A GDPR-compliant app, by design.
A GDPR-compliant app only collects the data it needs, protects it, says what it does with it, and lets everyone get it back or erase it. This is decided before writing the code, not after. I build your web and mobile apps with these rules from scoping onwards, and everyone's role is written into the contract.
The legal framework, in plain words
Which law, for whom
| Law | For whom | What it requires |
|---|---|---|
| GDPR (European Union) | Any company that processes data about people in the European Union, even if it is based elsewhere. | Data minimisation, a legal basis for each item, clear information, rights for everyone, security, a contract with each processor. |
| nFADP (Switzerland) | Companies that process data about people in Switzerland, since September 2023. | Rules close to the GDPR, including data protection by design. |
| Data Protection Act 2017 (Mauritius) | Companies established in Mauritius. | Rules close to the GDPR, and registration with the Data Protection Office. |
| Health data hosting (France) | Apps that store health data. | An HDS-certified host. |
I'm not a lawyer. I tell you what the app must do, and I build it that way. On legal questions, your data protection officer or your lawyer has the final word.
What I do in the app
Data protection by design
- 01
Less data.
The app collects only what it needs: for example, a customer's contact details reach a technician only once the quote is accepted.
- 02
Everyone sees what concerns them.
One space and one set of rights per profile: each type of user reaches only their own screens and data.
- 03
Rights in one tap.
Each user can export or delete their account from the app, as the stores require.
- 04
Nothing left on the phone.
For sensitive data, no database on the device, and documents are erased at sign-out.
- 05
A way back.
The database is backed up automatically before every release.
What's in writing, and in your name
The contract and the accounts
Contract
Roles in writing.
Who does what with your users' data is written into the contract. You are the data controller; I am your processor.
Hosting
In your name.
The app is hosted with the provider we choose together, under an account in your name.
Confidentiality
A signed agreement.
On request, before you give me access to your code or your data.
What I don't do
No turnkey compliance.
Compliance also depends on your organisation: your records of processing activities, your procedures, how you inform your users. I take care of the app, and I give you the technical elements for the rest.
Frequently asked questions
What people ask me about the GDPR
My company is outside the European Union. Does the GDPR apply?
Yes, as soon as your app is aimed at people who are in the European Union.
Will my users be able to delete their account?
Yes, it's planned from scoping. Apple and Google require it anyway for any app that lets people create an account.
What if my app processes health data?
You also need an HDS-certified host in France, and often an impact assessment.
Can you bring an existing app into compliance?
Yes, that's an app rescue. The code review (one week, €1,900 excl. VAT) already checks whether the data is protected and can be restored. App rescue →
Let's talk about your data.
A 30-minute call to tell me what data your app will process. I'll tell you what to plan for, before the first line of code is written. How I work: my method.