Legal

File	What it is
processing-register.md	The GDPR Article 30 record of processing
agreements.md	What is signed with whom, and when it renews
policies/	Internal policies
templates/	Contractor agreement, NDA

erudeon is a data controller, so the Article 30 record is a legal obligation rather than good practice. It names each processing activity, its purpose, its lawful basis, the categories of data and people, who it is shared with, and how long it is kept.

The member-facing half of this — consent, the PII map, retention, erasure — is erudeon/passtheyear/docs/COMPLIANCE.md, and this register links to it rather than restating it.

Read a contract before signing with /review-contract.