Article 30 Records of Processing Activities (RoPA) — Raxx
Status: draft template. This document does NOT constitute legal advice.
Maintain this as a living document; update when processing activities change.
Required under GDPR Article 30 for any controller processing EU personal data.
Last updated: 2026-05-11 UTC.
Authority: GDPR Article 30 full text at https://gdpr-info.eu/art-30-gdpr/
ICO guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/how-do-we-document-our-processing-activities/
Mandatory fields per Art. 30(1): (a) controller identity, (b) purposes, (c) categories of
data subjects and personal data, (d) recipient categories, (e) third-country transfers,
(f) retention periods, (g) security measures.
Part A — Controller Identity
Field
Value
Controller name
[COMPANY LEGAL NAME]
Controller address
[REGISTERED ADDRESS]
Controller email
support@raxx.app
Controller's EU representative (Art. 27)
[EU REPRESENTATIVE NAME, ADDRESS, EMAIL — to be designated]
Data Protection Officer
Not appointed (not required — see analysis in diy-privacy-compliance-path-2026-05-11.md Section 3.4)
Record owner
[OPERATOR NAME / TITLE]
Last review date
2026-05-11 UTC
Part B — Processing Activities
Each row below represents a distinct processing purpose.
Activity 1: User Account Management
Field
Value
Activity name
User Account Management
Purpose
Creating and managing user accounts; authentication; account communication
Legal basis (GDPR Art. 6)
Art. 6(1)(b) — performance of contract
Categories of data subjects
Registered users of the Raxx platform
Categories of personal data
Name, email address, hashed password, account creation date, last login date
Collected automatically from platform use; operator-assigned for customer_segment
Recipients
Heroku (storage); [analytics tool if any, e.g., internal only]
Third-country transfers
US: Heroku (SCCs)
Retention period
Anonymized analytics: indefinite. Identifiable session data: 90 days
Security measures
IP anonymization after 30 days; access controls; no third-party behavioral advertising
Legitimate interest balancing note
LI assessment: operator has a legitimate interest in understanding product usage; impact on users is low (standard usage analytics, not behavioral advertising or profiling); users retain right to object under Art. 21.
Activity 5: Error Monitoring and Security Logging
Field
Value
Activity name
Error Monitoring and Security Logging
Purpose
Detecting and debugging software errors; security incident detection and response
Legal basis (GDPR Art. 6)
Art. 6(1)(f) — legitimate interest (platform security and reliability)
Categories of data subjects
All platform users
Categories of personal data
User ID (may appear in error logs), IP address, error stack traces (may contain user-generated content fragments), request metadata
Source of data
Automatically captured from platform events
Recipients
Sentry.io (error monitoring)
Third-country transfers
US: Sentry (covered by Sentry DPA at sentry.io/legal/dpa/ with SCCs)
Retention period
Error logs: 90 days in Sentry; internal security logs: [90 days / 1 year]
Security measures
Sentry data scrubbing for PII in stack traces (configure via Sentry Data Scrubbing settings); access controls on Sentry project
Action item
Confirm Sentry Data Scrubbing rules are configured to mask email/name fields in error payloads.
Action required before first EU customer: Execute DPAs with all four processors listed above. Each vendor provides a standard DPA form at the URLs listed. Time estimate: 2–4 hours total.