Drawing is Free - GDPR checklist


1	Name	Data Type	Purpose	Storage Location	Duration
2	Email	Email addresses, names, contact details, commercially sensitive information, personal information	Operate business, respond to requests, communication with clients and suppliers	Local devices, Cargo and Google Servers	Kept indefinitely subject to deletion requests, reviewed quarterly, archived after 5 years. Sensitive data sent by email deleted no later than 3 months after receipt.
3	Website content	Images and video of attendees at events, email addresses, names, contact details, financial information	Operate business, marketing/publicity, lead generation	Cargo remote servers, copies of content held locally	Kept indefinitely subject to deletion requests, reviewed quarterly.
4	Patreon Content	Includes written updates, instructional PDFs, videos of zoom calls held behind passwords	Operate business, collecting payments, tailoring content to paid members	Patreon remote servers	Kept indefinitely subject to deletion requests, customers are able to manage data / unsubscribe at will through Patreon
5	Photographs of Workshops	Pictures of identifiable individuals	Documentary record of events, use in publicity on website	Locally on Laptop HDD, Backup	Kept indefinitely subject to deletion requests, reviewed quarterly.
6	Contact Details	Names, emails, phone numbers, addresses	To organise workshops and give out information to attendees, providing service	Locally on Laptop HDD, in email, on mobile contacts app, on exchange server	1. individual contacts - kept indefinitely subject to deletion requests, reviewed quarterly 2. Client programme attendees These are deleted 3 months after completion
7	Community contributed content	Images, video, comments and notes	To share work with the community, to enable people to see each other's artwork, to comment on and support each other, to grow the community	Remotely in Padlet, Patreon, Instagram, Featured on website, used in PDF publications	Indefinitely
8	Website - Analytics	Hashed IP Address, links clicked, device profiles (browser, screen resolution)	to monitor effectiveness of website	Remotely in Cargo, TinyAnalytics	Aggregate anonymised data stored according to analytics platform policy. TinyAnalytics is automatically anonymised after 24h
9	Social Media - LinkedIn, twitter, instagram, Facebook	Email addresses, names, contact details, social usernames	Shared as part of mutual 'follow / following', used so interested parties can receive notification of news and updates	Remotely on platform's servers	According to Platform; likely to be indefinite as individuals control their own data/accounts
10	Financial and accounting Data (eg Xero)	Email addresses, names, contact details, commercially sensitive information	Business and financial operations - sending and recieveing invoices and payment	Remotely on platform's servers. Invoices sent from system by email	Financial details kept for 5 years in accordance with regulations
11	Recordings of Meetings (Video, Audio)	video of meetings	Reference - to allow non-attendees to catch up. May be published to Vimeo behind a password	Laptop, Remotely on Zoom Servers, Remotely on Vimeo, Remotely on YouTube	Indefinitely (for public-facing archives)
12	Survey Research Data	Names, emails, financial data, possible personal data / sensitive data according to research topics	Understanding needs, reporting on impact for grant applications etc	Remotely on survey service servers, copies held locally on laptop	Until themes recorded and written up, no longer than 6 months
13	Notes - Interviews and meetings	Unstructured notes from discussions. Names, possible personal data / sensitive data?	Reference, Understanding needs, writing research reports	Filing cabinet	Until notebooks disposed of
14	Collaborative Documents	Unstructured data, documents	Sharing information, knowledge sharing	Remotely on platform's servers, copies held locally on laptop	Three years then review (reminder set) Sharing permissions reviewed quarterly