Records of processing activities (ROPA, GDPR Article 30)

Ref: https://www.gdprregister.eu/gdpr/records-of-processing-activities/

Article 30 of the EU General Data Protection Regulation (GDPR) requires organisations to maintain internal records, which contain the information of all personal data processing activities carried out by the organisation. These records help organisations understand what personal data they collect, where it comes from and how that data is being processed.

Context: who needs to document the records of processing activities?

Article 30 GDPR stipulates that all records of processing activities have to be maintained by organisations employing more than 250 employees. Smaller organisations only need to document processing activities that:

• are not occasional (e.g., are more than just a one-off occurrence or something you do rarely); or

• are likely to result in a risk to the rights and freedoms of individuals (e.g., something that might be intrusive or adversely affect individuals); or

• involve special category data or criminal conviction and offence data (as defined by Articles 9 and 10 of the GDPR).

Processing Activities

JEMHC uses secure transport (SSL/TLS) for secure point to point transfers for connections to customer mailservers, Jira instances and 3rd party integrations the customer configures. The Plugin People development/support environments are encrypted at rest.

The following are the key activities The Plugin People perform where we can come into contact with data relating to your instance:

Providing the JEMHC service (processing inbound mail or sending outbound mail)

We provide the JEMHC tools as a Processor service, customers configure it for two core cases: (a) retrieve email from mailboxes they control to create issues in a Jira system they control (b) send data from the Jira system the control through mailboxes they control. JEMHC supports mailservers with secure transport.

The Plugin People Ltd do not use, scan, share or disseminate customer email content other than for the provision of the features available to the customer through JEMHC (eg Auditing retains a copy of inbound and outbound mail - customer can opt out of this functionality at the risk of data-loss in no-processing scenarios).

In failure scenarios, the customer are notified about the problem with a link to the audit mail. In problem scenarios where auditing is opted-out, the problem mail (in full) is attached to avoid data loss. This mail is sent through the customer controlled mailbox to “Forward” recipients the customer configures in JEMHC Profiles.

Providing per-customer telemetry/notifications via Instant Messages and SMS

Customers may configure a variety of telemetry integrations, e.g. Slack/Telegram to communicate current processing, where PII data (email addresses may be shown), SMS to customer entered phone# can also be used for alerting purposes.

Providing Support : Help with inbound mail problems

During the provision of support of JEMHC customer through our support portal we may ask for supporting information that could contain Personally Identifiable Information (PII):

a) Customer may send a mail to one of our support staffs actual email (eg to/cc)

b) Customer may ‘flag’ an inbound message within JEMHC that causes data related it that messages processing to become available to support staff:

• the email in raw full TEXT form

• the JEMHC processing report for that email

• the JEMHC configuration Profile, that may contain email addresses

When providing such mail, it will expose low level data like IP addresses, PII relating to recipients and potential PII from content and/or attachments.

e) Customer may provide Screenshots of live Jira issues or error messages, or on screen log output that may expose a variety of data/PII.

Providing Support : Help with outbound mail problems

During the provision of support of JEMHC customer through our support portal, customer may attach:

a) copies of outbound mail that JEMHC retains as part of auditing, such mail would contain data from the Jira instance as well as PII of the recipient.

b) the JEMHC Auditing Event (Webhook) that is the topic of the support query. Webhooks contain a lot of issue-specific data, comments etc.

System Support: Monitoring System Operation

The Plugin People have named support staff have access to our JEMHC monitoring app from which we can see customer billing contact info, high level Capacity Plan usage, DataPack purchases etc. There is no access to customer configurations, data, or instance issues.

System logging exposes per instance processing traffic, we see customers hitting nominated mail servers with outcomes. These logs are transitory and typically removed every month or two due to finite storage space. JEMHC logs do not output email content deliberately in clear, the subject may be hashed for visual tracking only. Various error conditions and responses from customer mail servers are repeated verbatim in our logs, that will allow us to assist with related support queries.

System Admin: BCC copies of system notifications

The Plugin People have named system admins that receive BCC copies of JEMHC system generated email notifications (an opt-out for this usage is planned ashttps://thepluginpeople.atlassian.net/browse/JEMHC-3790 )

Monthly usage notifications

This to enables to validate those recipients actually get notifications. When noticed, we can inject a message into JEMHC to alert JEMHC admins when recipients they have configured cause non-delivery email responses from receiving mail servers.

Capacity Plan consumption

Sometimes a customers JEMHC Plan Allocations can be used up that results in stoppage of further processing. JEMHC will notify recipients set in JEMHC > Licensing > System Notifications, with an explanation. Billing staff here receive a CC: of such notifications, such that we can reach out pro-actively to offer advice and assistance in getting more capacity, to minimise time that the customer is impacted.

ROPA Grid

The following is a grid of processing activities relating to JEMHC:

• https://gdpr-info.eu/art-6-gdpr/

• Article 6(1)b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

• Article 6(1)c - processing is necessary for compliance with a legal obligation to which the controller is subject;