Improve GDPR compliance of my-data json download

Author: webstackdev

_TODO.md

@@ -23,24 +23,6 @@ https://aws.plainenglish.io/how-to-build-a-chatbot-using-aws-lex-and-lambda-in-2
 - Moving the scroll bar up quickly with the mouse seems to make the header logic break - the Switcher component and Breadcrumbs are hidden under the header
 - Themepicker and search icon are too big in non-squished header. Logo too - the initial presentation should be smaller.
 
-## GDPR Compliance for "My Data"
-
-**Weaknesses: Missing Information for Right of Access (Article 15)**
-
-The Right of Access is broader than just a data dump. A complete response must include specific supplementary information that your JSON currently lacks:
-
-- Retention Periods: You must state how long you intend to keep each category of data.
-- Third-Party Recipients: You must list any recipients or categories of recipients (like email service providers or analytics tools) with whom this data has been shared.
-- Data Subject Rights: The response should remind the user of their other rights, such as the right to request erasure, rectification, or to lodge a complaint with a supervisory authority.
-- Source of Data: While your JSON shows "source," it should explicitly confirm if any data was collected from third parties rather than the subject themselves.
-
-**Technical Observations**
-
-- Privacy Policy Version: Your output shows "privacyPolicyVersion": "1970-01-01". This looks like a placeholder or a Unix epoch default; ensure this reflects the actual policy version the user agreed to for each record to maintain a valid audit trail.
-- Consent Text: Most records show "consentText": null. GDPR requires you to be able to demonstrate what the subject consented to; providing the actual text shown to the user at the time is a best practice for documenting valid consent.
-
-Next Step: To be fully compliant, you should pair this JSON file with a summary document (often a PDF or HTML page) that includes the missing legal disclosures (retention, recipients, and rights) or include those fields directly in your JSON schema.
-
 ## Resume
 
 - Finish styling

src/actions/contact/action.ts

@@ -125,7 +125,8 @@ export const contact = {
             userAgent,
             ipAddress: ip !== 'unknown' ? ip : null,
             privacyPolicyVersion: getPrivacyPolicyVersion(),
-            consentText: null,
+            consentText:
+              'I consent to Webstack Builders processing my personal data for responding to your inquiry. See our Privacy Policy and Cookie Policy.',
             verified: true,
           })
         }

src/actions/downloads/action.ts

@@ -60,7 +60,8 @@ export const downloads = {
           userAgent,
           ipAddress: ip !== 'unknown' ? ip : null,
           privacyPolicyVersion: getPrivacyPolicyVersion(),
-          consentText: null,
+          consentText:
+            'I consent to Webstack Builders processing my personal data for providing your requested download. See our Privacy Policy and Cookie Policy.',
           verified: true,
         })
       }

