GDPR Article 30 — Record of personal data processing activities.
| ID | Purpose | Data Categories | Legal Basis | Retention | Recipients |
|---|---|---|---|---|---|
| PA-001 | Service Delivery Core application operations, user account management, and feature access. | Name, Email, Profile picture, Organization membership | Contract (Art. 6(1)(b)) | Until account deletion | Vercel (hosting), Neon (database) |
| PA-002 | Billing & Payments Processing payments, managing subscriptions, generating invoices. | Email, Name, Payment method (via Calmony Pay), Invoice history | Contract (Art. 6(1)(b)) | 7 years (financial records) | Calmony Pay |
| PA-003 | Transactional Email & Notifications Sending account notifications, team invitations, system alerts, and tenant/landlord communications. | Email, Name, Phone number (SMS/WhatsApp) | Contract (Art. 6(1)(b)) | 30 days (email/SMS logs) | Resend (email), Twilio (SMS/WhatsApp) |
| PA-004 | Analytics Tracking usage patterns to improve the service. Only with user consent. | Usage events, Page views, Feature interactions | Consent (Art. 6(1)(a)) | 180 days | None |
| PA-005 | Security & Audit Logging state-changing operations for security monitoring and compliance. | User ID, Action, IP address, Timestamp | Legitimate Interest (Art. 6(1)(f)) | 90 days | None |
| PA-006 | Property & Tenancy Management Managing property details, tenancy terms, landlord/tenant records, compliance documents, and offers. | Landlord/tenant name, Address, Contact details, Financial details, Identity documents | Contract (Art. 6(1)(b)) / Legal Obligation (Art. 6(1)(c)) | Duration of tenancy + 6 years | None |
| PA-007 | Tenant Referencing & AML/KYC Identity verification, credit checks, and anti-money laundering checks for prospective tenants. | Name, Date of birth, Address history, Financial information, Identity documents | Legal Obligation (Art. 6(1)(c)) / Legitimate Interest (Art. 6(1)(f)) | Duration of tenancy + 6 years | Blinc-UK (referencing/AML provider) |
| PA-008 | Error Monitoring Tracking application errors to maintain service reliability. PII scrubbed before transmission. | Error stack traces (PII scrubbed), Browser/device metadata | Legitimate Interest (Art. 6(1)(f)) | 30 days | None |
| PA-009 | Data Subject Requests Processing SARs, correction requests, erasure requests, and complaints under GDPR Articles 15-21. | Requester name, Email, Request details | Legal Obligation (Art. 6(1)(c)) | 3 years from resolution | None |