IOA Register of GDPR Information.xlsx

	A	B	C	D
1		Register of GDPR Information		IOA
2
3	Purpose of processing (Why are we processing)	Categories of personal data (What we are processing)	The source of the personal data (Where did we get it from?)	Description of Processing Activity (How we are processing)
4	Attendees and sponsors registration and payment for IOAMoots organised by IOA directly	Identity & Profile (email address, name, organisation, occupation (job title, role, sector), IOA experience, languages spoken, dietary requirements, access requirements), Contact (address, Telegram handle), Party Guest identity and contact (guest name, email & dietary requirements, access requirements), Financial & Transaction (payment details), Marketing and communications, Technical and Usage (IP address, resource access, traffic)	Data subject (You)	Eventsforce events management system - registration, abstract and website management
5	Presentations' admission process run by Event department for IOAMoots organised by IOA directly	(same as above) + personal presentation, summary of applicable presentations	Data subject (You)	Personal data of presentations submitted for IOAMoots by presenters and published on IOA.com/events
6	Sending notifications to IOAMoots attendees that have downloaded the IOAMoot application for the conference	Identity, contact details (name, surname and email), financial, transaction, marketing and communications	Data subject (You)	Personal data of Moot participants that download the Eventsforce IOAMoot Global mobile application
7	MOOC participants information	Identity & profile (name, email, city, country, timezone, description, photo - Gravatar or manual upload, additional names, interests, institution, department, phone, address, Twitter, LinkedIn, FaceBook, Google+, ICQ number, Skype ID, AIM ID, Yahoo ID, MSN ID, Web page), activity and contribution, course results, IP address	Data subject (You)	Learn IOA https://learn.IOA.org
8	IOA Educator Certification program and facilitator training	Identity & profile (name, email, city, country, timezone, description, photo - Gravatar or manual upload, additional names, interests, institution, department, phone, address, Twitter, LinkedIn, FaceBook, Google+, ICQ number, Skype ID, Yahoo ID, Web page), activity and contribution, course results, IP address	Data subject (You) and IOA Partner that enrols data subject	IOA Educator Certificate (MEC) program - https://education.IOA. com/login/index.php
9	Course hosting service	Identity & profile (name, email, city, country, timezone, description, photo - Gravatar or manual upload, additional names, interests, institution, department, phone, address, Twitter, LinkedIn, FaceBook, Google+, ICQ number, Skype ID, Yahoo ID, Web page), activity and contribution, course results, IP address, Chargebee payments (customer id, invoice number, transaction number), payments (amount, currency, payment gateway - Chargebee)	Data subject (You)	IOA Academy https://IOA. academy
10	User registration	Display name, email address, location, avatar, header image Optional inclusion: workplace, origin, political opinions, religious beliefs, gender, sexuality, accessibility requirements	Data subject (You)	Registration details
11	Describing communities, collections, or shared resources	Descriptions, language, metadata Optional inclusion: interests, occupation, location, workplace, location, origin, political opinions, religious beliefs, gender, sexuality, accessibility requirements	Data subject (You)	Resource metadata
12	Ensuring the service is accessible to all users	Optional inclusion: accessibility requirements	Data subject (You)	Accessibility
13	Sharing created courses with other IOA users worldwide	Personal data for course creators	Data subject (You)	IOA.Net
14	Sending e-newsletters, leads to Partners	Name, email, phone number, country of subscribers, organisation name, organisation type, department	Data subject (You)	Personal data on IOA.com (all contact forms) - https://IOA. com/contact/
15	Sending newsletters	Contact details (name, surname and email)	Data subject (You)	MailChimp marketing email
16	Nurture EDM's	Contact details (name, surname and email), job title, phone, country, organisation name	Data subject (You)	Salesforce marketing automation solution (Pardot)
17	Project management tool	Contact details (name, surname and email), phone number, country, organisation name, department	Site admin	Project management using Notion
18	Automation form for sending contact details to the relevant database	Contact details (name, surname and email)	Data subject (You)	Workflow automation provided by Zapier
19	Google Analytics is used to measure pageviews on all IOA websites and solely for statistical purposes on an aggregated basis	User’s IP address, geographical location and browser information	Data subject (You)	Google Analytics
20		Register of GDPR Information
21
22	Purpose of processing (Why are we processing)	Categories of personal data (What we are processing)	The source of the personal data (Where did we get it from?)	Description of Processing Activity (How we are processing)
23	Create a IOACloud site	Contact details (name, surname and email), location, telephone number (optional)	Data subject (You, the IOACloud site admin)	Customer signing up to IOACloud
