Data Processing
This page describes what personal data ConsentForge processes when operating on your behalf.
Data collected from your website visitors
When a visitor interacts with the ConsentForge banner, the following data is collected:
| Data | How it's stored | Retention |
|---|---|---|
| Consent choices (accept/reject per category) | Hashed, in consent receipt | 7 years |
| Timestamp of decision | UTC, in consent receipt | 7 years |
| IP address | SHA-256 hash only — raw IP never stored | 7 years |
| User agent | SHA-256 hash only — raw UA never stored | 7 years |
| Policy version at time of decision | In consent receipt | 7 years |
| Banner version at time of decision | In consent receipt | 7 years |
No raw PII is stored. IP addresses and user agents are one-way hashed before storage.
Legal basis for ConsentForge's own data collection
ConsentForge processes visitor data under legitimate interests (Art. 6(1)(f) GDPR): recording consent decisions is necessary to enable you to demonstrate compliance. This processing is inherent to the service.
Data location
All ConsentForge infrastructure is hosted in the European Union (Frankfurt, Germany). Data does not leave the EU.
Data Processing Agreement
ConsentForge acts as a data processor under GDPR Art. 28. You (the website owner) are the data controller.
A pre-signed DPA is available in Dashboard → Account → Legal → Data Processing Agreement.
Consent receipt retention
Consent receipts are retained for 7 years to support GDPR audit obligations. You can export receipts at any time via:
- Dashboard → Evidence → Export
- API:
GET /api/v1/receipts
Right to erasure (Art. 17 GDPR)
Since consent receipts are stored as hashed identifiers only (no raw PII), it is not possible to identify or delete records belonging to a specific individual — the hash is irreversible. This design is intentional and reduces your GDPR erasure obligations for consent records.
Data breach notification
In the event of a data breach affecting your tenant's data, ConsentForge will notify you within 72 hours in accordance with GDPR Art. 33. Notification will be sent to your account's primary email address.