> Political data is special-category data. Most vendors treat that as friction to be minimised; here it is the product. Everything below is answerable in a procurement questionnaire, and none of it is held back until a contract exists.
01
A membership list, a canvassing record, a petition signature, a donation history — under GDPR Article 9, data revealing political opinions is special-category data, and processing it requires a specific condition beyond the usual lawful basis. Every engagement starts by naming that condition in writing, not by assuming one.
02
Any infrastructure Praxis operates runs on EU-based providers under EU jurisdiction. Praxis introduces no US-hosted sub-processors of its own, so nothing about engaging Praxis adds a dependency on the Data Privacy Framework or on standard contractual clauses. For organisations working with people at risk, this is a safety property rather than a legal preference.
03
Most organisations in this sector run on Google Workspace or Microsoft 365, and Praxis works on top of it rather than demanding you leave first. That relationship is yours: you are the controller, the provider is your processor, and the transfer terms are the ones you already signed. Praxis operates inside your tenancy under your controls, adds no new provider to the chain, and is named in your records of processing like any other processor. Reducing that exposure is a migration Praxis can plan and carry out when you want it — costed and staged — not a claim that it has already happened.
04
No client data goes into an AI tool without it being named in writing first: which system, which folder, which categories of data, and which model provider. Special-category data — membership, canvassing, donations, anything revealing political opinion — is out of scope by default and only ever in scope with an explicit instruction and a lawful basis to match. Access for AI tooling is a scoped service account against named resources, never a workspace-wide OAuth grant, and it is revoked on the same schedule as every other access.
05
A data processing agreement under Article 28 is signed before the first record is touched — not after the project, not attached to the invoice. It names the processing, the duration, the sub-processors, the security measures, and what happens to the data at the end.
06
A data migration is the cheapest opportunity an organisation ever gets to delete what it should not be holding. Every migration begins with a field-by-field review: what is actually used, what has a retention basis, and what is being carried forward only because it was there before.
07
Access is scoped to the systems the work requires and revoked at handover. Credentials live in your password manager and your accounts, not in ours. If Praxis retains any access after delivery, it is because a retainer says so in writing.
08
Open formats, open-source components, your repository, your hosting account. Every engagement ends with you able to run the system without Praxis, and the handover documentation is written on that assumption. Lock-in is not a retention strategy here.
Where Praxis operates infrastructure rather than the client, these are the only third parties involved. Where the infrastructure runs in your own accounts, there are none — the list below is about what Praxis touches, not what you own.
Hetzner Online GmbH
Hosting and compute
Default hosting where Praxis operates infrastructure rather than the client.
OVHcloud
Hosting and compute (alternative)
Used where a client prefers a French or Polish jurisdiction.
Yes, always, and before any data is touched. Praxis provides a standard Article 28 DPA covering processing scope, duration, sub-processors, security measures and deletion at end of engagement. If your organisation has its own DPA template, that one is used instead — reviewing yours is part of the engagement, not an extra.
In the EU. Hetzner (Germany or Finland) by default, OVHcloud (France or Poland) where a client prefers that jurisdiction. Where Praxis builds infrastructure in your own accounts, the hosting is whatever you choose — and the EU-only recommendation still stands.
Not by Praxis. There are no US-based Praxis sub-processors, so engaging Praxis adds no reliance on the EU–US Data Privacy Framework or on standard contractual clauses. Where your organisation already runs on Google Workspace or Microsoft 365, that transfer relationship is yours and predates the engagement: Praxis works inside your tenancy under your existing terms rather than introducing a new provider. If you want that exposure reduced, migrating is work Praxis does — planned, staged and costed in advance — but it is your decision and not a condition of anything.
A processor acting on your documented instructions, exactly as the DPA describes. Access is scoped to the systems the work needs — a named shared drive, a specific project, a service account rather than a human login where a script is doing the work — and it is reviewed and revoked like any other. Nothing is copied out to Praxis infrastructure unless the work requires it and the DPA names it.
Only what has been named in writing beforehand: the system, the folder, the categories of data and the model provider. Special-category data — membership, canvassing, donation and anything else revealing political opinion — is out of scope by default. Where AI is part of an engagement, it gets a scoped service account against named resources rather than a workspace-wide OAuth grant, and the AI-usage policy that comes out of the work is a document you can hand to a funder.
By naming the Article 9(2) condition that applies before processing starts — most often 9(2)(d) for a political organisation processing its own members’ data, sometimes explicit consent. It is written into the DPA and the records of processing, so you can answer a regulator, a funder or a member with one sentence.
Working copies are deleted and access is revoked at handover. Anything Praxis holds beyond that point exists only because a retainer specifies it. The systems themselves stay with you: your accounts, your repository, your hosting.
Yes. Ask for the DPA, the sub-processor list and the security measures annex at any point in the sales conversation — before signing anything. Nothing on this page is held back until a contract exists.
No. It sets no cookies, loads no third-party scripts, runs no analytics and makes no requests to any other domain — fonts included. There is nothing to consent to, which is why there is no consent banner. The same standard applies to what Praxis builds for clients.
// ask_for_the_paperwork
Before a proposal, before a call, before anything is signed. If your data protection officer wants to review them first, that is the right order to do it in — and it is faster than discovering a blocker three weeks into a migration.
Request the DPA// next_step
A diagnostic maps where your supporter data lives, who can still see it, what you are holding it under, and what to fix first. Fixed price, two weeks.