Records of Processing Activities (ROPA)

1) Introduction and scope

This is Tanqory’s central ROPA to comply with GDPR/UK GDPR Art.30, PDPA SG, and ISO/IEC 27701. It covers both Controller and Processor roles across global operations.
Includes all data processed (digital/physical) by Tanqory and affiliates, activities performed for customers (Merchants), and activities where Tanqory determines purposes.
Read with the Privacy Policy, DPA, Data Classification, Data Retention, PIA/DPIA Policy, and Security Standards; if conflicts arise, follow the stricter/more specific or the most stringent law.
Stored in the PIA/ROPA register with access control and encryption; access logs and reviews at least every 6 months or upon material change.
English is the binding language; translations are for convenience.
New services/projects must create or update a ROPA record before processing real data, unless emergency safety/legal needs.
Material notices/changes will be sent via email/dashboard (durable medium) and logged.
This ROPA serves as evidence of accountability, audit readiness, and for regulator requests.
Contacts: legal@tanqory.com, dpo@tanqory.com, security@tanqory.com.

2) ROPA structure (Controller vs Processor)

Controller ROPA: activities where Tanqory sets purposes (HR/employee, accounting/billing, vendor/supplier, marketing/comms, website/analytics, security/compliance).
Processor ROPA: activities on behalf of Merchants (orders/payments/fulfillment, end-customer data, customer support, inventory/fulfillment, analytics/reporting, integrations/AI services).
Each record must state: purposes, data subject categories, data categories, recipients/recipient types, cross-border transfers (country/mechanism), retention periods, security measures, Sub-processor/processor (if any).
State legal bases (contract/legal obligation/legitimate interests/consent); if special/criminal data, include exceptions/protections.
For transfers, specify SCC/IDTA/BCR or adequacy and summarize DTIA/TRA results.
For children/vulnerable/ADM/AI, reference relevant DPIA/FRIA and human review/appeal measures.
PCI or sensitive data must be labeled Restricted per Data Classification with special controls (e.g., no CVV/full PAN, key management).
Aggregated/de-identified data can be recorded as such, with de-identification method noted.
Use the standard template in Appendix A for creation/update.

3) Creation, update, and review

Start with Screening/PIA/DPIA: every new project/system/feature affecting personal data must complete Screening to decide on ROPA/DPIA and high-risk handling.
Project Owner drafts the ROPA record (Appendix A template) with complete details (purpose/data/rights/transfers/retention/controls) and submits to DPO/Privacy.
DPO/Legal/Security review for completeness and legal basis/transfers/controls; if not approved, fix before go-live.
Update records before material changes (new data categories/recipients/regions/tech/legal basis) and log in change log.
Review at least every 6 months, or sooner after incidents/complaints/audit findings, and post-incident adjustments.
Projects lacking updated ROPA may be paused until complete.
Data Owner/Project Owner with DPO share responsibility for accuracy.
All access/downloads of sensitive ROPA entries are logged for audit.
Significant updates are announced via email/dashboard (durable medium) to stakeholders.

4) Cross-border transfers and Sub-processors

Each record must list destination countries, transfer mechanism (SCC/UK IDTA/BCR/adequacy/consent), recipients, and DTIA/TRA summary per EDPB/ICO guidance.
No transfers to sanctioned/blocked regions unless legally mandated and handled per law.
For enhanced technical measures (encryption in transit/at rest, exporter key control, minimization/pseudonymization), note them in the record.
Recipients/Sub-processors must have DPA/SCC/IDTA or equivalent and delete/return data at end of service.
List Sub-processors/recipient types (cloud, payments, analytics, support, logistics, AI/ML) in each record and reference the latest list in the DPA appendix.
Changes to Sub-processors or new destinations require ROPA updates and stakeholder notices per DPA/Terms.
Sensitive/PCI data must not be transferred to providers without adequate standards; note PCI scope/no CVV/PAN.
Log regulator requests/orders related to transfers and responses for audit.
Enterprise customers may request their records under NDA/confidentiality.

5) Security, retention, and data subject rights

Security: reference Security Standards/ISO 27001/27701; include encryption, access/MFA, logging/DLP, backup/DR, segmentation, secure SDLC, vendor controls.
Retention: reference Data Retention Policy/Order Form/strictest law; record duration/deletion criteria per entry; backups must delete in-cycle and not restore erased data.
Data subject rights: note channels and SLA (intake ≤2 Business Days, updates every 10 days, target closure 30 days) and steps for access/rectify/erase/restrict/port/object/withdraw for each category.
If ADM/AI used: state human review/appeal rights and transparency limits per applicable law.
ROPA/log access is need-to-know; label per Data Classification (typically Internal/Confidential; sensitive detail records are Restricted).
Deletion/return at contract end: specify secure delete/crypto erase and backup-cycle deletion.
Breaches: record notifications/impacts/mitigations in incident records and update ROPA if needed.
Attach or reference relevant PIA/DPIA/DTIA to show agreed measures.
For children/vulnerable groups, state consent/exception and special risk mitigations.

Appendix A: ROPA record template (summary)

• Processing purpose
• Data Subject categories / Data categories (note if special/criminal)
• Legal basis / special category exceptions
• Recipients/recipient types / Sub-processors / destination countries + transfer mechanism (SCC/IDTA/BCR/adequacy)
• Retention / deletion criteria / backup handling
• Key security measures (encryption, access/MFA, logging/DLP, secure SDLC, vendor controls)
• Data subject rights applicable / limitations (ADM/AI human review if any)
• References to DPIA/DTIA/PIA and contract/Order Form IDs
• Created/updated dates, record owner, approver (DPO/Legal/Security as risk-appropriate)
• Change log and links to artefacts (data flow, architecture, contracts)

Change history