Controller and purpose
The responsible organisation must be identified and must approve the purposes and lawful bases before launch.
Prototype privacy position
Privacy must be built into the portal from the start.
This prototype does not collect or submit personal or KYC data. It stores only the selected language and demonstration progress in this browser on this device.
Storage and access
The production system must use controlled server-side storage, role-based access and purpose-linked audit logs.
Rights and retention
The final notice must explain retention, data-subject rights, processors, transfers, complaints and contact routes.