GDPR - Data Processing Information

1. Data Controller And Contact

UrT.li is the controller of data processed through this service.

To speed up handling, include context such as date/time, URL, request ID, or filename.

2. What We Process

We process only what is needed to run the service, moderate content, and protect infrastructure.

• Technical logs (IP, user-agent, URI, timestamp).
• Moderation workflow data (nickname, contact, asset, decision note, revision trail).
• Download metadata (requested file, time, technical anti-abuse signals).
• Strictly necessary session/technical cookies.

3. Purposes And Legal Bases

We process personal data under Article 6 GDPR, depending on the purpose. Each processing activity is limited to what is strictly necessary for that purpose.

• Service operation and delivery (Article 6(1)(b) - performance of a service): used to deliver pages/files, keep request tracking links functional, and maintain normal platform operation. Typical data: technical request metadata, route/access context, and request identifiers.
• Security, anti-spam, and anti-abuse (Article 6(1)(f) - legitimate interest): used to detect suspicious traffic, rate-limit abusive behavior, and protect availability/integrity of the service. Typical data: IP, user-agent, request timing, and anti-abuse signals.
• Moderation and repository integrity (Article 6(1)(f) - legitimate interest): used to review submitted changes, preserve revision history, ensure accountability of decisions, and prevent tampering or conflicting moderation actions. Typical data: reporter/moderator metadata, decision notes, revision and lock history.
• Legal and regulatory compliance (Article 6(1)(c) - legal obligation): used when required by applicable law, valid legal requests, or mandatory retention/compliance duties.

4. Access, Retention, And Minimization

Access is role-based and restricted to authorized personnel. Some data is processed by infrastructure providers for hosting and operations.

Retention is tied to security and operational necessity. Data is reviewed and minimized regularly (deletion/anonymization when possible).

5. Your GDPR Rights

You may request access, correction, deletion, restriction, objection, or consent withdrawal when consent is the legal basis.

You may also lodge a complaint with your competent supervisory authority.

6. Security Measures (Summary)

• Public/private route separation and access controls.
• Operational logging and anti-abuse monitoring.
• Sanitization of user-generated content before rendering.
• Least-privilege and minimization by default.

7. EU Hosting Providers

UrT.li is hosted across multiple European providers: