[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6BYQT65VYJJZ102MV7FSTK6":3,"skill-same:01M6BYQT65VYJJZ102MV7FSTK6":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M6BYQT65VYJJZ102MV7FSTK6","diagnosing-bugs",null,"Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"\u002F\"debug this\", or reports something broken\u002Fthrowing\u002Ffailing\u002Fslow.","Vortex375\u002Fseraph","Vortex375","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F5016523?v=4","01M6BYMHA5FQE4EMD6BSZ13M46","Benjamin Schmitz","01M6BYMHEYGQ7DM3Q8A7KBNZ48",2,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fdiagnosing-bugs\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"diagnosing bugs","bugs","performance","debug","diagnose","loop","broken","user","use","reports","diagnosis","for","when","failing","2026-11-10 10:12:30",false,"---\nname: joint-controller-art26\ndescription: >-\n  Guides the establishment and management of joint controller arrangements under\n  GDPR Article 26, including determination of joint controllership, allocation of\n  responsibilities, and transparency obligations. Activate when two or more\n  controllers jointly determine purposes and means of processing, or when\n  evaluating shared data platforms. Keywords: joint controller, Article 26,\n  shared responsibility, arrangement, joint determination.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: gdpr-compliance\n  tags: \"gdpr, joint-controller, article-26, shared-processing, arrangement, responsibility\"\n---\n\n# Managing Joint Controller Arrangements\n\n## Overview\n\nArticle 26 applies when two or more controllers jointly determine the purposes and means of processing. Joint controllers must enter into an arrangement that transparently determines their respective responsibilities for compliance, particularly regarding data subject rights and transparency obligations. The essence of the arrangement must be made available to data subjects.\n\n## Determining Joint Controllership\n\nJoint controllership exists when two or more entities:\n1. **Jointly determine the purposes** — both entities influence why data is processed.\n2. **Jointly determine the means** — both entities influence how data is processed (essential means, not just technical implementation details).\n\n### Key Indicators\n\n| Indicator | Points to Joint Controllership | Points Away |\n|-----------|-------------------------------|-------------|\n| Shared decision on purpose | Both parties decide why data is processed | One party decides purpose; other merely executes |\n| Shared platform | Both parties upload\u002Faccess data on a common platform | One party hosts; other merely provides input |\n| Shared dataset | Both parties contribute to and benefit from a combined dataset | One party processes only for the other's purpose |\n| Mutual benefit | Both parties derive independent benefit from the processing | Only one party benefits; other is purely a service provider |\n| Influence on means | Both parties have a say in essential aspects (what data, how long, who accesses) | One party determines all essential means; other party only implements |\n\n### CJEU Case Law Guidance\n\n- **Wirtschaftsakademie Schleswig-Holstein (C-210\u002F16)**: A Facebook fan page admin is a joint controller with Facebook because the admin's creation of the page enables Facebook's processing and the admin benefits from visitor statistics.\n- **Jehovah's Witnesses (C-25\u002F17)**: A religious community that organises door-to-door preaching and coordinates personal data collection by its members is a joint controller with those members.\n- **Fashion ID (C-40\u002F17)**: A website embedding a Facebook Like button is a joint controller with Facebook for the collection and transmission of data triggered by the plugin.\n\n## Art. 26 Arrangement Requirements\n\nThe arrangement between joint controllers must determine in a transparent manner:\n\n### 1. Respective Responsibilities\n\n| Responsibility Area | Allocation Options |\n|---------------------|-------------------|\n| Lawful basis determination | Which controller is responsible for establishing and documenting the lawful basis |\n| Privacy notices (Art. 13-14) | Which controller provides transparency information to data subjects |\n| Data subject rights (Art. 15-22) | Which controller serves as the contact point and handles requests |\n| Data security (Art. 32) | Which controller implements and maintains security measures |\n| Breach notification (Art. 33-34) | Which controller notifies the supervisory authority and data subjects |\n| DPIA (Art. 35) | Which controller conducts the DPIA |\n| Records of processing (Art. 30) | How both controllers maintain their respective RoPA entries |\n\n### 2. Contact Point for Data Subjects\n\nThe arrangement must designate a contact point for data subjects. Regardless of the arrangement, data subjects may exercise their rights against any of the joint controllers (Art. 26(3)).