This document outlines the processing activities carried out by Castellum - Forge s.r.o. in accordance with Article 30 of the General Data Protection Regulation (EU) 2016/679.
1. Controller Details
| Controller | Castellum - Forge s.r.o. |
| Address | Pri kaštieli 4855/12, 949 01 Nitra, Slovakia |
| IČO | 57340315 |
| DPO | Juraj Urban — info@castellum-forge.net |
| Registration | Obchodný register Okresného súdu Nitra, oddiel: Sro, vložka č. 67992/N |
2. Processing Activities
2.1 User Account Registration
| Purpose | Create and manage user accounts |
| Legal basis | Contract performance (Art. 6(1)(b)) and consent for minors (Art. 8) |
| Data categories | Email, username, display name, date of birth, password (hashed), avatar |
| Data subjects | Registered users (13+, parental consent for 13-15) |
| Retention | Duration of account + 30 days post-deletion |
| Recipients | None (processed internally) |
2.2 Card Collection Management
| Purpose | Track and manage users' trading card collections |
| Legal basis | Contract performance (Art. 6(1)(b)) |
| Data categories | Card inventory data, collection names, scan images (retention per Privacy Policy §12.1) |
| Retention | Duration of account + 30 days |
| Recipients | GPU processing server (owned, Hetzner DE) for card scanning |
2.3 Marketplace Transactions
| Purpose | Facilitate buying and selling of trading cards between users |
| Legal basis | Contract performance (Art. 6(1)(b)), legal obligation for invoicing (Art. 6(1)(c)) |
| Data categories | Order details, shipping address, billing address, transaction amounts |
| Retention | 10 years (tax/accounting obligations) |
| Recipients | Stripe (payment processor), sellers/buyers (for order fulfillment) |
2.4 Social Features
| Purpose | Enable posts, comments, chat, follows, and pages |
| Legal basis | Contract performance (Art. 6(1)(b)) |
| Data categories | Post content, comments, chat messages, follower lists |
| Retention | Posts: 10 years; Chat: indefinite; Reports: 20 years |
| Recipients | Other users (public posts), moderation team |
2.5 Subscription & Payments
| Purpose | Process subscription payments and generate invoices |
| Legal basis | Contract performance (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) |
| Data categories | Billing info, payment method (tokenized via Stripe), invoice data |
| Retention | 10 years (tax law) |
| Recipients | Stripe Inc. (payment processor, US — EU SCCs) |
2.6 Advertising
| Purpose | Display CPC-based ads from marketplace sellers |
| Legal basis | Legitimate interest (Art. 6(1)(f)) |
| Data categories | Ad impressions, click data, user_id (for fraud prevention) |
| Retention | 10 years from campaign end |
| Recipients | Advertisers (aggregated stats only, no personal data) |
2.7 Email Communications
| Purpose | Send verification codes, password resets, invoices, and parental consent requests |
| Legal basis | Contract performance (Art. 6(1)(b)) |
| Data categories | Email address, username, email type |
| Retention | Email logs: 90 days |
| Recipients | SMTP relay (self-hosted) |
3. Technical & Organizational Measures
- All data encrypted in transit (TLS 1.3)
- Passwords hashed with bcrypt (12 rounds)
- Database access restricted to application server only
- Regular automated backups
- Card scan images stored on EU servers with defined retention; confirmed scans retained as pseudonymized training data for our own recognition models (Privacy Policy §12.1)
- Consent versioning via consent_log table
- Automated data purge cron (30 days after account deletion)
- GDPR data export endpoint for users (Article 20)
4. Data Transfers
| Stripe Inc. | USA — EU Standard Contractual Clauses (SCCs) |
| Hetzner Online GmbH | Germany — EU (no transfer) |
| Apple/Google | USA — SCCs (for social authentication) |
5. Data Subject Rights
Users can exercise their rights (access, rectification, erasure, portability, restriction, objection) by contacting info@castellum-forge.net or using in-app tools:
- Data Export: Account > Settings > Data Export
- Account Deletion: Account > Settings > Delete Account (30-day recovery window)
- Consent Withdrawal: Contact DPO or unsubscribe from communications
