Hi @MyriamBoure
This link https://gdpr-info.eu/art-24-gdpr/ was useful, thank you. It seems to confirm that what OFN needs is mainly a) to be able to technically implement the requirements of the Controller and b) some documentation such as policies and contract terms.
What seems to be lacking in OFN and which you have pointed out here already, is that we cannot properly delete data and nor can we determine (as far as I know) if any customer has been inactive for a certain number of years. The latter isn’t urgent as OFN is too young for this to be too much of a problem right now but it will become more relevant in the future. We do need to be able to delete personal data however, or, if we want to keep sales statistics, then something more complex will be needed to remove the personal element.