title: GDPR compliance for a web app (Vue.js, Django, Heroku)
body: <p>I have build a web application using Django, Vue.js and deployed it on Heroku. It is a web application made for a big charity where you can win prizes by donating to the charity. The following information is collected:</p>
  <ul>
  <li>Name</li>
  <li>Username</li>
  <li>Email</li>
  <li>Password</li>
  </ul>
  <p>Which is pretty basic, I guess. The reason no payment information is stored is because, upon clicking 'Donate', the user is redirected to JustGiving (implemented the JustGiving API) where they enter their payment information and such and are then redirected back to our website.</p>
  <p>A few emails are sent:</p>
  <ul>
  <li>An email when somebody wins a prize</li>
  <li>An email if you are the winner of the prize</li>
  <li>An email when a new prize draw is taking place</li>
  <li>A receipt of your donation</li>
  </ul>
  <p>This will be the first time I properly publish a web application so wanted to ask what steps I need to ensure to make sure the web app is legal. I know I have to probably have a 'cookies' alert and a section where users choose to receive emails or not.</p>
  <p>What other steps must I take to make sure I am not breaking any rules?</p>