\n\n### 3. Transparency\n\nThe essence of the arrangement must be made available to data subjects. This does not require publishing the full commercial agreement, but must cover:\n- The identity of both joint controllers\n- How responsibilities are divided\n- How data subjects can exercise their rights\n- The designated contact point\n\n## Arrangement Template Structure\n\nA compliant Art. 26 arrangement should include:\n\n1. **Parties and definitions**: Legal entity names, registered addresses, roles.\n2. **Scope of joint processing**: Specific processing activities covered, personal data categories, data subject categories.\n3. **Purpose determination**: How purposes are jointly determined and what each party's interest is.\n4. **Means determination**: Which essential means each party determines (data elements, retention, access, security standards).\n5. **Responsibilities allocation**: Detailed allocation per the table above.\n6. **Data subject rights**: Designated contact point, handling procedures, cooperation obligations.\n7. **Transparency**: How the essence of the arrangement is communicated to data subjects.\n8. **Security obligations**: Minimum security standards each party commits to.\n9. **Breach management**: Notification obligations between the parties and to authorities\u002Fdata subjects.\n10. **Liability**: Internal allocation of liability (note: external liability to data subjects is joint and several per Art. 82(4)-(5)).\n11. **Term and termination**: Duration, exit provisions, and data handling upon termination.\n\n## Practical Considerations\n\n### Joint and Several Liability\n\nUnder Art. 82(4), each joint controller is liable for the entire damage caused by processing that infringes the GDPR. A joint controller may be exempted from liability under Art. 82(3) only if it proves it is not responsible for the event giving rise to the damage. Internal liability allocation in the arrangement does not affect the data subject's right to claim against either controller.\n\n### Supervisory Authority Actions\n\nUnder Art. 26(3), data subjects can exercise their rights against each and any of the joint controllers regardless of the arrangement. The supervisory authority may also investigate any joint controller for the full scope of joint processing.\n\n### Relationship with Art. 28\n\nJoint controllership and the controller-processor relationship are mutually exclusive for a given processing activity. If Entity A determines purposes and means and Entity B merely processes on A's instructions, the relationship is controller-processor (Art. 28). If both determine purposes and means, the relationship is joint controllership (Art. 26).\n","# Managing Joint Controller Arrangements\n\n## Overview\n\nArticle 26 applies when two or more controllers jointly determine the purposes and means of processing. Joint controllers must enter into an arrangement that transparently determines their respective responsibilities for compliance, particularly regarding data subject rights and transparency obligations. The essence of the arrangement must be made available to data subjects.\n\n## Determining Joint Controllership\n\nJoint controllership exists when two or more entities:\n1. **Jointly determine the purposes** — both entities influence why data is processed.\n2. **Jointly determine the means** — both entities influence how data is processed (essential means, not just technical implementation details).\n\n### Key Indicators\n\n| Indicator | Points to Joint Controllership | Points Away |\n|-----------|-------------------------------|-------------|\n| Shared decision on purpose | Both parties decide why data is processed | One party decides purpose; other merely executes |\n| Shared platform | Both parties upload\u002Faccess data on a common platform | One party hosts; other merely provides input |\n| Shared dataset | Both parties contribute to and benefit from a combined dataset | One party processes only for the other's purpose |\n| Mutual benefit | Both parties derive independent benefit from the processing | Only one party benefits; other is purely a service provider |\n| Influence on means | Both parties have a say in essential aspects (what data, how long, who accesses) | One party determines all essential means; other party only implements |\n\n### CJEU Case Law Guidance\n\n- **Wirtschaftsakademie Schleswig-Holstein (C-210\u002F16)**: A Facebook fan page admin is a joint controller with Facebook because the admin's creation of the page enables Facebook's processing and the admin benefits from visitor statistics.