Privacy notice
Each Startup publishes a privacy notice that lists every Purpose it processes personal data for.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 P1.1 | The entity notifies data subjects about its privacy practices. |
| GDPR Art.13 | A controller tells data subjects its identity, purposes, legal basis, recipients, retention and their rights at collection. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Purpose in force during the report period. |
| Assert | Each appears in the privacy notice Version published at that time. |
Owner
Example
A tutoring marketplace adds a progress-report Purpose. The privacy notice Version published that day lists it, before the first report goes out.