{"record_type":"controller","version":"2025.1","reviewed_on":"2025-01-15","controller":{"name":"Acme Supplies SRL","address":"Rue de la Loi 100, 1040 Brussels, Belgium","contact_email":"privacy@acme-supplies.eu","dpo":{"name":"Marie Laurent","email":"dpo@acme-supplies.eu","phone":"+32 2 123 45 67"}},"activities":[{"id":"A-01","name":"Employee payroll and HR administration","purposes":["Salary calculation and payment","Social security and tax filings","Leave and absence tracking"],"legal_basis":"legal_obligation","data_subjects":["Employees","Former employees"],"data_categories":["Identification data","Contact details","Employment contract data","Bank account","National registry number","Salary and benefits"],"recipients":["Social security authority (ONSS)","Tax authority (SPF Finances)","Payroll processor (sub-processor)","Pension fund"],"international_transfers":[],"retention_period":"5 years after end of employment (fiscal obligation); 10 years for pension records.","security_measures":["Role-based access control","Encryption at rest (AES-256)","Encrypted transport (TLS 1.3)","Quarterly access reviews"]},{"id":"A-02","name":"Customer order fulfilment","purposes":["Processing purchase orders","Invoicing and payment collection","Delivery logistics"],"legal_basis":"contract","data_subjects":["Customers"],"data_categories":["Company name","Contact person name","Business email and phone","Billing and delivery address","Order and payment history"],"recipients":["Shipping carriers","Accounting software provider (sub-processor)","Payment service provider"],"international_transfers":[{"country":"United Kingdom","safeguard":"Adequacy decision (28 June 2021)"},{"country":"United States","safeguard":"EU-US Data Privacy Framework + SCCs 2021/914 Module 2 as fallback"}],"retention_period":"7 years after the end of the customer relationship (commercial law retention).","security_measures":["Network segmentation","Multi-factor authentication on admin accounts","Daily encrypted backups","Annual penetration testing"]},{"id":"A-03","name":"Marketing newsletter","purposes":["Sending commercial communications to opted-in subscribers"],"legal_basis":"consent","data_subjects":["Subscribers"],"data_categories":["Email address","Name","Preferences","Engagement metrics"],"recipients":["Email marketing platform (sub-processor)"],"international_transfers":[{"country":"United States","safeguard":"EU-US Data Privacy Framework"}],"retention_period":"Until consent is withdrawn, then deletion within 30 days.","security_measures":["Double opt-in confirmation","One-click unsubscribe on every message","Contractual data-processing agreement with provider"]}]}