> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last Updated: 2026-03-19

Organization: Acme Inc

Project: nextjs-saas-example

## Overview

This document identifies the categories of individuals (data subjects) whose personal data is processed by this system, as required by GDPR Article 30.

## Data Subject Categories

Category | Data Types | Legal Basis | Retention
--- | --- | --- | ---
End Users / Customers | Name, email, account credentials, usage data | Contract performance (Art. 6(1)(b)) | Duration of account + 30 days
Paying Customers | Payment method, billing address, transaction history | Contract performance (Art. 6(1)(b)) | As required by tax law
Website Visitors | IP address, browser info, cookies, page views | Legitimate interest / Consent (Art. 6(1)(f)/(a)) | 26 months
Support Contacts | Name, email, support ticket content | Legitimate interest (Art. 6(1)(f)) | 2 years after last contact

## Review Notes

- Review frequency: Annually
- Last reviewed: 2026-03-19
- Next review: 2027-03-19

## Related Documents

- Privacy Policy
- Record of Processing Activities
- Lawful Basis Assessment

Generated by Codepliant. Review with your DPO before finalizing.