Compliance Report

UK GDPR & Data Protection Act 2018

• Lawful basis declared — account features rely on Art. 6(1)(b) (contract); operations on Art. 6(1)(f) (legitimate interest); see the Privacy Policy.
• Data minimisation — we store only what's needed to authenticate, to sync user-chosen preferences, and to operate the food-diary feature for signed-in users. Analytics sits outside that minimum and is consent-gated (see PECR section).
• Food-diary scope declared — entries store food identifier, name, date, grams and a nutrient snapshot only; itemised in the Privacy Policy. Not treated as Art. 9 special-category data because entries describe foods chosen, not health conditions.
• Subject rights honoured — access, rectification, erasure, restriction, portability and consent withdrawal handled by email; 30-day SLA.
• Security of processing (Art. 32) — PBKDF2 password hashing, encrypted data-protection keyring, HTTPS in production, secrets out of source. Detail in the Security Report.
• Retention limits set — account data deleted within 30 days of closure; logs rotated at 90 days.
• Controller details published — DCPNET LTD, registered office and contact route on every relevant page.
• ICO complaint route signposted — in the Privacy Policy.

PECR & client-side storage

• No first-party tracking cookies — the application itself does not set HTTP cookies for tracking or session state; auth and preferences live in localStorage only.
• Client storage disclosed — every localStorage key is itemised in the Cookie Policy with purpose and consent basis.
• Strictly-necessary scope — theme, authentication and consent-record storage fall under PECR's necessary-storage exemption; the optional search-history and food-diary features are functional, user-initiated, account-linked and disclosed (reg. 6(4) "service explicitly requested").
• Analytics consent-gated — Google Analytics 4 is loaded only after the visitor has actively consented via the on-page banner; default state is denied, the consent record is itemised in the Cookie Policy.
• Google Consent Mode v2 implemented — consent defaults are emitted before any Google script loads, so the first impression each visitor makes on Google's network is "denied" until they choose otherwise.
• Equal-prominence accept & reject — the banner's Accept-all, Reject-all and Manage buttons share visual weight; rejection is one click, not buried behind a settings drawer.
• Consent withdrawal route — a "Cookie preferences" button in the site footer and on the Cookie Policy page re-opens the banner so visitors can change their mind at any time; the record refreshes annually.

Equality Act 2010 & WCAG 2.1 AA

• WCAG 2.1 Level AA conformance — tested with axe-core and pa11y across every public route, plus manual review of focus order, ARIA landmarks, and keyboard interaction.
• Documented standard — the Accessibility Report describes the testing process and how to flag a barrier.
• Light & dark themes — both meet AA contrast minimums; respects the operating-system preference.
• Two-day acknowledgement SLA for accessibility issues, ten-day fix-or-workaround target.

Consumer protection

• Free service, no payments — the Consumer Contracts Regs 2013 cooling-off provisions don't apply because no contract for goods or services is formed; details in the Returns Policy.
• Clear medical / dietary disclaimer — the Terms & Conditions state that Food Info is reference data and not medical advice.
• Trader identity disclosed — company name, number, VAT number and registered address shown on every page.

Modern Slavery Act 2015

• Below s.54 reporting threshold — DCPNET LTD's turnover is below £36 million, so a statutory statement is not required.
• Voluntary statement published — the Modern Slavery Policy sets out our zero-tolerance position and supplier-vetting practice.

Children & the Age-Appropriate Design Code

• Service not directed at children under 13 — stated in the Terms & Conditions and Privacy Policy.
• No nudging, no dark patterns — the consent banner gives Accept and Reject equal prominence; no false-urgency, no "soft opt-in" tricks. Analytics is off by default and only loaded with active consent; visitors who reject still receive the full service.

Security posture

• External pen-test conducted — full kalilinux/kali-rolling-based scan covers nmap service detection, security-header inventory, Host-header / SSRF probes, CORS, path enumeration with ffuf, sqlmap injection on the highest-risk parameter, and nikto on both servers. Reproducible from pentest/run.sh.
• Hardened security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP all set on SSR responses; equivalent middleware on the API.
• Auth enforcement verified — protected endpoints return 401 to no-token, missing-header, and bogus-token requests during black-box probing.
• SSRF / Host-header allowlist verified — external Host values rejected with HTTP 400.
• Injection coverage — sqlmap reports /foods/search?q= not injectable; EF Core parameterisation throughout.
• No production secrets in source control — only clearly-labelled development credentials are committed.
• Coordinated disclosure policy — published contact and protections for good-faith researchers in the Security Report.
• Open items tracked — rate limiting on auth endpoints, OAuth returnUrl origin allowlist, account-confirmation email, and stronger password policy are listed transparently in the Security Report under "Planned hardening".

Open-source attribution

• Inventory published — the third-party licences page lists every open-source component bundled into the production build, with its licence.
• All permissive licences — MIT, Apache-2.0, 0BSD, OFL-1.1, PostgreSQL Licence. No copyleft (GPL/AGPL/LGPL/MPL/SSPL) obligations triggered.
• Notices preserved — full 3rdpartylicenses.txt shipped with the production bundle and linked from the licences page.

Companies House & HMRC

• Trading-name disclosure — "Food Info is a trading name of DCPNET LTD" stated on every page.
• Company & VAT numbers visible — Company No. 15734157, VAT 512 3682 13, registered office given.
• Governing law & jurisdiction stated — in the Terms & Conditions.

Data sources & attribution

• USDA FoodData Central credited on the homepage and in the footer; nutrition data is in the U.S. public domain.
• McCance & Widdowson's CoFID credited under the Open Government Licence v3.0, attribution line is in the site footer, source badges appear on individual food pages, and the OGL v3.0 entry is in third-party licences.
• Reference intakes labelled by jurisdiction — UK Reference Intakes (EU Reg. 1169/2011, used as %RI on UK food labels) is the default; users can opt into the FDA 2016 Daily Values for the same nutrients. Both are reference-only, not advisory.

Caveats

This report describes the application's compliance posture as built. It is not a substitute for legal advice. If you operate a derivative service or rely on Food Info for your own compliance position, you should obtain your own legal counsel.

Material changes to the service that affect any of the items above will be reflected here and dated.