Security, minors’ data, and where the money goes
This page is for the town clerk, the comptroller and the DPO. It explains what we handle, where it lives and who can access it, and also what we do not do yet.
Where the money goes
Payment happens at the town bank’s own Redsys TPV, with the town’s own merchant credentials, through a redirect to the Redsys payment page. Money never passes through EnaJoin accounts. The payment is confirmed by the signed server-to-server notification Redsys sends (HMAC-SHA256), and we check the amount, order, currency and terminal. We store no card data: only order references and statuses. The integration is complete and is now being validated with the first pilot town’s real TPV.
Failed payments and refunds
A failed payment never loses the place, and each enrollment has a single open payment order, so it cannot be paid twice. If the bank ever captured a second or late payment, or a paid enrollment is cancelled, the payment appears in the list of payments to refund. You make the refund from your TPV’s administration module: EnaJoin does not move money.
Minors’ data, minimised
Name, birth date, support needs, image rights and, only with the guardian’s explicit consent in a separate checkbox (GDPR art. 9), the health and allergy information monitors need. Access is limited to the guardian and the town’s authenticated staff. Families can edit and delete their children and their account in the app.
Discount documents
The certificates and cards families upload are stored on the app server’s persistent volume in Germany. Only authenticated staff of the same town can download them, served as an attachment. Today they are not encrypted at application level, are not deleted automatically, and that volume has no off-site backup yet.
GDPR: who is who
The town is the controller of enrollment data; En Antena Produccions SL, the company behind EnaJoin, is the processor (GDPR art. 28) and signs a data processing agreement with the town. The app and its database are hosted at OVH in Frankfurt (Germany). There is one transfer outside the EU, which we state openly: the daily database backups are stored at Backblaze B2, in a United States region. Transactional emails are sent through Resend.
Application security
The TPV secret key is stored encrypted (AES-256-GCM) and is never shown again. Passwords hashed with bcrypt, CSRF protection on every form, login rate limiting, Cloudflare Turnstile (no cookies) on signup, login and password reset and, on family signup, Tor exit blocking and a honeypot field. Every place allocation is recorded with a millisecond timestamp, and every discount review with who made it and when.
No tracking cookies
The public catalog pages set no cookies: the language is kept in the address or in the browser. Only when a family or staff member logs in is a strictly necessary session cookie set. That is why no cookie banner is needed.
Accessibility
The target is WCAG 2.1 AA (UNE-EN 301 549), which is mandatory for public services. The accessibility statement, currently “partially conformant”, explains what is missing and how to report an issue.
Coming soon (not done yet)
- Automatic deletion of discount documents at season end, with a period set by the town.
- Application-level encryption of documents and an off-site backup of the documents volume.
- Database backups inside the EU (today they go to the United States: under review).
- Two-factor authentication (2FA) and separate roles and permissions for municipal staff.
- Self-declaration of conformity with the ENS, basic category.
- Automatic translation of activity descriptions, with a visible indicator until staff review it.
More information: App privacy · Accessibility · Legal notice
Want the data processing agreement, or have more questions?
Write to us