Govern · item 17
Classification and sub-processors
Before anything can be governed it has to be named. Every class of record the estate holds is classified by what it is about and whose it is, with the lawful basis, the retention rule and the minimization commitment written against it. Underneath sits the register of every downstream processor that touches it — who they are, where they process, and what they were assessed against.
Health
What the estate holds and under what class
Record classes by compliance state, the volume held under each and the special-category exposure.
Classes of record
10
8 carry personal data
Special category
1
Requires an additional condition, not just a basis
Records held
2,636,714
Across every class
Sub-processors
14
6 rated critical
Not assessed
2
5 approved with conditions
Onward transfer
3
4 receive special-category data
What the estate holds, by classification
Category drives the obligation. Special-category data needs a condition on top of a lawful basis, and the register says which.
Special category1
4,180 records
Health, biometric or comparable data. A higher bar applies to every processing purpose.
Personal data7
2,581,354 records
Identifies or relates to a living person.
Commercially sensitive1
38,420 records
Not personal data, but a loss here is a commercial event.
Non-personal1
12,760 records
No natural person is the subject. Residency still matters for contractual reasons.
Classification register
One row per class of record. Where the declared position and the observed position differ, the gap is written out rather than resolved in favor of the declaration.
Employee master dataPersonal data
61,840 recordsPlacement satisfies the rule
Identity, role, manager, location, contract terms and employment history for every worker in the estate.
Subject and owner
employee
Priya Raman · Chief People Officer
Lawful basis
Contract performance, Article 6(1)(b), with Section 26 BDSG for the German population.
Retention
RET-HR-07
Primary system: hcm
Minimization commitment
Agents receive role, level, location and tenure. Home address, dependants and bank details are withheld from every agent context.
Where it sits
DEUSSGUKAU8 placements · 4 processors · 2 routes
Candidate applicationsPersonal data
214,300 recordsException recorded
Applications, resumes, assessment scores, interview notes and screening outcomes for external candidates.
Subject and owner
candidate
Priya Raman · Chief People Officer
Lawful basis
Legitimate interest, Article 6(1)(f), with a balancing test recorded per jurisdiction.
Retention
RET-HR-02
Primary system: ats
Minimization commitment
Name, photograph, age, address and school-leaving dates are stripped before the screening agent sees a record. The agent scores on stated skills and stated experience only.
Where it sits
SGUSUKAUDE7 placements · 6 processors · 3 routes
EEA candidate data is processed in Singapore under clauses executed in 2024. The transfer impact assessment for that route is in progress and has been for 94 days.
Performance and calibration recordsPersonal data
58,920 recordsException recorded
Goals, continuous feedback, review text, calibration outcomes, ratings and performance improvement plans.
Subject and owner
employee
Priya Raman · Chief People Officer
Lawful basis
Legitimate interest, Article 6(1)(f). Section 26 BDSG and works council agreement for Germany.
Retention
RET-HR-05
Primary system: hcm
Minimization commitment
The calibration agent reads rating history and goal attainment. It does not read absence records, medical notes or grievance history.
Where it sits
DEUSSGUKAU7 placements · 2 processors · 1 routes
The German works council agreement covering agent-assisted performance review is drafted, not signed. German employees are excluded from the calibration decision point until it is.
Compensation and pay dataPersonal data
61,840 recordsPlacement satisfies the rule
Salary, band, merit outcome, bonus, equity grants and pay-equity analysis inputs.
Subject and owner
employee
Marcus Weill · VP Total Rewards
Lawful basis
Contract performance and legal obligation, Articles 6(1)(b) and 6(1)(c).
Retention
RET-FI-09
Primary system: hcm
Minimization commitment
Band modeling agents see banded ranges and market data. Individual pay is visible only to the merit agent within a single manager scope.
Where it sits
USDEUKSGAU7 placements · 2 processors · 0 routes
Health, safety and accommodation recordsSpecial categoryspecial category
4,180 recordsPlacement satisfies the rule
Workplace incidents, occupational health referrals, accommodation requests and return-to-work plans.
Subject and owner
employee
Priya Raman · Chief People Officer
Lawful basis
Article 9(2)(b), employment and social security obligations, with national derogations recorded.
Retention
RET-HR-11
Primary system: ehs
Minimization commitment
No agent reads this class. It is excluded from every agent context by policy and by field-level deny list.
