# Data Subject Categories

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Last Updated:** 2026-03-19
**Organization:** Acme Inc
**Project:** nextjs-saas-example

---

## Overview

This document identifies the categories of individuals (data subjects) whose personal data is processed by this system, as required by GDPR Article 30.

## Data Subject Categories

| Category | Data Types | Legal Basis | Retention |
|----------|-----------|-------------|-----------|
| **End Users / Customers** | Name, email, account credentials, usage data | Contract performance (Art. 6(1)(b)) | Duration of account + 30 days |
| **Paying Customers** | Payment method, billing address, transaction history | Contract performance (Art. 6(1)(b)) | As required by tax law |
| **Website Visitors** | IP address, browser info, cookies, page views | Legitimate interest / Consent (Art. 6(1)(f)/(a)) | 26 months |
| **Support Contacts** | Name, email, support ticket content | Legitimate interest (Art. 6(1)(f)) | 2 years after last contact |

## Review Notes

- Review frequency: Annually
- Last reviewed: 2026-03-19
- Next review: 2027-03-19

## Related Documents

- [Privacy Policy](./PRIVACY_POLICY.md)
- [Record of Processing Activities](./RECORD_OF_PROCESSING_ACTIVITIES.md)
- [Lawful Basis Assessment](./LAWFUL_BASIS_ASSESSMENT.md)

---

*Generated by Codepliant. Review with your DPO before finalizing.*
