Compliance Registers

This is the auditor-facing reference binder. Each section below answers a specific Article 30 / 35 / 28 / 13 evidence request. Bookmark this URL — the operator console mirrors the same content at Aforo Product UI → Governance → Compliance Library for tenant-private editing.

How to use this page#

Records of Processing Activities (Article 30)#

Article 30 requires every controller and processor (with ≥ 250 employees, or processing of special categories, or processing that is not occasional) to maintain a written record of processing activities. Aforo maintains 7 documented activities on behalf of itself as Controller and 7 on behalf of customers as Processor.

The 9 mandatory fields per activity (Art. 30(1))

• Name + contact details of the controller (and DPO, where applicable)
• Purposes of the processing
• Categories of data subjects + personal data
• Categories of recipients
• Cross-border transfers + the transfer mechanism
• Envisaged time limits for erasure (retention)
• General description of the technical + organisational security measures

Aforo\'s documented processing activities

Data Protection Impact Assessments (Article 35)#

Article 35 requires a DPIA when processing is "likely to result in a high risk to the rights and freedoms of natural persons" — particularly for systematic monitoring, large-scale special-category data, or automated decision-making. Aforo has filed 3 DPIAs to date covering the platform\'s highest-risk processing patterns.

The 7 Article 35(7) elements captured per DPIA

• Systematic description of envisaged processing + purposes
• Assessment of necessity + proportionality vs purposes
• Assessment of risks to data subjects (likelihood × impact matrix)
• Measures envisaged to address risks (mitigations)
• DPO consultation outcome
• Residual risk after mitigations
• Decision: PROCEED / PROCEED_WITH_MONITORING / BLOCK + reviewer + sign-off date

Subprocessor inventory (Article 28)#

Article 28(2) requires the processor (Aforo) to obtain prior authorisation from the controller (you) before engaging any subprocessor. Aforo discloses every active subprocessor below with the specific data flows, regions, and DPA references. Aforo notifies customers 30 days before adding a new subprocessor — you have a right to object during that window per the DPA.

30-day change-notification commitment

Article 28(2) gives the Controller a right to object to new or replacement subprocessors. Aforo operationalizes this with:

• 30-day notice before any new subprocessor goes live.
• Email subscription at /trust-center on every tenant\'s storefront portal — DPO can subscribe for automated notification.
• Termination right if the operator objects and Aforo cannot accommodate alternative arrangements.

Data residency (Article 13(1)(f))#

Article 13(1)(f) requires controllers to inform data subjects of any international data transfers. Aforo discloses the following region map and transfer mechanisms.

Cross-border transfer mechanisms#

Article 44-49 governs international transfers. Aforo uses the following mechanisms by transfer corridor:

Supplementary technical measures (Schrems II)

• Encryption at rest — AES-256-GCM (AWS KMS-managed keys) on every PostgreSQL + ClickHouse + S3 bucket.
• Encryption in transit — TLS 1.3 minimum across all inter-service and external traffic.
• Pseudonymisation — customer identifiers are opaque UUIDs; analytics rollups do not re-identify.
• Access logging — every PII read by privileged role is in the pii.* audit trail.
• Transparency reports — Aforo publishes annual transparency reports detailing any government requests received.

Retention policy#

Article 5(1)(e) requires data to be kept "for no longer than necessary." Aforo\'s default retention by data category:

DPA signature audit trail#

Aforo\'s DPA is signed via click-through acceptance during operator onboarding. Every signature event is captured in the operator audit log under the dpa.* action namespace.

Click-through legality

Click-through acceptance is legally binding under the click-through doctrine adopted across major jurisdictions (US ProCD v. Zeidenberg; EU eIDAS Article 25(1); India IT Act 2000 §10A). Aforo captures the four elements regulators check for:

• Notice — full DPA text is rendered above the accept button (no scroll-trap).
• Opportunity to review — DPA is downloadable as PDF before signing.
• Distinct affirmative act — separate "I accept" button with active selection, not bundled with other terms.
• Audit trail — IP, user agent, timestamp captured for evidentiary value.