Minimal profile data, separate consents, retention workflows — draft policy.
GDPR, SOC 2 or ISO certifications are not claimed from architectural controls alone.