Data Protection Impact Assessment

Despite our institutional presentation, this website is operated by a private individual, not a supranational governing body. The Commission regrets any confusion this may cause.

For all data protection inquiries, contact: strongly@concernedeu.com

The Commission collects a remarkably restrained quantity of personal data, a fact we find both admirable and slightly suspicious:

• Concern text — voluntarily submitted, maximum 1,000 characters
• IP addresses — processed temporarily for rate limiting only
• Archived press releases — stored only when you explicitly choose to archive
• Aggregate visit statistics — page views, referrers, country and device type, counted by Vercel Web Analytics without cookies and without building a profile of you

We deploy no tracking cookies and no advertising technology. The Directorate-General for Surveillance has been restricted to counting, which it finds deeply unsatisfying.

Processing is carried out under the following legal bases pursuant to Article 6(1) of the GDPR:

• Concern text — transmitted to an AI service to generate the press release you asked for (legal basis: Art. 6(1)(b), providing the service you request)
• IP addresses — used solely to enforce rate limits and prevent abuse (legal basis: Art. 6(1)(f) legitimate interest)
• Archived releases — displayed publicly on the Public Record Archives (legal basis: Art. 6(1)(a) consent, by explicit opt-in)
• Visit statistics — to understand which concerns resonate with the citizenry (legal basis: Art. 6(1)(f) legitimate interest; cookieless and aggregate)

Your concern traverses the Atlantic before receiving its official European response — a geographic irony the Commission acknowledges with appropriate solemnity.

• xAI Grok, via the Vercel AI Gateway (SpaceXAI and Vercel Inc., USA) — processes your concern text to generate responses. xAI keeps API requests for up to 30 days to detect abuse and does not use them for training
• Upstash Redis (Upstash Inc., USA) — temporary IP storage for rate limiting, and the one-hour provisional register of unarchived press releases
• Neon (Neon Inc., USA) — database hosting for archived press releases
• Vercel (Vercel Inc., USA) — website hosting, delivery and cookieless visit statistics

All services are US-based. International data transfers are acknowledged pursuant to Chapter V of the GDPR.

Retention periods range from 60 seconds to the heat death of the universe, depending on your choices. The Commission considers this range entirely proportionate:

• IP addresses — rate-limit counters expire within about two minutes (the shortest retention period the Directorate-General for Temporal Affairs would approve)
• Unarchived press releases — held in a provisional register for one hour so that you may archive them, then destroyed automatically, unread by any official
• Archived press releases — retained indefinitely until deletion is requested via the contact address in Article 9

Under the GDPR (Articles 15–22), you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with your national supervisory authority.

These rights are granted under the benevolent framework of European data protection and may be exercised without filing Form EU-GDPR/REQUEST/2026-A (this time).

To exercise any right, contact strongly@concernedeu.com.

Despite the elaborate Cookie Consent Management System you may have encountered, this website sets precisely zero (0) cookies for citizens. The banner exists as a meditation on European regulatory culture.

The sole exception is a strictly necessary session cookie for Commission personnel who sign in to the administrative archive. Citizens will never receive it. No tracking cookies, no analytics cookies, no advertising cookies, and no ambient biscuit-related data collection of any kind.

The banner does keep a small consent record in your browser’s local storage: a random citizen number and how many times you have consented and objected. It never leaves your device; clearing your site data resets your loyalty status, which the Commission regrets. Filing an objection adds one to a public tally of objections; the grounds you write stay in your browser unless you ask for a public response, in which case they are filed as a concern like any other.

This policy may be updated from time to time. The date at the top of this page reflects the most recent revision. The Commission assures you that any amendments will undergo no fewer than three rounds of inter-institutional consultation before publication, in full compliance with the principle of sincere cooperation.

For all privacy-related inquiries, contact strongly@concernedeu.com.

All inquiries will be processed within the 30-day period mandated by GDPR, assuming the Directorate-General for Correspondence is not on summer recess.