E08 Processor review - actions

2026-06-23·customer · 4 segments

What this document established

DPO processor-review actions: EU hosting, Halberd Observability as unnotified fifth sub-processor, 18-month retention from 1 May, item 3 (erasure closure) open.

Messages (oldest first)

message 1 of 4 Katarina Voss 2026-04-09 · cited by ers-dpo-actions

This email originated from outside of RELEX. Be careful of attachments and links from unknown senders. Report suspicious emails using the report button. Marco, Following this afternoon, the four actions as I recorded them. 1. Written confirmation of hosting region and whether it is named in the current agreement. 2. The fifth sub-processor: identity, what they process, where processing occurs, and the transfer mechanism if any of it is outside the EU. Plus why we were not notified. 3. The erasure request made in November: confirmation that it is fully closed, with a list of every location the data was held. 4. A stated retention period for meeting recordings and transcripts, and a position on the existing two years of material. I would like all four within four weeks. Katarina Voss Data Protection Officer Acme Org GmbH | Hansaring 82, 50670 Köln datenschutz@acme-org.example +49 151 4408 2295 Diese E-Mail und etwaige Anhänge sind vertraulich und ausschliesslich für den genannten Empfänger bestimmt. Sollten Sie nicht der richtige Empfänger sein, ist jede Verwendung, Vervielfältigung oder Weitergabe untersagt.
message 2 of 4 Marco Rossi 2026-04-29 · cited by ers-hosting,ers-subprocessor,ers-retention,ers-item3-open

Katarina, Responses to three of four. 1. Hosting is EU West region. It is named in Schedule 2 of the agreement. Extract attached. 2. The fifth sub-processor is Halberd Observability BV, registered in the Netherlands. They process application telemetry and logs. Processing occurs in the Netherlands and Ireland. You were not notified because our notification process only covered sub-processors handling primary customer data, and telemetry was not classified that way. That classification was wrong and we have changed it. 4. Retention period is set at eighteen months from creation, effective 1 May. The existing backlog is being worked through - commitments and decisions extracted into a record, then the underlying transcript deleted. I owe you item 3 and I do not want to send you a partial answer on it. Marco Rossi Account Executive [Image removed by sender] +351 912 447 026 | CET/CEST marco.rossi@relexsolutions.example Rua do Ouro 42, 1100-063 Lisboa relexsolutions.example [Image removed by sender]
message 3 of 4 Katarina Voss 2026-04-30 · cited by ers-extract-warning,ers-item3-open

This email originated from outside of RELEX. Be careful of attachments and links from unknown senders. Report suspicious emails using the report button. Thank you, that is a good response to three. On item 4, I want to register a concern rather than an action. If you extract from a transcript and then delete the transcript, and the extraction has carried across something personal, you have made that permanent and removed the only means of checking. Please think about it before you run the backlog. Item 3 remains open. Katarina Voss Data Protection Officer Acme Org GmbH | Hansaring 82, 50670 Köln datenschutz@acme-org.example +49 151 4408 2295 Diese E-Mail und etwaige Anhänge sind vertraulich und ausschliesslich für den genannten Empfänger bestimmt. Sollten Sie nicht der richtige Empfänger sein, ist jede Verwendung, Vervielfältigung oder Weitergabe untersagt.
message 4 of 4 Katarina Voss 2026-06-23

This email originated from outside of RELEX. Be careful of attachments and links from unknown senders. Report suspicious emails using the report button. Marco, Item 3. Katarina Voss Data Protection Officer Acme Org GmbH | Hansaring 82, 50670 Köln datenschutz@acme-org.example +49 151 4408 2295 Diese E-Mail und etwaige Anhänge sind vertraulich und ausschliesslich für den genannten Empfänger bestimmt. Sollten Sie nicht der richtige Empfänger sein, ist jede Verwendung, Vervielfältigung oder Weitergabe untersagt.

Memory citing this document

ers-dpo-actions — The Acme DPO (Katarina Voss) recorded four actions after the April 2026 review: written confirmation of the hosting region and its naming in the agreement; details of the fifth sub-processor; confirmation that the November erasure request is fully closed with a list of every location; and a stated retention period for meeting recordings and transcripts. All four were wanted within four weeks.
ers-hosting — Acme’s RELEX environment is hosted in the EU (West Europe region), and the region is named in Schedule 2 of the agreement.
ers-subprocessor — A fifth sub-processor existed without notification: Halberd Observability BV (Netherlands) processing application telemetry and logs in the Netherlands and Ireland. Acme was not notified because telemetry was not classified as primary customer data — a classification RELEX called wrong and changed.
ers-retention — Retention for meeting recordings and transcripts was set at eighteen months from creation, effective 1 May 2026; the existing two-year backlog is being worked through by extracting commitments and decisions into a record and then deleting the underlying transcript.
ers-item3-open — DPO action 3 — confirmation that the November erasure request is fully closed, with a list of every location the data was held — remained open at the June 2026 review. Marco Rossi had declined to send a partial answer.
ers-extract-warning — Katarina Voss registered a concern about the extract-then-delete approach: if an extraction carried something personal across and the transcript is then deleted, the personal data has been made permanent while the only means of checking it has been removed.