3.1 Data Processing Principles
- UK General Data Protection Regulation (GDPR).
- UK Data Protection Act 2018.
- Privacy by Design principles.
- Data minimisation principles.
3.2 Processing Activities
| Activity | Data Type | Frequency | Purpose |
|---|---|---|---|
| Recording | Audio, transcript | On-demand | Memory capture |
| Transcription | Audio to text | Per recording | Accessibility |
| Mood Detection | Transcript analysis | Per recording | Emotional tracking |
| Keyword Extraction | Transcript analysis | Per recording | Topic identification |
| Search | Full-text indexing | On-demand | Memory retrieval |
| Analytics | Aggregated usage | Daily | Performance monitoring |
3.3 Security Measures
- Technical: AES-256 encryption at rest, TLS 1.3 in transit, secure key management, penetration testing, vulnerability scanning.
- Organisational: access control and authentication, data minimisation, incident response procedures, regular audits, staff training.
- Physical: secure device storage, controlled facility access, backup and disaster recovery.
3.4 Data Retention
- Memories & transcripts: retained until user deletion.
- Analytics: aggregated data retained for 12 months.
- Logs: system logs retained for 90 days.
- Backups: user-controlled, encrypted backups.
3.5 Breach Notification
- Notify affected users within 72 hours.
- Provide details of the breach and its impact.
- Recommend protective measures.
- Notify supervisory authorities as required.
3.6 Data Subject Rights
Users may exercise their rights to access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), and objection (Article 21).