Purpose Binding Policy

A Dekimu Hub workspace recorded (“bound”) a personal-data processing activity to a single declared purpose, with a stated lawful basis and a fixed set of data categories and data-subject classes. The receipt is a tamper-evident record of the controller’s own declaration at the moment of binding — it does not assert that the processing is lawful, only that this declaration was made and has not changed since.

• A named processing activity was bound to one declared purpose.
• A lawful basis (GDPR Art. 6) was selected for that purpose.
• The data categories and data-subject class processed for the purpose were fixed at binding time.
• A data-minimisation commitment ties the declared purpose to the declared data categories.

The receipt commits to the following as SHA-256 hashes. The hashes prove the values existed and have not changed, without disclosing the values themselves:

• Activity identity (id + name)
• Purpose description
• Purpose class (namespaced “gdpr:…”)
• Lawful basis
• Data categories
• Data-subjects class
• Purpose↔data minimisation binding

Provided as context for what the receipt records. References to law are not a claim that any specific processing is compliant — that responsibility stays with the controller.

• GDPR Art. 5(1)(b) — purpose limitation
• GDPR Art. 5(1)(c) — data minimisation
• GDPR Art. 6 — lawfulness of processing
• GDPR Art. 30 — records of processing activities

This page describes what the corresponding anchored receipt attests. The receipt is a tamper-evident record of a declaration or event made by the workspace that issued it. It is not legal advice, not a regulatory endorsement, and not proof that the underlying processing is lawful. The issuing controller remains solely responsible for its compliance.

This receipt policy is published so that the policy_uri carried by minted receipts resolves to a stable reference. The legal wording is pending review by Dekimu Labs S.L. and may be revised; substantive changes will ship under a new version path (the existing version stays resolvable for receipts that reference it).