Where it sits
USDEUKSGAU5 placements · 0 processors · 1 routes
5 placements on a system that is not in the connector registry: Occupational health record store, Occupational health record store, Occupational health record store, Occupational health record store, Occupational health record store.
Customer contact recordsPersonal data
892,400 recordsException recorded
Named contacts at customer accounts: name, business email, telephone, role and interaction history.
Subject and owner
customer contact
Elena Fischer · Chief Revenue Officer
Lawful basis
Legitimate interest, Article 6(1)(f), for business contact detail held in a business capacity.
Retention
RET-CX-03
Primary system: crm
Minimization commitment
Agents read account and role. Personal mobile numbers are masked in every agent-visible view.
Where it sits
USDEUKSGAU5 placements · 6 processors · 2 routes
Follow-the-sun replication moves EEA contact records to Singapore continuously. The clauses cover it; the transfer impact assessment predates the current sub-processor list.
Support conversations and transcriptsPersonal data
1,284,000 recordsException recorded
Chat, email and voice transcripts from customer service, including anything the customer volunteers.
Subject and owner
customer contact
Devon Marsh · VP Customer Service
Lawful basis
Legitimate interest for service delivery; consent for voice recording where local law requires it.
Retention
RET-CX-06
Primary system: ccaas
Minimization commitment
Redaction runs before storage on card numbers and national identifiers. Free text is not redacted, so volunteered health or financial detail survives.
Where it sits
SGUSDEUKAU6 placements · 3 processors · 3 routes
Customers volunteer special-category detail in free text. The redaction pass does not catch it, so this class occasionally holds Article 9 data under an Article 6 basis. Logged, not solved.
Supplier bank and payment instructionsCommercially sensitive
38,420 recordsPlacement satisfies the rule
Supplier bank accounts, payment terms and remittance instructions, plus the change history behind each.
Subject and owner
supplier
Ana Duarte · Group Financial Controller
Lawful basis
Contract performance. Sole-trader suppliers are personal data; incorporated suppliers are not.
Retention
RET-FI-04
Primary system: erp-fi
Minimization commitment
Agents see the last four digits and the change record. Full account detail requires a human session with step-up authentication.
Where it sits
USDEUKSGAU5 placements · 2 processors · 1 routes
Research payloads and experiment dataNon-personal
12,760 recordsUnresolved
Experiment designs, results, formulations and laboratory notebook entries.
Subject and owner
none
Yusuf Adeyemi · Chief Technology Officer
Lawful basis
Not personal data. Governed by trade secret and export control rather than privacy law.
Retention
RET-RD-01
Primary system: eln
Minimization commitment
Not applicable. Export control screening applies to a subset held under a separate register.
Where it sits
USDEUK3 placements · 0 processors · 1 routes
The laboratory notebook system has never been connected. Residency for this class is asserted from the site register rather than observed from the system, and the platform says so on the lineage screen too.
Agent telemetry and evidence recordsPersonal data
8,054 recordsPlacement satisfies the rule
The evidence spine itself: who acted, on what, under which authority, with which model and prompt version.
Subject and owner
employee
Avery Chen · Enterprise Chief of Staff
Lawful basis
Legal obligation and legitimate interest. Named human actors make this class personal data.
Retention
RET-GV-01
Primary system: platform-core
Minimization commitment
Actor names are required for accountability and cannot be minimized further without defeating the record.
Where it sits
USSGUKAUDE6 placements · 3 processors · 2 routes
6 placements on a system that is not in the connector registry: This platform, This platform, This platform, This platform, This platform, This platform.
Sub-processor register
Every downstream party that receives data from this estate, named — with where it processes, what it receives, and the outcome of its last assessment.
