This Data Protection Impact Assessment is conducted in accordance with Article 35 of the General Data Protection Regulation (EU) 2016/679. It evaluates the risks of data processing activities within the Citadel TCG platform operated by Castellum - Forge s.r.o.
1. Assessment Overview
| Assessor | Juraj Urban (DPO / Owner) |
| Date | April 5, 2026 |
| Scope | All personal data processing on Citadel TCG (web, mobile, API) |
| Review cycle | Annual or upon significant changes |
2. Processing Requiring Assessment
2.1 Children's Data (Age 13-17)
Why assessed: Processing data of minors triggers DPIA requirement under Art. 35(3).
| Data processed | Email, username, DOB, parent email (13-15), card collections, social posts |
| Safeguards |
|
| Risk level | Medium — mitigated by age enforcement and parental consent flow |
| Residual risk | Low — users could provide false DOB (standard industry limitation) |
2.2 AI Card Recognition (Scanner)
Why assessed: Automated processing of user-submitted images.
| Data processed | Photographs of trading cards (may incidentally capture surroundings) |
| Safeguards |
|
| Risk level | Low — images are of cards, not persons; retention limited and documented |
| Residual risk | Low — photos may incidentally capture surroundings; training uses card-cropped images where possible and users can object to training use (Privacy Policy §12.1) |
2.3 Marketplace & Financial Data
Why assessed: Processing of financial transactions and shipping addresses.
| Data processed | Billing/shipping addresses, order amounts, VAT IDs (professional sellers) |
| Safeguards |
|
| Risk level | Medium — mitigated by Stripe PCI compliance and no raw card storage |
| Residual risk | Low — standard e-commerce risk profile |
2.4 Social Features & Content Moderation
Why assessed: User-generated content with public visibility and reporting system.
| Data processed | Posts, comments, chat messages, reports, page memberships |
| Safeguards |
|
| Risk level | Medium — UGC platforms inherently carry content risks |
| Residual risk | Low-Medium — mitigated by moderation tools and reporting |
2.5 Advertising & Click Tracking
Why assessed: CPC advertising with click tracking.
| Data processed | User ID, click timestamps, IP addresses (fraud prevention) |
| Safeguards |
|
| Risk level | Low — no profiling, no external trackers, internal ads only |
| Residual risk | Minimal |
3. Overall Risk Assessment
| Category | Inherent Risk | After Mitigations |
|---|---|---|
| Children's data | High | Low |
| AI/Image processing | Medium | Minimal |
| Financial data | High | Low |
| Social/UGC | Medium | Low-Medium |
| Advertising | Low | Minimal |
4. Conclusion
The processing activities of Citadel TCG present manageable risks that are adequately mitigated through the technical and organizational measures described above. Key risk-reduction factors include:
- No third-party analytics or tracking services
- All servers in EU (Hetzner, Germany)
- Strong age enforcement with parental consent flow
- Financial data delegated to PCI-compliant processor (Stripe)
- Automated data lifecycle management (purge cron, consent versioning)
- Full GDPR rights implementation (export, delete, consent management)
No processing activity requires consultation with the supervisory authority under Art. 36, as residual risks are within acceptable thresholds after applying the documented safeguards.
5. Contact
For questions about this assessment or our data protection practices, contact the DPO at info@castellum-forge.net.