Guide
Photos, positions, signatures: what the GDPR asks
A field form nearly always collects personal data without anyone meaning to: a passer-by's face in the background of a photo, an employee's position, a customer's signature. Here is what that implies, and what the tool must give you to answer for it.
15 days • 10 users • no card required
What you collect without meaning to
Three ordinary pieces of personal data
They are not flagged as such in a form, and they are the three that raise questions during an inspection.
- The employee's position
- Geolocating a submission means geolocating the person who filled it, at the time they filled it. The purpose must be declared and proportionate, and staff representatives informed.
- Faces in photos
- A site photo contains third parties. Retention, duration and access have to be thought through, and blurring is not always enough.
- The handwritten signature
- It is biometric in the ordinary sense and an element of proof. Its timestamp and integrity matter as much as its image.
What the tool must provide
Six concrete requirements
All of them can be checked by asking the vendor, and the answer should be written somewhere rather than given in a meeting.
- Where it is hosted
- Where the database, the files, the backups and the logs live — and under which law. An answer per service, not one global answer.
- List of subprocessors
- Who else touches your data: email delivery, notifications, object storage, analytics. The list must be published and dated.
- Retention periods
- How long a submission, a media file and a log are kept, and what triggers their deletion.
- Export and erasure
- Being able to extract all of a person's data and delete it, without a billed support ticket.
- Access traceability
- Knowing who read or corrected a submission, and when. A correction without a trace makes the history indefensible.
- Marking personal fields
- Being able to mark a field as personal data, so exports and retention treat it as such.
Where we stand
What Rondea provides, and what remains
This page is not a pitch: it also exists to say what is not finished on our side.
- Provided
- Hosting in France, organisation isolation enforced by the database, corrections traced as revisions, complete exports, personal-field marking, published subprocessor register.
- Not yet
- The external penetration test and the RGAA accessibility audit are planned and budgeted, not finished. No certification is held today, and we claim none.
- Yours to decide
- The purpose, the legal basis, informing the people concerned and the retention you choose remain your decisions. No software makes them for you, whatever a sales page says.
Does this page count as legal advice?
No. It describes what we observe while building field-capture software, and what our tool provides. Your data protection officer remains the one who decides.
Ask us the six questions
The security page answers point by point, including where the answer is "not yet". Write to us if one is missing.