Compliance

Last updated: 29 September 2026

Who is who (GDPR)

• Controller: the town hall. It decides what the channel is for and what is done with it, and citizens exercise their rights with it.
• Processor: En Antena Produccions SL (EnaInbox). We process the data only on the town hall’s behalf and instructions, under a data processing agreement (DPA, GDPR art. 28) signed with each town.
• Sub-processors, listed in the DPA with the transfer safeguards for each: OVH (hosting of the application and database in Frankfurt, EU), Resend (delivery of the emails to citizens, US), Backblaze (daily database backups, US) and Cloudflare, Inc. (Cloudflare Turnstile, anti-robot check on the public form and on staff access; may process data outside the EU under its data processing terms).
• Legal basis: a task carried out in the public interest (GDPR art. 6.1.e): the complaints and suggestions channel of the service charter.
• Supervisory authority: for Catalan town halls, the Catalan Data Protection Authority (APDCAT); elsewhere in Spain, the AEPD.

The article 13 notice on the form

Before a request is sent, the form shows the basic information GDPR article 13 requires: who the controller is (the town hall), what the data is used for, the legal basis, how long it is kept and how to exercise rights. It links to the town’s privacy page, which we prepare with the town clerk during onboarding.

Minimisation

• Email is the only required personal data; the name is optional. No phone number or address is asked for.
• Anonymous submission collects no personal data.
• Photos lose their metadata (see below).

Retention and automatic anonymisation

• Closed requests: after a period from closing (24 months by default; each town can adjust it), the contact data (email and name), the photos and the stored copies of the emails sent to the citizen are anonymised automatically. The statistics are kept (category, department, response times).
• Unconfirmed requests: if the citizen never confirms their email, the request never enters the queue and is deleted after 30 days.

Cookies and bot protection

• Zero cookies on citizen pages (form and status). The language goes in the address or is kept in the browser (localStorage), strictly necessary data the citizen chooses. That is why there is no cookie banner.
• The public form is protected against automated submissions with a honeypot field (invisible to people), a block on Tor exit nodes and Cloudflare Turnstile, verified on the server. Turnstile also protects staff login, password reset and signup.
• What Turnstile processes: when a protected form is opened, Cloudflare processes the IP address and technical data about the browser and device (such as the user agent and TLS fingerprint) to tell people from bots. It is a security measure necessary to provide the service (Art. 32 GDPR). It runs without pre-clearance, so it sets no cookies on our domains. Cloudflare acts as a sub-processor and, when it uses these signals to improve its bot detection, as an independent controller (Turnstile privacy addendum).
• The staff back office uses only the strictly necessary session cookies for logging in.

Photos without metadata

Every uploaded image is re-processed on arrival and its EXIF metadata is stripped, GPS coordinates included.

What “traceability” means, legally

1. The transition log: every status change with who, when and which note. The application offers no way to delete or edit it.
2. The notification log: every email sent to the citizen (recipient, subject, date): documentary proof that they were informed at every step. When a request is anonymised, the log stays without the contact data.

Automatic suggestions, not artificial intelligence

• The back office proposes a category, department and priority from keywords in the text. It is always labelled as an automatic suggestion and a person decides. It is not an AI model.
• No decision with effects on the citizen is automated (GDPR art. 22 does not apply).
• EnaInbox does not translate messages automatically. (Coming soon: automatic translation, always labelled as such.)

Accessibility

• Citizen pages target UNE-EN 301 549 / WCAG 2.1 AA: semantic HTML, labelled fields, visible focus, sufficient contrast.
• The town hall publishes the accessibility statement (RD 1112/2018), because the form is part of its web services. We provide the information: the conformance status (until there is an external audit, the honest wording is “partially conformant, based on a self-assessment”), any content that is not yet accessible, and the channel to report problems. If your general statement already covers third-party services, it is enough to mention the complaints and suggestions channel in it.
• If a citizen reports an accessibility barrier on the form, pass it on to us and we fix it.

Relation to the official registry

EnaInbox is not the official entry registry and does not replace it. The form says so and links to the electronic office for formal filings.