\n- **Jehovah's Witnesses (C-25\u002F17)**: A religious community that organises door-to-door preaching and coordinates personal data collection by its members is a joint controller with those members.\n- **Fashion ID (C-40\u002F17)**: A website embedding a Facebook Like button is a joint controller with Facebook for the collection and transmission of data triggered by the plugin.\n\n## Art. 26 Arrangement Requirements\n\nThe arrangement between joint controllers must determine in a transparent manner:\n\n### 1. Respective Responsibilities\n\n| Responsibility Area | Allocation Options |\n|---------------------|-------------------|\n| Lawful basis determination | Which controller is responsible for establishing and documenting the lawful basis |\n| Privacy notices (Art. 13-14) | Which controller provides transparency information to data subjects |\n| Data subject rights (Art. 15-22) | Which controller serves as the contact point and handles requests |\n| Data security (Art. 32) | Which controller implements and maintains security measures |\n| Breach notification (Art. 33-34) | Which controller notifies the supervisory authority and data subjects |\n| DPIA (Art. 35) | Which controller conducts the DPIA |\n| Records of processing (Art. 30) | How both controllers maintain their respective RoPA entries |\n\n### 2. Contact Point for Data Subjects\n\nThe arrangement must designate a contact point for data subjects. Regardless of the arrangement, data subjects may exercise their rights against any of the joint controllers (Art. 26(3)).\n\n### 3. Transparency\n\nThe essence of the arrangement must be made available to data subjects. This does not require publishing the full commercial agreement, but must cover:\n- The identity of both joint controllers\n- How responsibilities are divided\n- How data subjects can exercise their rights\n- The designated contact point\n\n## Arrangement Template Structure\n\nA compliant Art. 26 arrangement should include:\n\n1. **Parties and definitions**: Legal entity names, registered addresses, roles.\n2. **Scope of joint processing**: Specific processing activities covered, personal data categories, data subject categories.\n3. **Purpose determination**: How purposes are jointly determined and what each party's interest is.\n4. **Means determination**: Which essential means each party determines (data elements, retention, access, security standards).\n5. **Responsibilities allocation**: Detailed allocation per the table above.\n6. **Data subject rights**: Designated contact point, handling procedures, cooperation obligations.\n7. **Transparency**: How the essence of the arrangement is communicated to data subjects.\n8. **Security obligations**: Minimum security standards each party commits to.\n9. **Breach management**: Notification obligations between the parties and to authorities\u002Fdata subjects.\n10. **Liability**: Internal allocation of liability (note: external liability to data subjects is joint and several per Art. 82(4)-(5)).\n11. **Term and termination**: Duration, exit provisions, and data handling upon termination.\n\n## Practical Considerations\n\n### Joint and Several Liability\n\nUnder Art. 82(4), each joint controller is liable for the entire damage caused by processing that infringes the GDPR. A joint controller may be exempted from liability under Art. 82(3) only if it proves it is not responsible for the event giving rise to the damage. Internal liability allocation in the arrangement does not affect the data subject's right to claim against either controller.\n\n### Supervisory Authority Actions\n\nUnder Art. 26(3), data subjects can exercise their rights against each and any of the joint controllers regardless of the arrangement. The supervisory authority may also investigate any joint controller for the full scope of joint processing.\n\n### Relationship with Art. 28\n\nJoint controllership and the controller-processor relationship are mutually exclusive for a given processing activity. If Entity A determines purposes and means and Entity B merely processes on A's instructions, the relationship is controller-processor (Art. 28). If both determine purposes and means, the relationship is joint controllership (Art. 26).