Records of Processing Activities — Controller Role
Satisfies GDPR Art. 30(1) and revDSG Art. 12 (Verzeichnis der Bearbeitungstätigkeiten), which require the RoPA to exist as its own document, structured by processing activity rather than by data category. Every row below restates, in that shape, content that already lives in docs/compliance/dsgvo-data-flow.md §1–3 — nothing here is newly derived. Where a row cites a processor, treat the two known staleness corrections as live for every row that touches hosting or email: hosting processor is self-hosted Supabase on Hetzner, not Vercel; transactional/broadcast email processor is AWS SES (`eu-central-1`), not Resend (register/facts.md, not yet corrected in dsgvo-data-flow.md itself — tracked as a GOV-13 nonconformity candidate).
Controller of record: wait, what. Advisory (no separate Stratify legal entity incorporated yet; register/facts.md "Entity"). Contact for data-subject requests: [email protected].
RoPA — controller-role activities
| # | Processing activity | Purpose / legal basis | Data subjects | Categories of data | Recipients | Third-country transfers | Retention | Security measures |
|---|---|---|---|---|---|---|---|---|
| 1 | Subscriber account management (sign-up, mandate selection, profile) | Provide the subscriber account and mandate-selection service — Art. 6(1)(b) | Subscribers (B2C) | Email, user_id, language, active mandate, subscription status, referral-cookie attribution (dsgvo-data-flow.md §2) | Supabase (self-hosted, Hetzner — corrects "Vercel"/"Supabase EU" in §1); AWS SES for account emails/OTP (corrects "Resend" in §1) | None for this activity specifically | Until account deletion + 30 days backup | RLS auth.uid() = user_id; see PRIV-04 |
| 2 | Marketing / waitlist | Capture pre-launch interest — Art. 6(1)(a) consent at sign-up | Prospective subscribers | Waitlist email, source, referral-code cookie | Supabase; AWS SES if a confirmation email is sent (corrects "Resend") | None | 24 months from entry (§2) | RLS; cookie scoped 90 days |
| 3 | Paid subscription billing | Process subscription upgrades — Art. 6(1)(b) | Paying subscribers | stripe_customer_id, subscription status (Stratify has no card/IBAN access, §2) | Stripe Payments Europe Ltd (joint controller, Ireland) + Stripe's own sub-processors | Stripe sub-processors, US, via SCC (§6) | As account | Card data never touches Stratify infrastructure |
| 4 | Signal delivery — subscriber channel | Deliver research signals to subscribers per their selected mandate — Art. 6(1)(b) paid / Art. 6(1)(a) consent free (§3) | Subscribers | signal_deliveries status per channel; delivery/audit metadata | AWS SES (email, corrects "Resend"); web-push/VAPID (browser); Expo Push API → APNs/FCM (mobile) | APNs (US), FCM (US/EU), Expo Push API (US) — SCC + EU-US DPF (§6) | 24 months Phase A; flips to 7 years on FMA licence grant (§2) | Audit entry per delivery step; see PRIV-04 |
| 5 | Pilot relationships (verified strategy authors) | Manage pilot accounts and enable signal publication — Art. 6(1)(b) | Pilots (role=pilot) | Account data, role assignment, pilot public profile (world-readable by design) | Supabase | None | As account | RBAC role gate; public fields are a deliberate classification choice |
| 6 | Partner-user applicant intake | Manage the applying individual's own contact relationship for /partners/sandbox onboarding — Art. 6(1)(b) contract anbahnung | Partner-org applicants (natural persons applying on the partner's behalf) | Legal name, applicant name (§2 partner_users) | Supabase | None | As account | RLS; see PRIV-02 for the distinct processor-role question of partner end-customer data |
| 7 | Audit logging (cross-cutting) | Tamper-evident record of elevated actions across all activities above, incl. GDPR export/erasure events — Art. 6(1)(c) compliance / Art. 6(1)(f) legitimate interest (§3) | All of the above, referenced by ID | Chain-hashed audit_log rows | Supabase only — service-role-key read path, no external recipient | None | 24 months Phase A; 7 years post-licence (§2) | DB-trigger append-only + SHA-256 chain hash; detail in PRIV-04 |
| 8 | Product analytics / error telemetry (cross-cutting) | Product analytics and error diagnostics — Art. 6(1)(f) + UI opt-out (§3) | Subscribers, pilots, site visitors | Event data (no autocapture, explicit identify() only); sanitized error payloads | PostHog (EU); Sentry (EU, server-side only) | None | PostHog 12 months default; Sentry 30 days default / 90 days paid (§2) | PII sanitization enabled (§9) |
Notes
- Row 6 is deliberately narrow: it covers the applicant's *own* identity data, which Stratify holds
as controller. It is not the same question as whether Stratify processes a partner's *end-customer* data on the partner's instructions — see PRIV-02, which finds that activity does not currently exist in a form that meets the Art. 30(2) processor-role definition.
- This table does not invent categories beyond what
dsgvo-data-flow.md§2 already lists. If a new
processing activity is added to the product, add a row here and to §2 of the source document in the same change.
Review
Reviewed whenever dsgvo-data-flow.md §1–3 changes, and at minimum on the annual cadence set at approval. Owner: DPO / Privacy Owner (Antonios), matching dsgvo-data-flow.md's own ownership line.