> You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable.
But I should still note about the fact in my privacy policy, shouldn't I?
Couple other things I've noted when working on GDPR compliance for my forum:
- It may be good idea to write in your forum rules that you don't allow users to embed their data outside of forum profile. - Forums accumulate tons of lurker accounts (users that register account but don't post or browse anything) that could be automatically deleted - Forums like to log IP's used by users when they, say, post messages. Those could be overwritten to 0.0.0.0 for items older than X days.
I've also been working on privacy policy template for people in my position that I have on GitHub and would love to have any feedback:
https://github.com/rafalp/misago-privacy-policy-examples/blo...