Record of processing activities
Article 30 of the GDPR requires us to keep a record of what we do with personal data. This is that record, published in full.
It is not a summary written alongside the register. The page reads the register: the same rows the retention job and the admin console read. If a line here is wrong, the platform is wrong, not the wording.
Everything is stored in the European Union. The database is created in Cloudflare’s Western Europe region and object storage in its EU jurisdiction. Cloudflare is the only processor in the list below, and it is US-headquartered, so its data processing addendum and the standard contractual clauses in it cover any access that follows from that.
Every entry last reviewed on or after 28 October 2026.
The activities
| Ref | Activity | Lawful basis | Impact assessment |
|---|---|---|---|
| PA-01 | Account and organization management | Contract (Art. 6(1)(b)) | Not required |
| PA-02 | Event invitations and RSVPs | Consent (Art. 6(1)(a)) | Required |
| PA-03 | Trail registry | Legitimate interests (Art. 6(1)(f)) | Not required |
| PA-04 | Project updates and digests | Consent (Art. 6(1)(a)) | Not required |
| PA-05 | Award voting | Consent (Art. 6(1)(a)) | Required |
| PA-06 | Moderation and audit | Legitimate interests (Art. 6(1)(f)) | Not required |
| PA-07 | Data subject requests | Legal obligation (Art. 6(1)(c)) | Not required |
| PA-08 | Aggregate analytics | Legitimate interests (Art. 6(1)(f)) | Not required |
PA-01. Account and organization management
| Purpose | Authenticate organizers, maintain organizations, teams and roles so projects have accountable owners. |
|---|---|
| Lawful basis | Contract (Art. 6(1)(b)) |
| Controller | Commons |
| Categories of personal data | email, display name, avatar, session metadata. |
| Categories of data subject | organizers, members. |
| Recipients | Cloudflare (hosting, database, email delivery). |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | Until account deletion; sessions expire after 30 days. |
| Security measures | TLS in transit, data at rest in EU jurisdiction, magic-link auth with no stored passwords, role-based access. |
| Impact assessment | Not required for this activity. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
PA-02. Event invitations and RSVPs
Special category dataImpact assessment required| Purpose | Invite named people to events, record their response, manage capacity and waitlist, and confirm attendance. |
|---|---|
| Lawful basis | Consent (Art. 6(1)(a)) |
| Controller | Commons and the organizing organization (joint) |
| Joint controller | The organizing organization decides whom to invite; Commons provides the means. |
| Categories of personal data | email, display name, RSVP response, attendance, custom answers. |
| Special category data (Art. 9) | dietary requirements (may reveal religion or health), accessibility requirements (health). |
| Categories of data subject | invitees, attendees. |
| Recipients | Cloudflare (hosting, database, email delivery), the organizing organization. |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | Unconfirmed invitations 90 days. Special-category notes hard-deleted 90 days after the event. Attendance records retained by the organizer. |
| Security measures | Double opt-in before any mailing state; invitation tokens stored only as hashes; no account created without the subject's action. |
| Impact assessment | Special-category data at scale; DPIA required before public launch. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
PA-03. Trail registry
| Purpose | Publish walking and cycling routes submitted by organizations, and review them for official registration. |
|---|---|
| Lawful basis | Legitimate interests (Art. 6(1)(f)) |
| Controller | Commons |
| Categories of personal data | uploader identity, route geometry. |
| Categories of data subject | organizers. |
| Recipients | Cloudflare (hosting, object storage), the public. |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | Published routes retained indefinitely as a public registry; uploader attribution detached on erasure. |
| Security measures | GPS timestamps and device extensions (heart rate, cadence) stripped at ingest; exports regenerated from stored geometry rather than the original upload; optional trimming of route start and end. |
| Impact assessment | Not required for this activity. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
PA-04. Project updates and digests
| Purpose | Send followers an opt-in digest when a project they follow posts an update or schedules an event. |
|---|---|
| Lawful basis | Consent (Art. 6(1)(a)) |
| Controller | Commons |
| Categories of personal data | email, follow relationships, digest preferences. |
| Categories of data subject | followers. |
| Recipients | Cloudflare (email delivery). |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | Until the follow is withdrawn or consent revoked. |
| Security measures | Separate consent purpose from platform email; one-click unsubscribe; suppression list consulted before every send. |
| Impact assessment | Not required for this activity. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
PA-05. Award voting
Impact assessment required| Purpose | Run time-boxed public voting rounds with one verified vote per person. |
|---|---|
| Lawful basis | Consent (Art. 6(1)(a)) |
| Controller | Commons |
| Categories of personal data | verified identity hash, ballot choice, IP hash, user agent hash. |
| Categories of data subject | voters. |
| Recipients | Cloudflare (hosting, bot protection). |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | Ballots retained for the round plus one year to allow challenge; identifiers hashed throughout. |
| Security measures | Uniqueness enforced by a database constraint rather than application logic; ballots append-only; Turnstile on the ballot form. |
| Impact assessment | Public voting is a high-abuse surface; assess before first round. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
PA-06. Moderation and audit
| Purpose | Review projects and trails before publication, and keep a tamper-evident record of platform decisions. |
|---|---|
| Lawful basis | Legitimate interests (Art. 6(1)(f)) |
| Controller | Commons |
| Categories of personal data | actor identity, action metadata, IP hash. |
| Categories of data subject | organizers, administrators. |
| Recipients | Cloudflare (hosting). |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | Routine entries two years; security-severity entries seven years. |
| Security measures | Append-only; actor pseudonymized rather than deleted on erasure so the record of the erasure itself survives. |
| Impact assessment | Not required for this activity. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
PA-07. Data subject requests
| Purpose | Handle access, portability, rectification and erasure requests within the statutory period. |
|---|---|
| Lawful basis | Legal obligation (Art. 6(1)(c)) |
| Controller | Commons |
| Categories of personal data | email, request correspondence, export bundle. |
| Categories of data subject | any data subject. |
| Recipients | Cloudflare (hosting, object storage). |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | No export bundle is stored: it is built on request and streamed. The download token expires after 15 minutes; the request record is retained as proof of compliance. |
| Security measures | Identity verified by session before fulfilment; download links are a single 256-bit token, stored only as a hash, scoped to the requesting account, time-limited and capped at three redemptions. |
| Impact assessment | Not required for this activity. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
PA-08. Aggregate analytics
| Purpose | Understand which pages are used, without identifying anyone. |
|---|---|
| Lawful basis | Legitimate interests (Art. 6(1)(f)) |
| Controller | Commons |
| Categories of personal data | path, day, country, device class, referrer host. |
| Categories of data subject | visitors. |
| Recipients | Cloudflare (Analytics Engine). |
| Transfers outside the EU | None beyond the processor described above. |
| Retention | Aggregated daily; rows deleted after ~2 years. |
| Security measures | Written server-side only — no client beacon, no cookie, no IP or user id retained. Not personal data by construction, so no consent is required. |
| Impact assessment | Not required for this activity. |
| Last reviewed | 28 October 2026. Next review due 28 October 2027. |
If something here is wrong
Tell us and we will correct the register, not the page. Contact details are on the imprint.
To see what we hold about you specifically, or to have it deleted, use your data page. You do not have to write to anyone.
The privacy page says the same things in plain language, including how long each kind of record is kept.