| Processor | Category | Purpose | Processes in | Receives | Agreement | Audit right | Last assessed | Status |
|---|---|---|---|---|---|---|---|---|
Primary model provider Critical criticality · HQ US | Model provider | Inference for every agent in the estate. Receives prompt content, which includes record extracts. | US | 5 classes | DPA-2025-014 signed 330 d ago | Report-based. No on-site audit right negotiated. | 41 d ago | Approved with conditions Approved with conditions. Zero-retention is contracted and attested annually; it is not independently verifiable by this platform. This is the highest-exposure processor in the register and the one with the weakest audit right. Everything an agent reads passes through it. |
Secondary model provider High criticality · HQ US | Model provider | Failover inference when the primary provider is unavailable or rate-limited. | USIE | 2 classes | DPA-2025-019 signed 288 d ago | Report-based, SOC 2 Type II shared annually. | 41 d ago | Approved Approved. EU region available and used for EEA-origin traffic. |
Applicant tracking vendor High criticality · HQ US | Software vendor | Hosts candidate applications, assessment results and interview records. | USSG transfers onward | 1 classes | DPA-2024-006 signed 652 d ago | Contractual on-site audit right, never exercised. | 94 d ago | Approved with conditions Approved with conditions. The vendor uses two onward processors for resume parsing and video interview hosting. The audit right exists and has never been used. An unexercised audit right is a contract clause, not an assurance. |
Resume parsing service High criticality · HQ US | Software vendor | Extracts structured fields from uploaded resumes on behalf of the applicant tracking vendor. | US | 1 classes | none on file | None. This is an onward processor; the relationship is with the applicant tracking vendor, not with us. | never | Not assessed Not assessed. Identified from the vendor sub-processor page during the 2026 review, not from any notification. A processor handling candidate resumes that we have never assessed and have no direct contract with. It was found by reading the vendor website. |
Video interview platform High criticality · HQ US | Software vendor | Hosts recorded and live interviews, and stores the recordings. | USDE | 1 classes special category | DPA-2025-021 signed 240 d ago | Report-based. | 94 d ago | Approved with conditions Approved with conditions. Facial analysis features are contractually disabled; the platform cannot verify they are off. Video recordings are biometric-adjacent. Contractual disablement of facial analysis is asserted by the vendor and not observable from here. |
Customer platform vendor Critical criticality · HQ US | Software vendor | Hosts customer contact records, opportunity and quoting data. | USDESGAU | 1 classes | DPA-2023-002 signed 1145 d ago | Report-based, ISO 27001 and SOC 2. | 348 d ago | Approved Approved. Regional instances configured. Sub-processor list refreshed twice since the last assessment. Last assessed 348 days ago against a sub-processor list that has changed twice since. |
Contact center vendor Critical criticality · HQ US | Software vendor | Voice, chat and email handling, plus transcript generation and storage. | USDESGAU transfers onward | 2 classes special category | DPA-2023-004 signed 1131 d ago | Report-based. | 348 d ago | Approved with conditions Approved with conditions. Speech-to-text runs through an onward processor. Transcripts carry whatever the customer says, including health and financial detail. Assessed as ordinary personal data. |
Speech recognition service High criticality · HQ US | Model provider | Converts recorded calls to text for the contact center vendor. | US | 1 classes special category | none on file | None. Onward processor of the contact center vendor. | never | Not assessed Not assessed. Named in the vendor sub-processor list; no direct relationship exists. Every recorded customer call in the estate passes through a processor we have never assessed. |
Core HR vendor Critical criticality · HQ US | Software vendor | Employee master, compensation, performance and payroll processing. | USNLSG | 3 classes | DPA-2024-001 signed 733 d ago | Contractual audit right plus annual third-party report. | 41 d ago | Approved Approved. EU pod confirmed for German and UK populations. |
Infrastructure provider Critical criticality · HQ US | Infrastructure | Hosts the platform, the ledger, the warehouse and the evidence spine. | USDEUKSGAU | 3 classes | DPA-2022-001 signed 1520 d ago | Report-based, full compliance program published. | 41 d ago | Approved Approved. Regions pinned per record class; no cross-region replication configured outside the declared routes. |
Marketing and analytics vendor Medium criticality · HQ US | Analytics | Campaign automation, digital analytics and attribution. | US | 1 classes | DPA-2026-002 signed 180 d ago | Report-based. | 41 d ago | Approved Approved under the EU-US Data Privacy Framework, certification verified February 2026. |
Shared-service outsourcing partner Critical criticality · HQ SG | Outsourcing partner | Human staff in the Singapore hub who handle escalated transactions across all four towers. | SGIN transfers onward | 4 classes | DPA-2024-008 signed 690 d ago | On-site audit right, exercised October 2025. | 302 d ago | Approved with conditions Approved with conditions. Delivery staff in a second country were disclosed during the on-site audit and are now named here. Delivery from a second country was discovered during audit rather than disclosed in advance. The register now names it; the disclosure failure is not undone by that. |
Background screening vendor High criticality · HQ UK | Software vendor | Right-to-work verification and criminal record checks where lawful. | UKUSSG | 1 classes special category | DPA-2024-016 signed 590 d ago | Contractual audit right, exercised March 2026. | 41 d ago | Approved Approved. Criminal record checks are suppressed in jurisdictions where they are unlawful for the role. |
German payroll bureau High criticality · HQ DE | Payroll bureau | Statutory payroll filing and social contribution reporting for the German entity. | DE | 2 classes | DPA-2023-011 signed 980 d ago | On-site audit right, exercised annually by the German entity. | 128 d ago | Approved Approved. Data stays in Germany throughout. |
Processors carrying an open question
Named, not counted.
