Privacy & GDPR

Question 1

What is GDPR in one paragraph?

Accepted Answer

GDPR is the EU's data-protection law. It gives people rights over their personal data (access, deletion, portability) and requires you to have a lawful basis for processing. It applies to any business handling EU residents' data.

Question 2

Does GDPR apply to me if I'm outside the EU?

Accepted Answer

Yes if you target EU residents — collect their data, sell to them or track them. Most modern websites are in scope.

Question 3

Controller vs processor — what's the difference?

Accepted Answer

The controller decides why and how data is processed (you). The processor handles data on your behalf (us). GDPR roles set who is responsible for what.

Question 4

Is Blanca's Builder a data processor for me?

Accepted Answer

Yes. We process data on your behalf to deliver the service. A DPA (Data Processing Agreement) is available at /trust/data-processing — accepted by default on signup.

Question 5

Do I need a privacy policy?

Accepted Answer

Yes. Any site that collects any personal data — even just an email — needs one. Blanca's Builder generates a starting policy and translates it to 24 languages.

Question 6

Do I need a cookie banner?

Accepted Answer

Only if you set non-essential cookies (analytics, ads, third-party scripts). With first-party privacy-friendly analytics no banner is required.

Question 7

What is Google Consent Mode and do I need it?

Accepted Answer

It lets you signal user consent to Google's tags. Required if you run Google Ads or Analytics in the EU. The platform includes a consent module that supports v2.

Question 8

How should I categorise cookies?

Accepted Answer

Strictly necessary, functional, analytics, marketing. The cookie banner asks per category; preferences are stored 6-12 months and respected sitewide.

Question 9

How do I handle Data Subject Requests?

Accepted Answer

From Admin, Privacy, Requests you can export or delete a user's data in one click. The request log keeps an auditable record for regulators.

Question 10

How long should I keep customer data?

Accepted Answer

Only as long as needed. Define retention per data type (orders, leads, logs). The platform automates deletion when retention expires.

Question 11

Where is my data stored?

Accepted Answer

EU by default — Supabase in Frankfurt or Stockholm. US or APAC residency is available on Enterprise.

Question 12

Do you transfer EU data to the US?

Accepted Answer

Only when essential (e.g. some AI providers). Transfers use the EU-US Data Privacy Framework and Standard Contractual Clauses, listed in our DPA.

Question 13

Is customer data encrypted at rest?

Accepted Answer

Yes. AES-256 at rest, TLS 1.2+ in transit. BYOK encryption keys available on Enterprise via AWS KMS or Cloudflare Keyless.

Question 14

What if there's a data breach?

Accepted Answer

We notify affected customers without undue delay and within 72 hours per GDPR Article 33. Breach reports are published at /trust/incidents.

Question 15

Can my customers export their own data?

Accepted Answer

Yes. Settings, Privacy, Export data sends a ZIP with everything we hold on them within 24 hours.

Question 16

Can users delete their account themselves?

Accepted Answer

Yes. Settings, Account, Delete account schedules deletion with a 14-day grace; backups are purged within 30 days.

Question 17

Is my data used to train AI models?

Accepted Answer

No. By default, prompts and responses are never used to train models. Both BYOK and Managed AI providers contractually exclude training.

Question 18

Where can I see your list of subprocessors?

Accepted Answer

At /trust/data-processing. Updates are notified 30 days in advance per GDPR; you can object before they take effect.

Question 19

Are you compliant with Schrems II?

Accepted Answer

Yes. Default infrastructure (Cloudflare EU, Supabase EU) stays inside the EU. Where US providers are involved, SCCs and DPF certifications apply.

Question 20

Do I need a Data Protection Officer (DPO)?

Accepted Answer

Required for public bodies and for organisations whose core activity is large-scale monitoring or processing of special-category data. Most small businesses do not need one.