Page 1

Project or Business Process: Version: Dated: Author:

Personal Data Analysis Diagram Customer name, address and email address Transfer method Description

Customer contact details

Special category

No

Obtained from data subject

Yes

Consent required?

No

Privacy notice Owner

Storage in database

Volume

About 50 a day

Frequency

Web server

Adhoc

Internal or external

Internal

Controls applied

Location type Country stored in Encryption level

Privacy Notice 1

Retention period Customer telephone number Telelphone number of the customer

Special category

No

Obtained from data subject

Yes

Consent required?

No

Privacy notice

Privacy Notice 1

Volume Transfer method

Electronic via Internet

Frequency

Adhoc

Internal or external Controls applied

External

Number, expiry and CVC of customer's credit card

Special category

No

Obtained from data subject

Yes

Consent required?

No

Privacy notice

Electronic via Internet About 50 a day

Frequency

About 50 a day Website sale processing

Controls applied

SSL/TLS encryption

Lawful basis

Contractual

Method of consent

Consent not required

Automated decisionmaking?

No Sales and Marketing Manager

Country stored in

Retention period

Transfer method Volume

About 50 a day

Special category

No

Obtained from data subject

Yes

Consent required?

No Privacy Notice 1

Encryption at rest None 7 years

Frequency

Review Website

Adhoc External None

Location type Country stored in

API via Internet

Volume

About 50 a day

Frequency Internal or external

UK None

Level of data subject access

None

Access controls

Transfer method

Electronic

Encryption level

Retention period

The IP address of the customer at the time of purchase

UK

Email via Internet

Controls applied

Process Narrative: The Website Sale process starts with a customer visiting our website, choosing a product and going through checkout. The customer provides contact details and credit card information and their IP address is recorded automatically by the website. Credit card details are checked and stored at the Payment Processor, order details are stored on the Web Server and interfaces send the customer name and email address to a Review Website and a Mailing website for later use.

Electronic

Two factor Access controls authentication for admin accounts

Internal or external

Privacy Notice 1

Customer IP address

Description

Location type

Level of data subject access

Credit card details

Website sale; receive funds in exchange for product

Copy of sale confirmation email

Owner

7 years

Payment processor

Encryption level

Purpose of processing

Process owner

External

Sales and Marketing Manager

Privacy notice

None

Adhoc

Internal or external

SSL/TLS encryption

Sale via website

Credit card details

Owner

Transfer method

Volume

Sales and Marketing Manager

Description

UK

Two factor Access controls authentication for admin accounts

Description

Owner

Electronic

Level of data subject Can be updated via access portal

Storage on web server

Sales and Marketing Manager

Website Sale Version 1 [dd/mm/yyyy] A.N. Other

7 years User account and password

Mailing Website

Adhoc External

Controls applied

Sales and Marketing Manager API – Name and email address

None

Location type Country stored in

Electronic UK

Encryption level

None

Level of data subject access

None

Retention period Access controls

7 years Two factor for admin access


Project or Business Process: Version: Dated: Author:

Personal Data Analysis Diagram

Transfer method

Extract from database

Volume

200 a week

Frequency

Daily

Internal or external

Location type Country stored in

UK None

Level of data subject access

None

Access controls

Not known

7 years User account and password

Post-sale review request

Information retrieval

Electronic

Encryption level

Retention period

External

Controls applied

Review Website

Post-sale review request Version 1 [dd/mm/yyyy] A.N. Other

Purpose of processing Customer name and email address Description

Lawful basis Method of consent

Customer contact details

Special category

No Process owner

Obtained from data subject

Yes

Consent required?

Yes

Privacy notice Owner

Automated decisionmaking?

Email the customer to ask them to submit a review of the product Consent Tickbox at checkout No

Sales and Marketing Manager

Privacy Notice 1

Sales and Marketing Manager

Process Narrative: Customer name and email address are stored on the Review Website and used to send an automated request to the customer to submit a review of the product they have purchased. If submitted, the review is stored on the Review Website and will be accessible publicly.


Personal Data Analysis Templates [Personal data item name(s)] Description

0

Special category Obtained from data subject

0

Consent required?

0

Privacy notice

0

Owner

0

0

Volume

0

Frequency

0

Internal or external

0

Controls applied

0

[Transfer name]

[Processing]

Purpose of processing

Transfer method

0

Transfer method

0

Volume

0

Frequency

0

Internal or external

0

Controls applied

0

Lawful basis Method of consent

0

Automated decisionmaking?

0

Process owner

0

[Transfer name]

Instructions: [Storage location]

Location type

0

Country stored in

0

Encryption level

0

Level of data subject access

0

Retention period

0

Access controls

0

Copy and paste the appropriate objects on this page onto a new tab (one per business process) in order to create representations of the flow of personal data. To enter shape data, first ensure that the Shape Data task pane is shown by visiting the View ribbon, clicking on Task Panes and selecting Shape Data. Data can be entered by clicking on the shape and typing data directly into the Shape Data box that will be displayed.

Profile for CertiKit Limited

EXAMPLE Personal Data Analysis Diagram - VISIO  

EXAMPLE Personal Data Analysis Diagram - VISIO  

Profile for public-it