Primary model providerApproved with conditions
This is the highest-exposure processor in the register and the one with the weakest audit right. Everything an agent reads passes through it.
Applicant tracking vendorApproved with conditions
The audit right exists and has never been used. An unexercised audit right is a contract clause, not an assurance.
Resume parsing serviceNot assessed
A processor handling candidate resumes that we have never assessed and have no direct contract with. It was found by reading the vendor website.
Video interview platformApproved with conditions
Video recordings are biometric-adjacent. Contractual disablement of facial analysis is asserted by the vendor and not observable from here.
Customer platform vendorApproved
Last assessed 348 days ago against a sub-processor list that has changed twice since.
Contact center vendorApproved with conditions
Transcripts carry whatever the customer says, including health and financial detail. Assessed as ordinary personal data.
Speech recognition serviceNot assessed
Every recorded customer call in the estate passes through a processor we have never assessed.
Shared-service outsourcing partnerApproved with conditions
Delivery from a second country was discovered during audit rather than disclosed in advance. The register now names it; the disclosure failure is not undone by that.
What the basis actually rests on
Lawful basis relied on across the transfer register.
Standard contractual clauses12 routes
Explicit consent1 route
None recorded1 route
Adequacy decision1 route
No personal data1 route
Standard contractual clauses carry most of the register. That is a common position and a fragile one: clauses alone do not answer whether the receiving jurisdiction can compel access, which is the question the transfer impact assessment exists to answer.
Actions
What is waiting on a person
Every class below names a lawful basis, a residency rule and an owner. The queue is what is written down and not yet settled.
5
Answer an acknowledged gap
The class itself records something the team could not evidence.
4
Clear a class running under an exception
Held in a way the residency rule does not sanction, with a written reason.
1
Resolve an unclassified holding
The platform holds the data and the class does not yet say on what basis.
1
Re-confirm a special-category basis
Special-category data carries a higher bar and a shorter review cycle.
Operations
What this desk is allowed to start
A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.
Trigger and bound
This desk can define a class, attach a lawful basis and a retention code to it, and mark where it may physically sit. It cannot move the data: the residency rule written here is compared against the placements on the residency page, and a mismatch surfaces there as an unsanctioned placement rather than being corrected automatically.
Live observability
What the record shows right now
10 record classes covering 2,636,714 held records, 1 of them special category.
Current distribution
10 classes
Compliant550%
Running under exception440%
Unresolved110%
Is policy and strategy coming to fruition
Whether the written intent is holding here
5 of 10 classes are clean; 5 are carrying a written exception or no answer at all.
Not holding on the record
The policy position is that nothing is held without a stated lawful basis, a named owner and a rule about where it may live. That statement is complete for 5 of 10 classes. The rest are honest about being wrong rather than quietly compliant: 4 run under an exception somebody wrote down, and 1 have no settled answer. None of these classes has been reviewed by external counsel, so what you are reading is the team's own classification of its own data.
What this page is, and what it is not
The classification, the register and the assessment states are real structures against modeled holdings. The volumes are modeled. What the register demonstrates is whether the estate can name every downstream party and say what each one was assessed against — not that these particular parties were assessed.
2 of 14 sub-processors have no assessment on record and 2 have never been assessed at all. 2 operate without a processing agreement on file. They stay in the register with the gap visible rather than being removed until the paperwork catches up.
5 of 10 classes carry a declared exception, and 1 class is special category — the one where an ordinary lawful basis is not sufficient on its own.