---
sidebar_position: 7
title: Data Handling & GDPR
description: "How TrackForge handles catalogue data under GDPR: public blockchains carry hash commitments only — no catalogue metadata, writer data or personal information."
keywords:
  - GDPR
  - data handling
  - evidence packet
  - proof bundle
---

# Data Handling & GDPR

TrackForge proof design minimises personal data exposure. Public blockchain records contain hash commitments, not catalogue metadata, writer data, or personal information.

## Data Categories

- Catalogue metadata supplied by the owner.
- Reference evidence needed for UK/US workflow checks.
- Evidence packet hashes and Merkle roots.
- Rating event metadata.
- Operator evidence where required for remediation or proof.

## Public Proofs

OpenTimestamps proofs record cryptographic commitments only. The blockchain does not contain track titles, writer names, IPI numbers, catalogue names, or ownership shares.

## External Sources

External source consultation is documented as part of the workflow and evidence provenance. Source use must be described according to the actual workflow version used, not roadmap ambition.