Paperwork, already half done

DPIA starter: Vanta

from trust card 3 answers · you answer 6 left

1. What personal data does the tool process, and where?
   from trust card · maker says Its trust centre lists customer and employee personal information, card and health information among the data it may hold.
2. Where does processing happen?
   from trust card · maker says Core data on AWS and MongoDB in the US, EU or Australia; Cloudflare in the US and EU.
3. Who else receives the data (sub-processors)?
   from trust card · maker says Includes AWS (hosting; US, EU or Australia), MongoDB (database; US, EU or Australia), Cloudflare (hosting and delivery; US, EU), Chameleon (in-app notifications; US). Full list on its trust centre.
4. How long is it kept?
   you answer
5. The supplier’s role under UK GDPR
   you answer
6. Why do you need this processing?
   you answer
7. Who are the data subjects?
   you answer
8. Main risks, and what reduces them
   you answer
9. Residual risk after controls
   you answer