This feature indicates whether a field contains personal data and includes a processing description.

This allows for quick differentiation between personal and non-personal data fields, enabling both internal and external users to view the description. The addition of an indicator simplifies the process of ensuring that all personal data fields are accounted for during the erasure of personal data, policy additions, pseudonymization, or during searches and reporting.

• (5)(2) Accountability

This feature enables the organization of collected data into categories such as Contact Data, Financial Data, Highly Sensitive Data, etc.

This categorization allows for the customization of specific security and data retention policies tailored to various data classes. You may apply multiple policies to a single category.

• (30)(1)(e) Categories of Personal Data
• (25)(2) Technical and Organisational Measures; demonstration of purpose

• (5)(1)(e) Storage Limitation
• (5)(1)(b) Purpose Limitation

A data security policy outlines who is permitted to view and/or modify data within this category in the system.

Security policies support SmartSimple's role-based security. We can configure these policies to assist in achieving the principles of purpose limitation and integrity and confidentiality by ensuring that only individuals requiring access for legitimate, specified purposes are granted permission.

• (5)(1)(b) Purpose Limitation
• (5)(1)(f) Integrity and Confidentiality

Pseudonymization enables the masking of personal data fields, rendering the retained data unidentifiable.

This approach allows for a nuanced method of data management. Deleting an entire profile and all associated data is often unnecessary and can lead to gaps in reports. By utilizing pseudonymization, you can render specific fields unidentifiable, thus preserving the integrity of long-term reporting while adhering to data retention obligations.

• (5)(1)(e) Storage Limitation
• (5)(1)(f) Integrity and Confidentiality
• (5)(1)(b) Purpose Limitation

It is imperative that the end user comprehends why and how their personal data will be processed to facilitate informed consent.

The Personal Data Field Indicator allows you to designate any field that contains personal information and provide a description of the intended uses of that field.

When the user accesses any page within the system that utilizes personal information fields, they can view all explanations you have provided. On their profile, users can see a list of personal data fields that you maintain about them.

This feature is automatically available in every instance of SmartSimple.

• Informed consent
• Data subject's right to transparent information
• Information to be provided where data is collected from the data subject
• Right of access

Following the establishment of a policy internally, you can enforce compliance by requiring users to agree to it upon login. The policy can be set as mandatory, ensuring that users who do not accept it will be unable to access the system or input personal information.

Multiple policies can be implemented, and they can be enforced either once or at specified intervals. Upon acceptance of a policy, the system generates a PDF of the acceptance complete with a time/date stamp, creating a fully auditable consent collection process.

• (7)(1) informed consent, demonstration of consent
• (2) Accountability

The Cookie Policy feature notifies users regarding the use of cookies within the SmartSimple application. Users landing on the login page will be alerted and required to consent to the use of cookies.

Additionally, we have provided a policy template that you can utilize to formulate your own cookie usage policy within your Privacy and Security Policies.

• Informed consent

The personal data erasure feature is employed to comply with requests for the deletion of user data. This feature can be activated on UTA Level 2 types as an individual's data erasure request.

Within this Level 2 framework, an administrator can review these requests and will have the option to delete the user profile of the Level 2 owner.

A certificate of data erasure is subsequently generated to document this activity.

• Rights of the data subject

• Obligations of the controller
• Rights of the data subject

Article 5 of GDPR: Principles relating to the processing of personal data

1. Personal data shall be:

b) collected for specific, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific, or historical research purposes, or statistical purposes shall, in accordance with Article 89(1), not be considered incompatible with the initial purposes ('purpose limitation').

Article 5 of GDPR: Principles relating to the processing of personal data

1. Personal data shall be:

e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Article 5 of GDPR: Principles relating to the processing of personal data

1. Personal data shall be:

f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures ('integrity and confidentiality').

Article 5 of GDPR: Principles relating to the processing of personal data

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability').

Article 7 of GDPR: Conditions for consent

1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing of his or her personal data.

Article 25 of GDPR: Data protection by design and by default

2. The controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data which are necessary for each specific purpose of processing are processed.

This obligation applies to:

• the amount of personal data collected
• the extent of their processing
• the period of their storage
• their accessibility.

In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

Article 30 of GDPR: Records of processing activities

1. Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:

e) where applicable, transfers of personal data to a third country or an international organization, including the identification of that third country or international organization and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards.

Article 89 of GDPR: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

1.¹ Processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject.

² Such safeguards shall ensure that technical and organizational measures are in place, particularly to ensure respect for the principle of data minimization.

³ These measures may include pseudonymization provided that those purposes can be fulfilled in that manner.

⁴ Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.