Privacy ops

Processing register & retention

Exact periods stay empty until authorised privacy/legal staff approve and enter them. “As long as necessary” is not an acceptable sole retention statement.

Back to legal hub

Processing activities

Operate Secret Community membership and roles

Create and operate invitation-only communities

GDPR: Art. 6(1)(b) contract / Art. 6(1)(f) legitimate interests (service integrity)
KVKK: Document per applicable KVKK Art. 5 provision — counsel to confirm
Categories: account id, username, membership, roles, permissions
Profiling: No
Human review: Yes
Retention ref: rp-membership

Telephone verification

Verify control of number; prevent abuse

GDPR: Art. 6(1)(b) / Art. 6(1)(f) — not consent for mandatory verification
KVKK: Document per applicable KVKK Art. 5 provision — counsel to confirm
Categories: phone number, verification status, verification logs
Profiling: No
Human review: Yes
Retention ref: rp-phone-verify

Voice-call verification and creator interview

Confirm creator request and security understanding

GDPR: Art. 6(1)(b) / Art. 6(1)(f)
KVKK: Document per applicable KVKK Art. 5 provision — counsel to confirm
Categories: call timestamps, result, reviewer id, category notes
Profiling: No
Human review: Yes
Retention ref: rp-voice-verify

Internal Community Trust Score / risk indicators

Prioritise security review; detect abuse

GDPR: Art. 6(1)(f) legitimate interests; Art. 22 safeguards for significant effects
KVKK: Document profiling/automated decision rules with counsel
Categories: reports, abuse signals, moderation history, score events
Profiling: Yes
Human review: Yes
Retention ref: rp-trust-score

Reports, moderation decisions, appeals

Enforce rules; investigate reports; safety

GDPR: Art. 6(1)(f) / legal obligation where applicable (e.g. DSA duties)
KVKK: Document per applicable KVKK Art. 5 provision — counsel to confirm
Categories: report content refs, decision records, appeal status
Profiling: No
Human review: Yes
Retention ref: rp-moderation

Privileged Root access auditing

Accountability for privileged access

GDPR: Art. 6(1)(f) / Art. 6(1)(c) where security logging is obligatory
KVKK: Document with counsel
Categories: root user, resource, reason, action, session
Profiling: No
Human review: Yes
Retention ref: rp-root-access

Retention matrix

ID	Record type	Days	Method	Owner
`rp-phone-verify`	Telephone verification records	Counsel to set	secure-delete	privacy
`rp-voice-verify`	Voice-call verification & interview records	Counsel to set	secure-delete	privacy
`rp-invitations`	Invitation records	Counsel to set	secure-delete	privacy
`rp-invite-tokens`	Expired invitation tokens/secrets	Counsel to set	secure-delete	security
`rp-membership`	Membership records	Counsel to set	secure-delete	privacy
`rp-acceptances`	Rule/notice acceptance records	Counsel to set	secure-delete	privacy
`rp-security-logs`	Security logs	Counsel to set	secure-delete	security
`rp-moderation`	Moderation & appeal records	Counsel to set	secure-delete	trust-safety
`rp-trust-score`	Trust Score history	Counsel to set	irreversible-anonymise	trust-safety
`rp-reports`	User reports	Counsel to set	secure-delete	trust-safety
`rp-root-access`	Root privileged-access logs	Counsel to set	secure-delete	security
`rp-legal-hold`	Legal-hold records	Counsel to set	legal-hold-exempt	legal
`rp-dsr`	Data-subject request records	Counsel to set	secure-delete	privacy