24	Process payments for initial subscriptions, upgrades and renewal	Contact details (name, surname and email), billing country, email (if using Paypal), payment method details	Data subject (You, the IOACloud site admin)	Payment processing
25	Manage subscriptions and renewals, calculate and report on required taxes	Contact details (name, surname and email), billing country	Data subject (You, the IOACloud site admin)	Subscription management and tax calculations
26	Warn IOACloud site owners of impending automatic subscription processing (renewal, cancellation, etc.)	Contact details (name, surname), email address (if using Paypal) and other payment method details (but excluding credit card number and CCV)	Data subject (You, the IOACloud site admin)	Subscription event processing
27	Sending emails to IOACloud admins regarding the IOACloud service	Contact details (name, surname and email), financial data	Data subject (You, the IOACloud site admin)	Emails sent by IOACloud
28	Infrastructure and product monitoring	Country, website URL	Data subject (You, the IOACloud site admin)	Internal dashboards
29	Monitoring and troubleshooting IOACloud sites and infrastructure	Location, IP address, contact details (name, surname and email), country, IOA activity data	IOACloud site admins and IOACloud site users	Log aggregation and analysis from LogsHero Ltd.
30	Operational reporting on IOACloud servers and sites	Location, IP address, IOA activity data when error occur	Data subject (You, the IOACloud site admin)	System monitoring and performance analysis from NewRelic Inc.
31	Messaging between IOACloud site users	Contact details (name, surname and email)	IOACloud site admins, IOACloud site users	Email sent from IOACloud sites
32	Conversion of assignments from various formats, as part of expected service	Any personal information submitted within assignments (including contact details (name, surname and email), address, phone number, photographs (if provided)).	IOACloud site admins, IOACloud site users	Document conversion for IOA's Assignment module
33	Offer web conferencing features to IOACloud site users	Any personal information submitted within assignments including contact details (name, surname and email), any data submitted during the session	IOACloud site users	Web conferencing and whiteboard from Blindside (Big Blue Button)
34	Keep IOACloud sites users data (eg. files) safe and available for later use	Any personal information submitted within the site or course (including contact details (name, surname and email), address, phone number, photographs (if provided)).	IOACloud site admins, IOACloud site users	Storage of IOACloud sites' data
35	Hosting client sites and storing data	User details	Data subject (You)	Amazon AWS
36	Calendar scheduling tool	Contact details (name, surname, email, phone number)	Data subject (You)	Scheduling using Calendly software platform
37	Authentication and authorisation software	Login session, IP address, user-agent, and the web application name and website address	Data subject (You)	Authentication and authorisation using Okta
38	Payment gateway	Names, addresses, and websites of Customers and potential customers; an itemised list of all invoices sent to Customers (whether subsequently paid and unpaid), including invoice number, amounts and itemised details with the value of each IOA Service type identified; contracts, bid documents and electronic communications relating to all work proposed or done for all Customers; and any and all documents and correspondence evidencing the software and services provided to Customers	Data subject (You)	Payments via PayPal
39	Site management	Performance details of webpage load time, User agent of the browser,IP address, Unique ID generated for the user, User session details	Data subject (You), system records	Monitoring using Site24x7
40	Payment gateway	Names, addresses, and websites of Customers and potential customers; an itemised list of all invoices sent to Customers (whether subsequently paid and unpaid), including invoice number, amounts and itemised details with the value of each IOA Service type identified; contracts, bid documents and electronic communications relating to all work proposed or done for all Customers; and any and all documents and correspondence evidencing the software and services provided to Customers	Data subject (You)	Payments via Stripe
41	Project management	Name and job title, business address, business telephone number, email, IP-address, location data	Data subject (You)	Teamwork to run projects
42	Time tracking	Contact details (name, surname, email, phone number), IP addresses	Data subject (You)	Toggl time tracking software
43	Provide support	Contact details (name, surname and email), phone number, country, organisation type, organisation name, industry, IOACloud or IOA US site url	Data subject (You)	FreshDesk (Freshworks Inc) helpdesk software
44		Register of GDPR Information
45
46	Purpose of processing (Why are we processing)	Categories of personal data (What we are processing)	The source of the personal data (Where did we get it from?)	Description of Processing Activity (How we are processing)
47	Provide engineers with information to process escalated requests	Contact details (name, surname and email), phone number, country, organisation type, organisation name, industry, IOACloud or IOA US site url	Data subject (You)	Issue tracking powered by Tracker (JIRA)
