End to End Data Storage and Processing Protocols
1. Data Storage
• Storage Methods:
◦ Cloud-based servers with end-to-end encryption (we use Google Cloud if there is a specific platform we must adopt for securitisation purposes we are willing to explore. We have been exploring CloudFlare as an alternative multi-purpose cloud based system)
◦ Encrypted databases for structured data (proposed certifications MySQL, PostgreSQL)
2. Data Processing
• Purpose of Processing:
◦ Order fulfilment
◦ Secure third-party services for payment processing (proposed for this project Shopify and Payfast)
◦ Personalisation of user experience (e.g., product recommendations, key rolling features and other plug ins)
◦ Marketing communications (with opt-in consent). Standards universal for personalised marketing
◦ Customer service support (chatbot functionality and general customer service)
◦ Analytics and performance tracking
• Data Processing Tools
◦ CRM software (we are exploring Hubspot or Salesforce for this action)
◦ Email marketing platforms (Mailchimp but this would also depend on which direct mail marketing platform BMW currently has in place as this system will need to be seamless for internal and external comms)
◦ Analytics tools (e.g., Google Analytics – but based on call with IT department global may guide us further on which platforms to go ahead with)
4. Data Sharing and Third Parties
• With Whom:
◦ Payment processors
◦ Shipping and logistics providers
◦ Marketing and advertising platforms (Meta, Google)
◦ Analytics service providers
• Compliance and Contracts:
◦ Data Processing Agreements (DPAs) with all third parties
◦ Due diligence and security checks on vendors
◦ Adherence to data privacy regulations like GDPR and CCPA
◦ Secure Infrastructure with robust measures to protect sensitive data.
5. User Rights and Data Governance
• Customer Rights:
◦ Right to access, rectify, or delete personal data
◦ Right to data portability
◦ Right to object to or restrict processing
◦ Right to withdraw consent at any time
• Governance Practices:
◦ Privacy Policy transparency
◦ Data Protection Officer (if required)
◦ Regular audits and compliance reviews
6. Retention and Deletion Policy
• Retention Periods:
• Deletion Process:
◦ Personal data: Retained as long as necessary for business purposes or as requiredby law
◦ Inactive accounts: Purged after a defined period ( BMW SA and TDP would need toagree on associated timelines for this action)
◦ Transactional data: Retained for financial and legal compliance
◦ Manual or automated deletion systems
◦ Secure data wiping techniques
7. Incident Response and Breach Notification
• Breach Response Plan:
◦ Incident detection and reporting system
◦ Internal investigation and remediation
◦ Legal and customer notifications within required timeframes
• Regular Drills and Reviews:
◦ Conduct security training
◦ Simulate breach scenarios annually