GDPR Compliance

BlocMarket maintains a full Article 30 Record of Processing Activities (ROPA) in docs/compliance/gdpr_data_mapping.md. The platform operates under UK GDPR; the data controller is BlocMarket Ltd.

Data Inventory and Classification

All personal data is classified into three tiers:

Classification	Examples	Handling
Restricted	Password hashes, MFA secrets, Stripe references, identity documents	Encrypted at rest; never logged; short expiries
Confidential	Email, names, phone, addresses, GPS points, bid amounts, IP addresses	TLS 1.3 in transit; RLS-protected
Internal	UUIDs, roles, statuses, view counts	Standard access controls

Sensitive fields use specialised protections: passwords are Argon2id-hashed; email verification tokens expire in 24 hours; password reset tokens in 30 minutes; identity documents in AWS S3 (eu-west-2) expire after 30 days maximum with AES-256 at rest.

Data Retention Schedule

Data Category	Retention Period	Rationale
Email, first/last name	3 years post-closure	Service records
Password hash	Until deletion	Authentication only
Property addresses, GPS, boundary	Until delisted + 1 year	Dispute window
Bids (amount, status, message)	Account lifetime + 6 years (anonymised)	Limitation Act 1980
Payments	6 years	Financial record-keeping (HMRC)
Notifications	Until read + 30 days	Operational
Identity documents	30 days maximum	Verification only
IP addresses (rate limit cache)	24 hours	Security
IP addresses (logs)	90 days	Security monitoring
Login history	12 months	Security
Audit trail (financial)	7 years	Compliance

Legal Basis for Processing

Activity	Legal Basis
User registration and authentication	Contract — Art. 6(1)(b)
Property listing management	Contract — Art. 6(1)(b); Legitimate interest — Art. 6(1)(f) (verification)
Bloc formation and bidding	Contract — Art. 6(1)(b)
Payment processing	Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c)
Push notifications	Consent — Art. 6(1)(a)
Identity verification documents	Consent — Art. 6(1)(a)
Security monitoring and activity logging	Legitimate interest — Art. 6(1)(f) (fraud prevention)

Data Subject Rights

Right	Article	Implementation	Response Time
Access	Art. 15	GET /api/v1/users/me/export (JSON/CSV)	30 days
Rectification	Art. 16	PATCH /api/v1/users/profile (self-service)	Immediate
Erasure	Art. 17	DELETE /api/v1/users/me (7-day grace period)	30 days
Portability	Art. 20	GET /api/v1/users/me/export (JSON + CSV)	30 days
Object	Art. 21	privacy@blocmarket.wyattau.com	30 days
Restrict processing	Art. 18	privacy@blocmarket.wyattau.com	30 days
Withdraw consent	Art. 7(3)	Account settings → Notification Preferences	Immediate
Notified of breach	Art. 34	Email notification to affected users	72 hours

Right to Access and Portability

Export status can be polled at GET /api/v1/users/me/export/status. The gdpr-worker application processes export and deletion requests asynchronously. IP addresses are redacted from anonymised exports.

Right to Erasure

Two-stage deletion:

1. Soft delete — POST /api/v1/users/account/delete hides the account; POST /api/v1/users/account/restore can reverse it
2. Permanent deletion — DELETE /api/v1/users/me; the worker anonymises transaction records (legal retention requirement), deletes profile and preferences, removes property associations, clears cached data, and logs the deletion for audit

Note

Erasure is subject to legal exceptions: financial records must be retained for 6 years under the Limitation Act 1980, and data required for establishing or defending legal claims may be kept. Where retention is required, anonymisation is applied in lieu of deletion.

Audit Trail

• user_activity_log table records security-relevant events with structured JSON
• Application, access, and audit logs aggregate to Grafana Loki
• Audit logs for financial transactions are retained 7 years
• API access logs retained 90 days; login history 12 months

Consent Management

Consent Type	Legal Basis	Mechanism
Push notifications	Art. 6(1)(a)	Per-device opt-in via POST /api/v1/notifications/devices/register; tokens deleted when consent withdrawn
Marketing communications	Art. 6(1)(a)	Unsubscribe mechanism; per-channel preferences
Transactional notifications	Art. 6(1)(b)	Managed via PATCH /api/v1/notifications/preferences
Identity verification documents	Art. 6(1)(a)	Explicit consent checkbox; 30-day automatic expiry

BlocMarket uses no cross-site tracking and no marketing/advertising cookies.

Cross-Border Transfers

Processor	Data Location	Transfer Mechanism
Supabase	US/EU	Standard Contractual Clauses (pending DPA)
AWS S3	eu-west-2	No transfer
Stripe	UK/US	SCCs; UK Extension to EU Adequacy
GoCardless	UK	No transfer
DocuSign	UK/US	SCCs; UK Extension to EU Adequacy
Google/FCM	US	SCCs (pending DPA)

Breach Notification

A documented procedure requires notification to the ICO within 72 hours where a breach is likely to result in a risk to rights and freedoms, and notification to affected data subjects without undue delay where risk is high.

Security Measures (Article 32)

Measure	Implementation
Encryption in transit	TLS 1.3 on all endpoints
Encryption at rest	AES-256 (S3), Supabase TDE
Password hashing	Argon2id (memory-hard KDF)
Access control	RLS + RBAC
SQL injection prevention	SQLx compile-time validated queries
Multi-factor authentication	TOTP (optional)
Rate limiting	Per-IP, sliding window

Review Schedule

Review	Frequency	Owner
Full ROPA review	Annually	DPO
Retention policy compliance check	Quarterly	DPO
Data subject rights process test	Semi-annually	DPO
Third-party processor audit	Annually	Legal + Security
Post-breach ROPA update	After any breach	DPO