Each data collection point documents its legal basis under GDPR Art. 6

Without a documented lawful basis for each processing activity, every data collection your application performs is potentially unlawful under GDPR Art. 6. Regulators do not need to prove harm — the absence of a documented basis is itself the violation. Marketing emails sent to users who signed up only for account delivery violate Art. 6 directly: the 'contract' basis covers service delivery, not promotional campaigns, and each is a separate legal act. The distinction between consent, contract, and legitimate interest is not cosmetic — 'legitimate interest' requires a balancing test, and skipping it leaves you exposed to a GDPR Art. 5(1)(a) breach finding that can carry fines up to 4% of global turnover.

Document the legal basis for each processing activity in your privacy policy and optionally in a DATA_REGISTER.md at the repo root. Write it explicitly per purpose — do not combine unrelated activities under one basis.

| Data Type    | Collection Point  | Lawful Basis           | Notes                          |
|--------------|-------------------|------------------------|--------------------------------|
| Email        | Signup form       | Contract (Art. 6(1)(b))| Required to deliver the service|
| Email        | Newsletter opt-in | Consent (Art. 6(1)(a)) | Separate checkbox; withdrawable|
| Usage events | In-app analytics  | Legitimate interest    | Balancing test documented below|
| Payment info | Checkout          | Contract (Art. 6(1)(b))| Required for payment processing|

For legitimate interest, document the balancing test: "Pseudonymous analytics to improve the product. Low-impact (no PII, opt-out available). Our interest does not override user privacy interests." Add this to DATA_REGISTER.md and cross-reference it from your privacy policy.