Data, Legal Bases and Documents

The starting point is a list of data and processing operations. A customer's name and phone number, a representative's passport details, employee data, video recordings and communication history are used differently and require different legal bases, retention periods and access levels.

UBC specialists will identify what data the company collects, where it comes from, why it is used, where it is stored and to whom it is disclosed. They then compare that process with agreements, website forms, CRM settings and employee responsibilities.

If the company works with foreign customers, cloud services or a group of companies, international transfers and requirements of other jurisdictions are analysed separately for the specific structure.

Depending on the business activity, the review may cover:

• website forms, questionnaires, agreements and notices;
• data relating to customers, employees, candidates and counterparty representatives;
• purposes and legal bases of processing;
• employee access and allocation of responsibility;
• storage of paper and electronic documents;
• disclosure to accountants, CRM providers, hosting providers, delivery services and other suppliers;
• the procedure for responding to requests from individuals;
• actions following misdirected information, loss of access or another incident.

The audit result shows which documents already work, what needs updating and which technical or organisational measures should be agreed with responsible employees.

A website visitor should understand what information they provide and why. UBC specialists will prepare or review the privacy policy, consent wording, notices for forms and cookie terms where cookies are used.

For agreements with customers and partners, the roles of the parties, data categories, transfer purpose, security measures and interaction procedure for requests or incidents are defined. The wording should reflect the actual data exchange rather than describe services the company does not use.

If a form sends data through an external provider, this is reflected in the documents and access settings.

Employees need simple answers to four questions: what data they may obtain, where to store it, to whom it may be disclosed and when it should be deleted or archived. UBC can prepare policies, instructions, confidentiality undertakings, access rules and request-handling forms.

In HR processes, candidate questionnaires, personnel files, payroll documents and manager access are reviewed separately. For sales and support, the review covers CRM systems, call recordings, mailing lists and communication history.

UBC specialists align the legal part with the way access, backups and contractors are organised. An information-security specialist can be involved where necessary.

Access, Suppliers and Requests

CRM, hosting, cloud accounting, mailing systems, telephony and delivery services receive different data sets. Before engaging a provider, the company should determine what data it genuinely needs, where the data will be stored, who receives access and how information will be returned or removed when the agreement ends.

UBC specialists review the contractual terms and allocate the parties' responsibilities. Within the company, an employee is appointed who knows the supplier list and can quickly contact them if a customer request or technical event occurs.

An incident requires a short working procedure. The employee records the time and circumstances, preserves technical information, limits further access and informs the responsible person. The company then determines which data are affected, the persons concerned, any required notifications and measures needed to restore normal operations.

UBC can prepare an incident-record form, contact list and communication templates. Legal assessment is based on the actual circumstances and applicable requirements. After completion, the causes and measures taken are included in a final document used to improve access, instructions and supplier agreements.

The company should be able to locate information about a specific person and understand where it came from, why it is used and to whom it was disclosed. UBC specialists will prepare a process for receiving a request, confirming the applicant's identity, finding information across departments and approving the response. The responsible employee receives a form for collecting data from marketing, HR, accounting and IT without unnecessary correspondence.

If a request concerns correction, deletion or stopping a particular processing activity, the decision takes account of the purpose of processing and mandatory document-retention periods. If a record must be retained, its use for other purposes can be restricted and the action taken explained to the applicant.

For a corporate customer, it is useful to prepare a description of security measures and party roles in advance. This speeds up contract negotiation: the commercial team answers questions from the prepared package, while non-standard requirements are referred to the lawyer and information-security specialist.

You receive a description of the principal processing activities, a list of required changes and a document package for customers, employees and suppliers. The company can use data under an agreed process and respond more quickly to requests from partners and corporate customers.

The fee depends on the number of processes, websites, systems, divisions and contractors, and whether international analysis is required. After the initial questionnaire, UBC specialists define the scope and agree the fee.

Organisation of Data Protection and Result

Send the website forms, customer agreements, HR documents, a list of information systems and contractors that receive data. Identify responsible persons and any known user requests. UBC specialists will map the data-processing activities, define priorities and prepare the documents in an order convenient for implementation.

For each process, the record states what data the company receives, from whom, for what purpose, in which system it is stored and to whom it is disclosed. The website, CRM, HR documents, mailing systems, payment services and contractors are identified separately. The responsible employee confirms access rights and the period after which information is deleted or archived.

Based on the data-flow description, documents are prepared for customers and employees, supplier terms are agreed and an internal request-handling procedure is established. When a new service is introduced, its role and contractual terms are reviewed before data are transferred. Management receives a clear register and can control changes without repeating a full-company audit.