src/actions/gdpr/entities/dsar.ts

@@ -113,6 +113,103 @@ export async function verifyDsarToken(token: string): Promise<DsarVerifyResult>
         createdAt:
           record.createdAt instanceof Date ? record.createdAt.toISOString() : record.createdAt,
       })),
+      legalDisclosures: {
+        retentionPeriods: {
+          consentRecords:
+            'Retained for 7 years from the date of consent to meet legal compliance and audit requirements.',
+          contactFormSubmissions:
+            'Retained for 3 years from the date of submission for legitimate business correspondence purposes.',
+          newsletterSubscriptions:
+            'Retained until you unsubscribe, plus 12 months thereafter for audit purposes.',
+          downloadRecords:
+            'Retained for 2 years from the date of download for business records purposes.',
+        },
+        thirdPartyRecipients: [
+          {
+            name: 'Resend',
+            category: 'Email delivery service',
+            purpose:
+              'Delivers transactional and marketing emails on our behalf. Receives your email address and name.',
+            privacyPolicy: 'https://resend.com/privacy',
+          },
+          {
+            name: 'HubSpot',
+            category: 'Customer relationship management (CRM) and marketing platform',
+            purpose:
+              'Stores contact details and newsletter subscription status for marketing communications. Receives your email address and name when you subscribe to the newsletter or submit the contact form with marketing consent.',
+            privacyPolicy: 'https://legal.hubspot.com/privacy-policy',
+          },
+          {
+            name: 'Upstash',
+            category: 'Rate-limiting and caching service',
+            purpose:
+              'Stores anonymised request fingerprints to enforce rate limits. Does not receive personally identifiable information.',
+            privacyPolicy: 'https://upstash.com/privacy',
+          },
+          {
+            name: 'Sentry',
+            category: 'Error monitoring service',
+            purpose:
+              'Captures application error reports which may include request metadata. Configured to scrub personally identifiable information from error payloads.',
+            privacyPolicy: 'https://sentry.io/privacy/',
+          },
+          {
+            name: 'Vercel',
+            category: 'Hosting and infrastructure provider',
+            purpose:
+              'Hosts and serves this website. All web requests are processed through Vercel infrastructure.',
+            privacyPolicy: 'https://vercel.com/legal/privacy-policy',
+          },
+        ],
+        yourRights: {
+          summary:
+            'Under the UK GDPR and EU GDPR you have the following rights regarding your personal data.',
+          rights: [
+            {
+              article: 'Article 15',
+              right: 'Right of access',
+              description:
+                'You have the right to obtain a copy of the personal data we hold about you and supplementary information about how it is processed.',
+            },
+            {
+              article: 'Article 16',
+              right: 'Right to rectification',
+              description:
+                'You have the right to request correction of inaccurate personal data we hold about you.',
+            },
+            {
+              article: 'Article 17',
+              right: 'Right to erasure',
+              description:
+                "You have the right to request deletion of your personal data ('right to be forgotten'). Use the Delete My Data form at https://www.webstackbuilders.com/privacy/my-data to submit a deletion request.",
+            },
+            {
+              article: 'Article 18',
+              right: 'Right to restriction of processing',
+              description:
+                'You have the right to request that we restrict the processing of your personal data in certain circumstances.',
+            },
+            {
+              article: 'Article 20',
+              right: 'Right to data portability',
+              description:
+                'You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as this JSON file) and to transmit it to another controller.',
+            },
+            {
+              article: 'Article 21',
+              right: 'Right to object',
+              description:
+                'You have the right to object to the processing of your personal data for direct marketing purposes at any time.',
+            },
+          ],
+          howToExercise:
+            'To exercise any of these rights, contact us at privacy@webstackbuilders.com. We will respond within 30 days.',
+          supervisoryAuthority:
+            'You have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner\'s Office (ICO): https://ico.org.uk. In the EU, contact the supervisory authority in your country of residence.',
+        },
+        dataSource:
+          'All personal data in this export was collected directly from you through first-party form submissions on webstackbuilders.com. No data has been obtained from third-party sources.',
+      },
     }
 
     return {

src/actions/newsletter/action.ts

@@ -156,7 +156,8 @@ export const newsletter = {
               ? context.clientAddress
               : null,
           privacyPolicyVersion: getPrivacyPolicyVersion(),
-          consentText: null,
+          consentText:
+            'I consent to Webstack Builders processing my personal data for marketing communications (unsubscribe anytime). See our Privacy Policy and Cookie Policy.',
           verified: false,
         })
 

src/content/Platform Engineering Fundamental Curriculum.pdf

@@ -41,12 +41,13 @@ export const environmentalVariablesConfig: AstroUserConfig['env'] = {
       optional: true,
     }),
     /**
-     * Gets the privacy policy version injected at build time via the PrivacyPolicy integration.
+     * Gets the privacy policy version injected at build time via the PrivacyPolicyVersion integration.
+     * No default is set intentionally — if the integration fails to inject this, getPrivacyPolicyVersion()
+     * will throw, surfacing the configuration error rather than silently storing an invalid epoch date.
      */
     PRIVACY_POLICY_VERSION: envField.string({
       access: 'public',
       context: 'client',
-      default: '1970-01-01',
       optional: true,
     }),
     /**