Data Protection Impact Assessment

Despite our institutional presentation, this website is operated by a private individual, not a supranational governing body. The Commission regrets any confusion this may cause.

For all data protection inquiries, contact: dpo@concernedeu.com

The Commission collects a remarkably restrained quantity of personal data, a fact we find both admirable and slightly suspicious:

• Concern text — voluntarily submitted, maximum 1,000 characters
• IP addresses — processed temporarily for rate limiting only
• Archived press releases — stored only when you explicitly choose to archive

We deploy no cookies, no analytics trackers, and no advertising technology. The Directorate-General for Surveillance is, for once, not involved.

Processing is carried out under the following legal bases pursuant to Article 6(1) of the GDPR:

• Concern text — transmitted to an AI service to generate a response (legal basis: Art. 6(1)(a) consent, by voluntary submission)
• IP addresses — used solely to enforce rate limits and prevent abuse (legal basis: Art. 6(1)(f) legitimate interest)
• Archived releases — displayed publicly on the Public Record Archives (legal basis: Art. 6(1)(a) consent, by explicit opt-in)

Your concern traverses the Atlantic before receiving its official European response — a geographic irony the Commission acknowledges with appropriate solemnity.

• Google Gemini API (Google LLC, USA) — processes your concern text to generate responses
• Upstash Redis (Upstash Inc., USA) — temporary IP storage for rate limiting
• Neon (Neon Inc., USA) — database hosting for archived press releases
• Vercel (Vercel Inc., USA) — website hosting and delivery

All services are US-based. International data transfers are acknowledged pursuant to Chapter V of the GDPR.

Retention periods range from 60 seconds to the heat death of the universe, depending on your choices. The Commission considers this range entirely proportionate:

• IP addresses — automatically expire after 60 seconds (the shortest retention period the Directorate-General for Temporal Affairs would approve)
• Unarchived text — exists in your browser session only, not stored on our servers
• Archived press releases — retained indefinitely until deletion is requested via the contact address in Article 9

Under the GDPR (Articles 15–22), you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with your national supervisory authority.

These rights are granted under the benevolent framework of European data protection and may be exercised without filing Form EU-GDPR/REQUEST/2026-A (this time).

To exercise any right, contact dpo@concernedeu.com.

Despite the elaborate Cookie Consent Management System you may have encountered, this website deploys precisely zero (0) cookies. The banner exists as a meditation on European regulatory culture.

No tracking cookies, no analytics cookies, no advertising cookies, and no ambient biscuit-related data collection of any kind.

This policy may be updated from time to time. The date at the top of this page reflects the most recent revision. The Commission assures you that any amendments will undergo no fewer than three rounds of inter-institutional consultation before publication, in full compliance with the principle of sincere cooperation.

For all privacy-related inquiries, contact dpo@concernedeu.com.

All inquiries will be processed within the 30-day period mandated by GDPR, assuming the Directorate-General for Correspondence is not on summer recess.