48	Answer sales enquiries and pass on indirect leads to Partners	Contact details (name, surname and email), phone number, address, country, organisation type, organisation name, industry, job title, site url, number of employees	Data subject (You)	Customer relationship management tool Salesforce, messages sent via Slack
49	Facilitating the signup and control of the IOA Apps Plans Portal account	Contact details (name, surname and email), location, telephone number	IOA Apps Plans Portal site admins (Data controller)	Customer signup
50	Manage recurring subscriptions and payments	Contact details (name, surname and email), country	IOA Apps Plans Portal site admins	Braintree Payment and subscription management (Paypal service)
51	Manage recurring subscriptions and payments	Contact details (name, surname and email), billing country, website name	IOA Apps Plans Portal site users	Chargebee subscription billing and revenue management platform
52	Clients and subscription management in company's Google Workspace information systems	Contact details (name, surname and email), billing country, website name, test username and password, certificates	Branded IOA App and IOA Apps Plans Portal site users	Google Workspace
53	Project management	Contact details (name, surname and email)	Branded IOA App users	Basecamp - Project Management
54	Sending push notifications to mobile app users	Email	Branded IOA App and IOA Apps Plans Portal site users	Airnotifier application server for sending push notifications
55	Compliance with IOA Partner Certification Agreement	Name, address, email, phone number	Data subject (You) and data subject employer	User profile contact details
56	Access to Partner data on IOA Partner site	User and activity data	Data subject (You) and data subject employer	IOA Partner activity on Partner portal
57	Partner marketing	Partners' client details, Partner details	Data subject (You), data subject employer, Partner organisation	Case study upload
58	Partner meetings	Name, voice recording, video/photograph of user	Data subject (You) and data subject employer	Zoom meeting recordings
59	Partner organisation profile on IOA Partner portal	User details, Partner organisation details	IOA Partner	IOA Partner staff on company profile
60	IOA client customer financial data from Partners	Client details, Partner details	IOA Partner	Partner ́s client data
61	IOA client customer financial data from Partners	Client financial information, Partner details	IOA Partner	Invoice data of Partner's clients
62	Writing and storage of agreements/contracts/documentation with Partners, and potential Partners	Contact details (name, surname, email, phone number), financial records, staff records	IOA Partner/Applicant	IOA Partner documentation and agreements
63	General business documentation of meetings including attendees	Partner organisation details, Partner details, Partner employees	Data controller	IOA Partner meeting notes
64	General business documentation	Partner organisation details, Partner details	Data controller	Commercialisation development and Partnerships program
65	Partner billing, record keeping and communications	HQ authentication information, contact details (name, surname, email, phone number), IOA Partner contact details, client statistics & invoicing	Data subject (You)	IOA Partners portal
66	Home page for IOA User Association	Profile data of users	Data subject (You)	IOAAssociation Site https: //IOAassociation.org/
67	Data collection for applications to be part of the Partner Network	Contact details (name, surname, email, phone number), services and corporate info of applicants	Data subject (You)	Partner Applications Site https: //IOA.com/become-IOA- partner/
68		Register of GDPR Information
69
70	Purpose of processing (Why are we processing)	Categories of personal data (What we are processing)	The source of the personal data (Where did we get it from?)	Description of Processing Activity (How we are processing)
71	Business development statistics generation	HQ authentication information, contact details (name, surname, email, phone number), IOA Partner contact details, client statistics & invoicing	Website records	Gaining insights via the Tableau server
72	Central code repository	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	git.IOA.org - Hosted by IOA
73	Community education and feedback	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	https://IOA.org/mod/forum/ - Hosted by IOA
74	Mirror of central code repository	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	https://github.com/IOA/IOA - Hosted by 3rd party
75	Public IOA code repository	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	github.com - Hosted by 3rd party
76	Private IOA code repository	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	gitlab.com - Hosted by 3rd party
77	Developer code repository	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	Local git repositories on dev machines
78	Sharing of rapid prototypes, research artefacts, usability testing feedback	Contact details (name, surname, email, phone number), activity, contribution	Employee/contractor	An online whiteboard and productivity platform powered by Invision.
