Rechtliche Dokumente der Plattform

What we collect and why

For citizens: When you register via your country's eID system, the Platform receives identity attributes from your eID provider. These are immediately processed through a one-way cryptographic hash (SHA-256 with a seasonal salt). The Platform stores only the resulting fingerprint. Your name, ID number, date of birth, and other personal identifiers are never stored.

Your civic judgments (trust or distrust toward specific officials) are stored in anonymized form, linked only to your cryptographic fingerprint. We store your current judgment per official — not the history of changes.

Your email address (if provided for waitlist or notifications) is stored separately from your judgment data and can be deleted independently.

For officials (monitored subjects): We collect and publish publicly available information about officials exercising governmental authority: name, position, institution, jurisdiction, and authority level. This information is sourced from official government records and public databases.

For subscribers: We collect billing information (processed by Paddle) and account credentials. Billing data is not linked to judgment data.

Legal basis for processing

• Citizen judgment data: Legitimate interest (Article 6(1)(f) GDPR) — providing continuous accountability infrastructure in the public interest.
• Official profile data: Legitimate interest and public interest — officials exercising governmental authority are subjects of legitimate public scrutiny.
• Subscriber billing data: Contract performance (Article 6(1)(b) GDPR).
• Waitlist email addresses: Consent (Article 6(1)(a) GDPR), withdrawable at any time.

Data storage and residency

Citizen data for each country is stored on servers within that country's territory wherever possible. In no case does citizen data leave the EU. National deployments are fully isolated.

Data retention

• Citizen fingerprints: Retained while the account is active. Deleted permanently upon account deletion.
• Cryptographic salt: Rotated annually. Old salts permanently deleted after two years.
• Aggregated indices: Retained indefinitely as public statistical data. Cannot be traced to individuals.
• Subscriber billing data: Retained as required by UK tax and accounting law (typically 6 years).

Deine Rechte nach der DSGVO

• Auskunft (Art. 15) — Recht auf eine Kopie der mit deinem Konto verknüpften Daten.
• Berichtigung (Art. 16) — Korrektur unrichtiger Daten.
• Löschung (Art. 17) — dauerhafte Löschung des Kontos und aller verknüpften Daten.
• Einschränkung (Art. 18) — Antrag auf Einschränkung der Verarbeitung.
• Datenübertragbarkeit (Art. 20) — Erhalt der Daten in einem strukturierten Format.
• Widerspruch (Art. 21) — Widerspruch gegen die auf berechtigtem Interesse beruhende Verarbeitung.
• Beschwerde beim Bundesbeauftragten für den Datenschutz und die Informationsfreiheit (BfDI).

Da die Plattform unumkehrbares Hashing verwendet, werden personenbezogene Daten nicht in identifizierbarer Form gespeichert. Die Kontolöschung löscht alle verknüpften Daten dauerhaft.

So kannst du deine Rechte ausüben: Wende dich an privacy@teisond.com. Wir antworten innerhalb von 30 Tagen gemäß DSGVO-Anforderungen.