.1.c): Visitors who have given consent to the analytics category
Categories of personal data (Art. 30.1.c): Aggregate navigation data: pages viewed, session duration, device type, general geographic area. IP anonymised by Google (anonymize_ip: true). Google identifiers: _ga cookie (24 months), _ga_* cookie (24 months)
Recipients (Art. 30.1.d): Google LLC (Google Analytics 4)
Transfers outside EU (Art. 30.1.e): Google LLC: USA — EU-US Data Privacy Framework (European Commission adequacy decision 10/07/2023) + Standard Contractual Clauses (SCCs)
Erasure deadlines (Art. 30.1.f): _ga cookie: 24 months. _ga_* cookie: 24 months. Google Analytics data: per Google's data retention policies (default 14 months)
Security measures (Art. 30.1.g / Art. 32): Consent-gated loading, anonymize_ip: true, no personal data sent to Google, consent revocable at any time via CookieFAB/footer

T-06User interface preferences

Purpose (Art. 30.1.b): Store technical user preferences (language, light/dark theme, sidebar state) to ensure a consistent user experience
Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR) — strictly necessary cookies
Categories of data subjects (Art. 30.1.c): All portal visitors
Categories of personal data (Art. 30.1.c): Language code (it/en/es/fr, NEXT_LOCALE cookie), theme preference (localStorage theme, managed by next-themes), sidebar state (sidebar:state cookie, true/false value)
Recipients (Art. 30.1.d): None — data stored exclusively in the user's browser and not transmitted to third parties
Transfers outside EU (Art. 30.1.e): No transfers. Data exclusively client-side
Erasure deadlines (Art. 30.1.f): NEXT_LOCALE: 12 months. theme (localStorage): until manual deletion. sidebar:state: 7 days
Security measures (Art. 30.1.g / Art. 32): No personal data involved. Data not transmitted to server. SameSite=Lax on all cookies

This record is drawn up pursuant to Art. 30 of Regulation (EU) 2016/679. The Controller undertakes to update this record whenever processing activities change. Previous versions are available in the Archive section of the portal.

Search the framework

Record of Processing Activities

Record of Processing Activities