79	Conduct user studies, interviews, and surveys	Contact details, activity (name, surname, email, phone number), contribution	Employee/contractor	Optimal Workshop for research on user experience
80	Conduct user surveys, Mobile - support for Airnotifier sites	Contact details (name, surname, email, phone number), form entries	Data subject (You)	Survey administration powered by Google Forms
81	Scheduler for usability testing & user interviews	Contact details (name, surname, email, phone number), schedules, location data	Data subject (You)	Scheduling using Calendly software platform
82	Host the usability tests and user interview recordings	Contact details (name, surname, email, phone number), biometric data including pictures video and voice recording	Data subject (You)	Youtube
83	Community engagement & recruitment for user studies	Name, surname, email, phone number, address, health records, biometric, IP Address, document contents, email contents, usage records	Data subject (You)	Messages sent via Slack
84	Community engagement & recruitment for user studies	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	IOAAssociation.org
85	Mobile - training in IOAMoots	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	MOBILE IOAcloud demo site - Hosted by IOA in IOACloud
86	Demo most recent version of software to the public	IP addresses and other data may end up in logs, IOA will also display IP data in internal logs which is publically available	Data subject (You)	QA and Demo sites
87	Testing accessibility features in IOA	Login and other personal profile information	Data subject (You)	Accessibility IOA Site https://docs.IOA. org/311/en/Accessibility
88	Register of research related to IOA	Published research documents, login details and profile	Data subject (You)	IOA research site https://research.IOA.org
89	Testing of software	Any non-anonymised data from production instances for testing	Data subject (You)	IOA staging sites
90	Ongoing testing of software	Logins for staff, possible other data as test cases	Data subject (You)	CI servers for development
91	Distribution of software	Source code with names in it and IOA profiles for staff and contractors	Data subject (You)	Download IOA site
92	Allowing security researchers access to an isolated instance for testing purposes	IP address in logs, any user profile details entered by the user (eg email), if they set up custom users instead of using the provided ones	Data subject (You)	Security testing IOA instance https://sectesting.IOA.com (also https://bugcrowd.IOA.com is an alias for the same site).
93	Use the image made public by a user on Gravatar	Image/picture of user (biometric)	Data subject (You)	Gravatar on all IOA Community sites
94		Register of GDPR Information
95
96	Purpose of processing (Why are we processing)	Categories of personal data (What we are processing)	The source of the personal data (Where did we get it from?)	Description of Processing Activity (How we are processing)
97	Public site spam prevention	User contributed content (forum posts)	Data subject (You)	Akismet anti spam (IOA.org + Academy)
98	Registration of websites using IOA and IOA services	Website URL, name and IT admin email address	Data subject (You)	Registration of websites on https: //stats.IOA.org/
99	Legacy IOA sites	Login information	Data subject (You)	Legacy sites (SMEC2001 Survey learning)
100	Language translations for IOA	Contact details (name, surname, email, photo), activity and contribution	Data subject (You)	Language translation IOA site (lang.IOA.org)