Privacy for public bodies
This section is for data protection officers, project managers, administrators, developers and editors of public bodies that run a site with Exponential. Every product statement is backed by the repository, above all Privacy standards: Exponential is software, not a data controller; it provides features (consent log, opt-in mail, erasure on account removal, audit pseudonymization, log masking and retention, no third-party assets in the administration) and names its gaps (no single export or delete-me function, manual account removal, logs without an age limit by default, forms without retention, no cookie banner).
Note This section describes features and common practice; it is not legal advice. Check the law that applies to your organization with your legal counsel.
Contents
Reading order
- Data protection officers: GDPR mapping, controller and processor, personal data inventory, records of processing, DPIA, privacy notice outline.
- Administrators: retention overview with its audit and log pages, consent records, suppression list, access and erasure, restriction.
- Project managers and developers: data minimization, cookies and banners, third-party extensions, analytics, CAPTCHAs, maps, social login, forms, the privacy by design checklist.
Pages in this section
| Page | Answers |
|---|---|
| Mapping the GDPR to Exponential | topic by topic, features and gaps |
| Controller, processor and the software | who is who around a site |
| Where personal data lives in Exponential | the inventory with tools and retention |
| Data minimization | minimized by default; what you minimize |
| Privacy in the audit trail | defaults, pseudonymization, strict profile |
| Masking in logs and the log viewer | masking when writing and showing |
| Retention of personal data: an overview | every mechanism and its default |
| Audit retention | 90 / 730 days and how to change them |
| Log retention | age limits and pruning |
| Consent records for mail | the consent log |
| Mail categories and opt-in | essential, optional, double opt-in |
| One-click unsubscribe | footer and List-Unsubscribe |
| The suppression list | hashed do-not-mail entries |
| The right of access | exports and collection |
| What cannot be exported | the limits and options |
| The right to erasure | automatic, manual, kept |
| Restriction and Deactivate and move | retiring accounts without deleting |
| Cookies set by Exponential | the kernel's functional cookies |
| Cookie banners and consent | none shipped; when you need one |
| Third-party extensions and privacy | services that send data out when activated |
| Analytics and visitor statistics | own statistics and Google Analytics |
| CAPTCHAs and privacy | reCAPTCHA, hCaptcha and alternatives |
| Maps and embedded content | Google Maps location datatype and embeds |
| Social login and privacy | sign-in through providers |
| Information collection forms and privacy | what forms store; manual retention |
| Search phrases | search statistics |
| Records of processing for a website | facts for each activity |
| Data protection impact assessment for a website | when and with what facts |
| A privacy notice outline for an Exponential site | sections and facts |
| Privacy rules outside the EU | laws the project maps; a feature approach |
| Privacy by design checklist | planning to operation |
Step-by-step tasks (answer an access request for mail preferences, erase a user account, export audit records about a person, export and remove form submissions) are in the compliance tasks of this help (Compliance tasks).
Related pages
- Up: Governments: start here
- Privacy standards
- Compliance and GDPR for hosts
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.