{"controller":{"name":"Acme Supplies SRL","dpo_email":"dpo@acme-supplies.eu"},"version":"2025.1","effective_date":"2025-02-01","next_review":"2026-02-01","entries":[{"data_category":"Customer account profile","purpose":"Authentication, order fulfilment, customer support","legal_basis":"contract","retention_period":"Duration of relationship + 7 years","retention_criterion":"From end of last active contract.","legal_source":"BE Code of Commercial Law — general commercial retention (7 years).","deletion_method":"Hard delete from production DB; anonymisation of historical order records.","owner":"Head of Engineering","systems":["users table (Postgres)","customers table (Postgres)"]},{"data_category":"Order and invoice records","purpose":"Fulfilment, accounting, tax reporting","legal_basis":"legal_obligation","retention_period":"7 years","retention_criterion":"From close of fiscal year in which the order was placed.","legal_source":"BE VAT Code art. 60 §4 — 7-year retention of invoices.","deletion_method":"Automated purge job on 1 February each year; PDFs removed from archive storage.","owner":"Head of Finance","systems":["Accounting software","Archive S3 bucket"]},{"data_category":"Payroll records","purpose":"Salary calculation, social security, tax compliance","legal_basis":"legal_obligation","retention_period":"5 years (fiscal) / 10 years (pension)","retention_criterion":"From end of employment relationship.","legal_source":"BE Income Tax Code art. 315; social security retention rules.","deletion_method":"Hard delete from HRIS; pension records migrated to long-term archive.","owner":"Head of People","systems":["HRIS","Pension fund portal export archive"]},{"data_category":"Marketing consent and engagement metrics","purpose":"Newsletter delivery and effectiveness measurement","legal_basis":"consent","retention_period":"Until consent withdrawn + 30 days","retention_criterion":"Withdrawal event; 30-day buffer to allow deletion to propagate through batch jobs.","deletion_method":"Hard delete from mailing tool; anonymisation in warehouse tables.","owner":"Head of Marketing","systems":["Mailjet","Analytics warehouse"]},{"data_category":"Support ticket history","purpose":"Customer support, service improvement","legal_basis":"contract","retention_period":"24 months","retention_criterion":"From ticket closure date.","deletion_method":"Automated rolling purge; attachments scrubbed from object storage simultaneously.","owner":"Head of Customer Success","systems":["Helpdesk tool","Object storage bucket"]},{"data_category":"Website analytics","purpose":"Understanding site usage","legal_basis":"consent","retention_period":"12 months rolling","retention_criterion":"Rolling window from collection.","deletion_method":"Automatic truncation by analytics provider.","owner":"Head of Marketing","systems":["Plausible (EU-hosted)"]},{"data_category":"Fraud detection signals","purpose":"Transaction risk scoring","legal_basis":"legitimate_interests","retention_period":"24 months","retention_criterion":"Rolling window from collection.","deletion_method":"Automatic truncation in fraud provider console; summary statistics retained.","owner":"Head of Finance","systems":["Fraud detection provider"]}],"review_cycle":"Annual, or sooner if a change in processing activity warrants.","approved_by":{"name":"Marie Laurent","title":"Data Protection Officer","date":"2025-02-01"}}