Compliance

Summary for the town clerk, comptroller and DPO. It describes what the app does today (September 2026); what it does not do yet is at the end, under “Coming soon”.

Minors’ data

• Minimisation: name, birth date, support needs and image-rights consent.
• Health data (medical information and allergies): stored only if the guardian ticks a separate explicit consent checkbox (GDPR art. 9.2.a), and the form asks only for what monitors need to know.
• Access: the legal guardian (their own children only) and authenticated municipal staff. Monitors get the printed session list, not system access.
• Families’ rights in the app: edit and delete each child, cancel an unpaid enrollment and delete the account. When an account is deleted, paid enrollments are kept anonymised for municipal accounting.
• Legal bases: exercise of public powers in providing the municipal service (GDPR art. 6.1.e) and performance of the enrollment relationship (art. 6.1.b); explicit consent for health data (art. 9.2.a); consent for image rights (art. 6.1.a).

Discount documents

They are the most sensitive data in the system (they can reveal family composition):

• Stored on the app server’s persistent volume in Germany (OVH, Frankfurt).
• Only authenticated staff of the same town can download them, served as an attachment.
• Today they are not encrypted at application level, not deleted automatically at season end, and the volume has no off-site backup yet.

GDPR roles and data processing agreement

• The town is the data controller; En Antena Produccions SL, the company behind EnaJoin, is the processor (GDPR art. 28) and signs a data processing agreement with the town.
• Sub-processors: OVH (hosting of the app, database and documents, Frankfurt, Germany); Resend (transactional email, a US company certified under the EU-US Data Privacy Framework); Backblaze B2 (daily database backups, US region); Cloudflare, Inc. (Turnstile bot check on the signup, login and password reset forms: processes the IP address and technical browser data; acts as a processor and, when it uses these signals to improve its bot detection, as an independent controller; may process the data outside the EU under its data processing terms, Turnstile privacy addendum).
• International transfer: database backups are stored in the United States (Backblaze B2). We are reviewing it, together with the mechanism covering it (standard contractual clauses or the EU-US Data Privacy Framework), and the aim is to move them to the EU.
• Information for families: app privacy.

Payments

• Payment at the town bank’s Redsys TPV, by redirect to the Redsys page. Confirmation arrives through the bank’s signed server notification, and the amount, order, currency and terminal are checked.
• We store no card data: only order references, amounts and statuses.
• The TPV secret key is stored encrypted (AES-256-GCM) and never shown again.
• Refunds are made by the town from its own TPV; EnaJoin flags them in the “payments to refund” list.
• The integration is built and being validated with the first pilot town’s real TPV.

Security and traceability

• Passwords hashed with bcrypt, CSRF protection on every form, login rate limiting.
• Signup, login (families and staff) and password reset protected with Cloudflare Turnstile (managed mode, no pre-clearance: it sets no cookies on our domains); signup also with Tor exit blocking and a honeypot field; email confirmation happens on a page with a button, never on opening the link.
• Daily off-site database backups (14 kept).
• Functional audit: every enrollment request is recorded with a millisecond timestamp; every discount review with author, date and reason. The allocation order can be exported.
• No cookies on public pages; one strictly necessary session cookie after login. Cloudflare Turnstile sets none either.

Accessibility

• Target: UNE-EN 301 549 / WCAG 2.1 AA on citizen pages (semantic HTML, labels on every field, accessible language selector).
• The accessibility statement is “partially conformant” until verification is complete, and can be linked from the town website.

Coming soon

Not done yet:

• Automatic deletion of discount documents at season end.
• Application-level encryption of documents and an off-site backup of the documents volume.
• Database backups inside the EU.
• Two-factor authentication (2FA) and separate roles and permissions for staff.
• Self-declaration of conformity with the ENS, basic category.
• Automatic translation of activity descriptions, with a visible indicator until staff review it.