\n",{"name":38,"license":39,"metadata":40,"description":46},"joint-controller-art26","Apache-2.0",{"tags":41,"author":42,"domain":43,"version":44,"subdomain":45},"gdpr, joint-controller, article-26, shared-processing, arrangement, responsibility","mukul975","privacy","1.0","gdpr-compliance","Guides the establishment and management of joint controller arrangements under GDPR Article 26, including determination of joint controllership, allocation of responsibilities, and transparency obligations. Activate when two or more controllers jointly determine purposes and means of processing, or when evaluating shared data platforms. Keywords: joint controller, Article 26, shared responsibility, arrangement, joint determination.","main","9b2ef9eae161c00a17241d42a388571321b33e9f","app\u002Fseraph_app\u002F.agents\u002Fskills\u002Fdiagnosing-bugs",0,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph","https:\u002F\u002Fgithub.com\u002FVortex375","2026-11-08 18:46:14",{"source":8,"skillName":38,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add Vortex375\u002Fseraph --skill joint-controller-art26",{"tool":60,"command":61},"bunx","bunx skills add Vortex375\u002Fseraph --skill joint-controller-art26",{"tool":63,"command":64},"pnpm","pnpm dlx skills add Vortex375\u002Fseraph --skill joint-controller-art26","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fdiagnosing-bugs\u002FSKILL.md",true,[68,74,80,84,88,94],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"agents\u002Fopenai.yaml","REFERENCE","参考文档",103,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fdiagnosing-bugs\u002Fagents\u002Fopenai.yaml",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"assets\u002Ftemplate.md","ASSET","资产文件",7189,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fjoint-controller-art26\u002Fassets\u002Ftemplate.md",{"path":81,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fstandards.md",4338,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fjoint-controller-art26\u002Freferences\u002Fstandards.md",{"path":85,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fworkflows.md",4762,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fjoint-controller-art26\u002Freferences\u002Fworkflows.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fhitl-loop.template.sh","SCRIPT","脚本",1316,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fdiagnosing-bugs\u002Fscripts\u002Fhitl-loop.template.sh",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fprocess.py",6211,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fjoint-controller-art26\u002Fscripts\u002Fprocess.py",[99,120,145,170,186,205],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":115,"publishedAt":33},"01M6BYS1QVW7F887EXS5RR34TA","writing-for-agents","Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwriting-for-agents\u002FSKILL.md",[105,110],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[116,30,117,31,27,118,119],"writing","writing for agents","editing","documents",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":33},"01M6BYRZNREK0C7V6Y43AKDJWW","wizard","Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwizard\u002FSKILL.md",[],[122,127,128,129,130,131,132,133,31,134,135,30,136,137,138,139,140,141,27,142,143,144],"provisioning","ci","generate","infrastructure","dashboard","can","running","invoke","party","credentials","human","provisioning infrastructure","migration","up","only","interactive","Bash","secrets",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":33},"01M6BYRY92S448X31PTG25TCJC","wayfinder","Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwayfinder\u002FSKILL.md",[],[147,152,153,154,132,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"at","map","agent session","time","true","shared","more","tickets","as","clear","issue","session","one at a time","work","decision","plan","chunk","tracker",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":33},"01M6BYRWXMYWB6PD7E9PAD44M4","wait-what","Stop. That last message did not land: re-pitch it.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwait-what\u002FSKILL.md",[],[177,178,179,156,180,181,182,183,184,185],"wait what","wait","re","last","it","pitch","message","stop","land",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":192,"publishedAt":33},"01M6BYRTS6JNDYB7BZVAWK7JJ9","triage","Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Ftriage\u002FSKILL.md",[],[188,193,194,195,196,197,198,199,200,201,202,203,156,204],"machine","roles","grill","ready","write","verify","issues","state","move","prs","state machine","briefs",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":211,"publishedAt":33},"01M6BYRRRCDHNXH2YBDTYJPG36","to-tickets","Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fto-tickets\u002FSKILL.md",[],[212,159,213,214,215,156,216,217,160,218,169,219,167,220,221],"to tickets","spec","links","break","native","ticket","conversation","text","SET","file"]