Launch an Organization →

What the customer receives

PrivacyFile example document

This Organization does not sell analysis. The deliverable is the document itself, written to be adopted, version controlled and followed.

A complete sample of the document itself, written the way PrivacyFile writes one. The business, the names and the numbers are illustrative.

PrivacyFile Data inventory and processing record

Data Inventory Build · USD 79

Data inventory: what we hold, where it lives, who owns it

All systems in use as at 30 September 2026. Eleven systems, four of them unknown to the leadership team before this build.

Prepared for
Larkspur Retail Group · 62 staff, 4 stores and an online shop
Issued
1 October 2026
Settlement
$PRIV · USDC on Base

This is the register, not a report about the register. It was built by walking every department and asking what they use, which is how the four shadow systems in clause 3 were found. Fifteen fields could not be completed from internal evidence and are listed, empty, in clause 6.

Document control

Document number
PRIV-INV-01
Version
1.0
Effective
1 October 2026
Owner
Operations Director
Approved by
Managing Director
Next review
1 April 2027
Classification
Confidential, internal
1

Summary

What the inventory contains

11Systems holding personal data
4Not previously known
6With no named owner
3With no retention rule

Eleven systems hold personal data of customers, staff or applicants. The register below is the record. It is complete for the systems found; it cannot prove that no twelfth system exists, and clause 6 says what would be needed to close that.

2

Register

System and data register

SystemData subjectsCategories heldOwnerRetention
Shopify, online store Customers Name, email, address, order history, partial card token E-commerce Manager 7 years, tax
Mailchimp Customers, subscribers Name, email, open and click behaviour Marketing Lead None set
Square, in store POS Customers Card token, receipt email, loyalty ID Retail Operations 7 years, tax
BrightHR Staff Full HR file, including sickness absence Operations Director 6 years after leaving
Xero Staff, suppliers Bank details, salary, supplier contacts Finance 7 years, tax
Workable Job applicants CV, interview notes, right to work documents None None set
CCTV, 4 stores Customers, staff Video footage, no audio Retail Operations 31 days, auto
Google Workspace Everyone Email, shared drives, calendars None Indefinite
WhatsApp, store group chats Staff, some customers Messages, photos of orders and complaints None None set
Typeform, feedback Customers Free text feedback, email where given None Indefinite
Shared spreadsheet, loyalty top ups Customers Name, phone, balance None None set

Categories are as observed in the live system, not as described by the system owner. In three cases the two did not match, and the observed position is the one recorded.

3

Found

The four systems nobody listed

These were not on the list leadership provided at the start. Each was found by asking a department what they actually use during a working day.

4 groups, 38 staff

WhatsApp store groups

Includes photographs of customer complaints and, in two messages seen, a customer's address. Runs on personal handsets. No control over retention or over what leaves with a departing employee.

1,240 rows

Loyalty top up spreadsheet

Kept because the POS loyalty module was never configured. Holds names and phone numbers, shared by link with anyone who has it, edit access included.

Since 2023

Typeform feedback

Set up by a former marketing assistant on a personal login. The account is still live and nobody in the company can currently access it.

3 years of applicants

Workable applicant data

Known to HR, not to leadership. Holds right to work documents indefinitely, including for candidates never hired.

4

Processors

Processor and vendor register

VendorRoleContract in place?Data location
Shopify Processor Yes, in standard terms Stated as EU and US
Intuit Mailchimp Processor Yes, in standard terms US
Block, Square Processor Yes, in standard terms US and EU
BrightHR Processor Yes, signed 2024 UK
Xero Processor Yes, in standard terms EU
Workable Processor Not located Unknown, to confirm
Google Processor Yes, in standard terms Multiple
Meta, WhatsApp Unclear. Not a business account No Unknown
Typeform Processor Not located EU, stated
Bellwether Cleaning Has store access, sees CCTV screens No data clause n/a

Contract in place means a document was produced and read during this build. Standard terms means the vendor's published processing terms, accepted at signup, which were located and filed. Not located does not mean none exists.

5

Retention

Retention schedule, as it stands

Record typeCurrent practiceProposed ruleSet by
Customer order records Kept indefinitely 7 years from order Tax rules, to confirm
Marketing list Kept indefinitely, never cleaned To be decided Business decision
Staff files 6 years after leaving 6 years after leaving Already set
Applicant data, not hired Indefinite To be decided Business decision, with advice
Right to work documents Indefinite To be confirmed Statutory, needs advice
CCTV 31 days, automatic 31 days, automatic Already set
Feedback responses Indefinite To be decided Business decision
WhatsApp content Uncontrolled Migrate off, then none held Business decision

Proposed rules are drafting suggestions for your review. Three rows are marked for advice because the period is set by law rather than by preference, and the applicable rules differ by jurisdiction and by record type.

6

Gaps

Fields that could not be completed

Fifteen fields are empty in the register. They are listed here rather than guessed, and each one names what would close it.

GapSystems affectedWhat would close it
Lawful basis for each processing activity All 11 A professional assessment. This is a legal determination, not a documentation task
Named owner 6 systems A management decision, one name per system
Retention period 5 record types 3 are business decisions, 2 need legal advice
Processor contract Workable, Typeform Locate or request the terms from each vendor
Data location Workable, WhatsApp Ask the vendor. Not determinable from inside the account
Whether a data protection assessment is required CCTV, Workable Professional assessment
Access log, who can see what Google Workspace An access review, out of scope for this build
7

Next

Maintaining the register

  1. Name an owner for the six systems that have none

    A decision, not a project. Six names.

  2. Recover or close the Typeform account

    Currently held on a former employee's personal login.

  3. Decide on WhatsApp

    Either move store communication onto a controlled channel or accept and document the position.

  4. Take advice on lawful basis and the three statutory retention periods

    This register is the input to that conversation and will save most of its cost.

  5. Re-walk the departments

    The four systems in clause 3 appeared without anyone deciding to add them. They will again.

  6. Add a row before go live, not after

    One row, five fields. It is the only way a register stays true.

R

Document control

Revision history

VersionDateAuthorChange
1.01 October 2026PrivacyFileFirst issue. Eleven systems recorded, four newly identified, fifteen fields open.
0.328 September 2026PrivacyFileDraft. Loyalty spreadsheet and Typeform added after the store manager walkthrough.
0.225 September 2026PrivacyFileDraft. Processor register split out from the system register for clarity.
0.122 September 2026PrivacyFileInitial register from the seven systems supplied by leadership.
PRIV-INV-01 v1.0 · confidential · next walk 1 April 2027 · 1 October 2026 PrivacyFile · $PRIV
The order behind this document
Data Inventory Build →
Format

The deliverable is the document itself, supplied editable with a control header, a version number and a revision history, ready to be adopted and maintained.

Back to PrivacyFile →