Acme Org/People
L3 · Restricted
ACME ORG
People & context
Roles, expressed priorities and the evidence for your next conversation.
Acme · Customer
Katarina Voss
Data Protection Officer
Recorded email domain: acme-org.example.
katarina.voss@acme-org.exampleRecorded names: Katarina Voss, katarina voss, datenschutz@acme-org.example, +49 151 4408 2295, katarina.voss@acme-org.example, Katarina, Voss
Review expressed priorities, responses to proposals and suggested next steps.
Katarina Voss is Acme's Data Protection Officer. In the 9 April 2026 processor review she recorded four actions: written confirmation of the hosting region and whether it is named in the current agreement; details of the fifth sub-processor including why Acme was not notified; confirmation that the November erasure request is fully closed with a list of every location the data was held; and a stated retention period for meeting recordings and transcripts plus a position on the existing two years of material, all within four weeks. 1
She also registered a concern, explicitly not an action, that extracting from a transcript and then deleting it makes any carried-over personal data permanent and removes the only means of checking, and asked Acme's counterpart to think about it before running the backlog. In the same review meeting she raised that a document describes one of Acme's own people as the person whose judgement determines whether the project succeeds, naming her without using her name, and called it an assessment of an individual's competence held by a third party which she has never seen; Marco Rossi acknowledged the point as correct. 2–9
Responses to her proposals: on 29 April Marco Rossi answered three of four actions — hosting is EU West and named in Schedule 2 of the agreement; the fifth sub-processor is Halberd Observability BV, registered in the Netherlands, processing application telemetry and logs in the Netherlands and Ireland, with the notification classification admitted wrong and changed; and an 18-month retention period from creation effective 1 May, with the backlog being worked through by extraction then deletion. Voss called that a good response to three but kept item 3 open. Marco sent item 3 on 23 June. 10, 2, 11
As of the 2 July internal note, the four actions are closed except the retention policy, which is with legal. 12
Recommendation: in the next conversation, lead with the closed item 3 evidence and the retention policy status with legal, and be ready to address the extraction-then-deletion anonymisation concern directly rather than treating it as closed, since Voss explicitly asked for it to be considered before the backlog run. 11, 12, 2
Evidence · 3 documents · 12 excerpts
Processor review - actionsDocument · 4 excerpts
11
2
Katarina Voss · Message 2 · 2026-04-30T09:20:00
Thank you, that is a good response to three. On item 4, I want to register a concern rather than an action. If you extract from a transcript and then delete the transcript, and the extraction has carried across something personal, you have made that permanent and removed the only means of checking. Please think about it before you run the backlog. Item 3 remains open.Open source
10
Marco Rossi · Message 3 · 2026-04-29T14:15:00
Katarina, Responses to three of four. 1. Hosting is EU West region. It is named in Schedule 2 of the agreement. Extract attached. 2. The fifth sub-processor is Halberd Observability BV, registered in the Netherlands. They process application telemetry and logs. Processing occurs in the Netherlands and Ireland. You were not notified because our notification process only covered sub-processors handling primary customer data, and telemetry was not classified that way. That classification was wrong and we have changed it. 4. Retention period is set at eighteen months from creation, effective 1 May. The existing backlog is being worked through - commitments and decisions extracted into a record, then the underlying transcript deleted. I owe you item 3 and I do not want to send you a partial answer on it.Open source
1
Katarina Voss · Message 4 · 2026-04-09T16:30:00
Marco, Following this afternoon, the four actions as I recorded them. 1. Written confirmation of hosting region and whether it is named in the current agreement. 2. The fifth sub-processor: identity, what they process, where processing occurs, and the transfer mechanism if any of it is outside the EU. Plus why we were not notified. 3. The erasure request made in November: confirmation that it is fully closed, with a list of every location the data was held. 4. A stated retention period for meeting recordings and transcripts, and a position on the existing two years of material. I would like all four within four weeks.Open source
Data protection and security reviewMeeting · 7 excerpts · 2026-04-09
10:37 – 10:54
3
Katarina Voss · 10:37 · utterance 124
One more thing. I have seen a document that describes one...Open source
4
5
Katarina Voss · 10:54 · utterance 126
I am paraphrasing, the person whose judgement determines whether the project succeeds.Open source
11:53 – 11:57
6
7
Katarina Voss · 11:57 · utterance 138
those. So it names her perfectly well without using her name,Open source
12:09 · utterance 140
8
Katarina Voss · 12:09 · utterance 140
and it is an assessment of an individual's competence held by a third party, which she has never seen.Open source
12:23 · utterance 142
9
Marco Rossi · 12:23 · utterance 142
That is correct and I had not thought about it that way.Open source
Acme renewal and resourcingMeeting · 1 excerpt · 2026-07-02
Turn 3 · speaker attribution unresolved
12
Them · Turn 3 · speaker attribution unresolved
The four actions are closed except the retention policy, so which is with legal.Open source
How this answer was prepared
- Read 2974 permitted source records at L3.
- Verified E08M004 for the four recorded actions and the four-week deadline
- Verified E08M002 for the extraction-then-deletion concern and item 3 remaining open
- Verified E08M003 for Marco's 29 April answers on hosting, sub-processor and retention
- Verified E08M001 for item 3 sent 23 June
- Verified T21U0124–T21U0126, T21U0137–T21U0140 and T21U0142 for the competence-assessment point and Marco's acknowledgement
- Verified 12 quoted passages against runtime sources.
Source connections
Processor review - actions2026-06-23T10:05:00 · Katarina VossRe: Processor review - actions2026-04-30T09:20:00 · Katarina VossRe: Processor review - actions2026-04-29T14:15:00 · Marco RossiProcessor review - actions2026-04-09T16:30:00 · Katarina VossRemove this person
Erase identifying material from this workspace's source copies and invalidate affected answers, briefs and other derived content.