GDPR & Data Protection
This is the authoritative statement of the Open Radio Linking Project’s data-protection obligations under the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR. It complements our Privacy Policy.
Data controller
The OpenRLP Project is the data controller for personal data processed through orlp.io. Contact: privacy@orlp.io. A formal Data Protection Officer is not required at our current scale (the Article 37 thresholds are not met), but a designated privacy contact answers all data-subject requests within 30 days (Article 12).
Lawful basis for processing (Article 6)
We process the minimum data necessary under the following lawful bases:
- Art. 6(1)(b) — Contract: node registration data (callsign, contact email) is processed to provide the linking service you request.
- Art. 6(1)(f) — Legitimate interests: error logging and security monitoring to keep the service reliable and secure.
- Art. 6(1)(a) — Consent: non-essential analytics and performance measurement (Vercel Analytics & Speed Insights) are loaded only after you opt in via our cookie banner, and you can withdraw consent at any time from the footer.
- No special-category data (Article 9) is processed.
Your rights (Articles 15–22)
EU/UK data subjects may exercise the following rights by emailing privacy@orlp.io:
- Art. 15 — Access: obtain a copy of the personal data we hold about you.
- Art. 16 — Rectification: correct inaccurate data.
- Art. 17 — Erasure (“right to be forgotten”).
- Art. 18 — Restriction of processing while a dispute is resolved.
- Art. 20 — Portability: receive your data in a machine-readable format (JSON).
- Art. 21 — Object to processing based on legitimate interests.
- Art. 22 — No automated decision-making or profiling is performed.
Requests are answered within 30 days and free of charge (Article 12).
Data minimisation (Article 5(1)(c))
Only data strictly necessary for the stated purpose is collected; nothing is collected speculatively.
- Node operators: callsign (required), contact email (required for admin contact), frequency/CTCSS (required for the directory).
- Website visitors: no personal data — privacy-friendly aggregate analytics only.
- Admins: email and a bcrypt-hashed password only.
- No names, postal addresses, phone numbers, or payment data are ever collected.
Storage limitation (Article 5(1)(e))
- Active node records: retained while the node is registered.
- Inactive node records: deleted after 24 months of no activity.
- Admin session tokens: deleted after 8 hours or on logout.
- Error logs: 90-day retention, then auto-deleted.
Security & privacy by design (Article 25)
Data protection is built into the architecture, not bolted on afterwards:
- All PII is encrypted at the application layer with AES-256-GCM before it reaches the database.
- Passwords are bcrypt-hashed (cost 12); plaintext never exists in the system.
- All database queries are parameterised — SQL injection is structurally prevented.
- Content renders as escaped text and inputs are sanitised — XSS is structurally prevented.
- HTTPS is enforced via HSTS; rate limiting deters brute-force and data harvesting.
International transfers (Chapter V)
- Vercel (hosting/analytics) — USA — EU-US Data Privacy Framework adequacy decision.
- Neon (database) — Standard Contractual Clauses via the Neon DPA.
Breach notification (Articles 33–34)
- The supervisory authority is notified within 72 hours where a breach poses a risk to individuals.
- Affected data subjects are notified without undue delay where the risk is high.
- Report a suspected breach: security@orlp.io.
Right to complain (Article 77)
You may lodge a complaint with your national supervisory authority — for example, the UK Information Commissioner’s Office (ICO), Ireland’s Data Protection Commission, Germany’s BfDI, or France’s CNIL.