GDPR Data processing modelCustomer and Prospect Management

Organisation: PrivateFunction: Sales and marketing

This processing model is related to the management and follow-up of customers and prospects

Purposes (14)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Management of accounting and tax obligations

Legal obligation

Article 6(1)(c) UK GDPR - legal obligation: Companies Act 2006, s.388 (accounting records); HMRC record-keeping requirements (company and VAT records kept for 6 years).

Prospecting for goods and services similar to the contract.

Legitimate interest

Article 6(1)(f) UK GDPR - legitimate interest in marketing similar products and services to existing customers. For email and SMS, the PECR soft opt-in applies (reg. 22(3)): contact details obtained in the course of a sale or negotiations for a sale, marketing of the sender's own similar products and services only, and a simple opt-out offered at collection and in every message.

Prospecting for professionals when the subject of the message is related to the professional's activity.

Legitimate interest

Article 6(1)(f) UK GDPR - legitimate interest. The PECR consent rule for electronic mail marketing (reg. 22) protects individual subscribers; it does not apply to corporate subscribers (such as companies and LLPs), but sole traders and some partnerships are individual subscribers. Business contacts can still object at any time under Article 21 UK GDPR.

Keeping the credit card number to facilitate future purchases (excluding cryptogram)

Legitimate interest

For customers who opt for a premium subscription in order to benefit, free of charge or not, from additional services aimed at facilitating their purchases (fast delivery, private sales, access to additional content, etc.)

Suppression list management (objections and opt-outs)

Legitimate interest

Legitimate interest in ensuring that people's objections to direct marketing (Article 21 UK GDPR) and PECR opt-outs are respected.

Prospecting by mail or human intervention

Legitimate interest

Legitimate interest to communicate with prospects subject to allowing individuals to object beforehand and at any time.

Canvassing by electronic means (for the purpose of sending email, SMS, automated voice mail, etc.)

Consent

Article 6(1)(a) UK GDPR - consent, required by PECR reg. 22(2) for unsolicited direct marketing by electronic mail (email, SMS) to individual subscribers, unless the soft opt-in in reg. 22(3) applies.

pre-litigation and litigation management

Legitimate interest

Legitimate interest in the context of establishing proof of a right or contract.

tracking / tracing people's navigation

Consent

Storing or accessing information on a user's device requires consent under PECR reg. 6 and Schedule A1, para. 2, so consent is relied on for the related processing. Since 5 February 2026, Schedule A1 exempts some purposes from consent (strictly necessary services, statistics to improve the service, adapting appearance or functionality, emergency assistance), subject to clear information and a simple way to object; online advertising and cross-site tracking are not exempt (ICO guidance on the use of storage and access technologies).

Organization of contests

Organisation of prize competitions, free draws or other promotional operations. Prize competitions are not gambling under the Gambling Act 2005 (s.339) unless they amount to gaming, betting or a lottery; such operations require a Gambling Commission licence or must fall within a statutory exemption.

Consent

Transfer, lease or exchange of customer files and prospect files

Consent

Management of people's opinions on products, services or content

Legitimate interest

Communication about products, services or content

Keeping the credit card number to facilitate future purchases (excluding cryptogram)

Consent

Until the withdrawal of consent or expiration date of the bank card.

order management, deliveries, after sales service

Contract

Data categories (7)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Business Relationship Monitoring

UK sources: Limitation Act 1980, s.5; Companies Act 2006, s.388; HMRC record-keeping requirements; Information Commission (ICO) guidance on storage limitation.

Data details

Documentation requestsrequired

Test Requestsrequired

Items, purchased productsrequired

subscribed services or subscriptionsrequired

Services ordered and invoicedrequired

Quantity, amount, periodicity, date and amount of order and invoicerequired

invoice due daterequired

Delivery terms and addressrequired

Purchase and Service Historyrequired

product returnrequired

Sale origin (seller, representative, partner, affiliate)required

Customer Correspondence and Serviceoptional

Customer and prospect exchanges and feedbackrequired

Person(s) in charge of customer relationsrequired

Data conservation rules

Active base:

Intermediate archiving:

6 years after the end of the contract or the last transaction

Limitation Act 1980, s.5 (6 years for contract claims); HMRC requires company and VAT records to be kept for 6 years.

Destruction

prospect or customer identity

UK sources: Limitation Act 1980, s.5; Companies Act 2006, s.388; HMRC record-keeping requirements; Information Commission (ICO) guidance on storage limitation.

Data details

Date of birth

optional

Civilityoptional

Name or company nameoptional

First Namesoptional

Address (including headquarters, billing location)optional

phone numberoptional

Fax numberoptional

Email addressoptional

Internal processing code for customer identificationoptional

Accounting identification codeoptional

SIREN numberoptional

Data conservation rules

Active base:

Data necessary for the performance of a contract are kept for the duration of the business relationship. After the contract ends, they are moved to intermediate archiving where the controller has a legal obligation to keep them (for example accounting records: 3 years for a private company, 6 years for a public company, Companies Act 2006, s.388) or needs them as evidence in case of a dispute, within the limitation period (6 years for contract claims, Limitation Act 1980, s.5). Prospects who are not customers: no statutory period; the controller should set a period after the last contact (for example 3 years) after which the data are deleted if the prospect has not responded.

Companies Act 2006, s.388; Limitation Act 1980, s.5

Destruction

personal situation

UK sources: Limitation Act 1980, s.5; Companies Act 2006, s.388; HMRC record-keeping requirements; Information Commission (ICO) guidance on storage limitation.

Data details

Marital Lifeoptional

Number of persons in householdoptional

Number and age of child(ren) in the householdoptional

Professionoptional

Business Areaoptional

socio-professional categoryoptional

presence of petsoptional

Data conservation rules

Active base:

Destruction

Information stored on the terminal equipment

Cookies and similar storage and access technologies, subject to PECR reg. 6 and Schedule A1 and the Information Commission (ICO) guidance on the use of storage and access technologies.

Data details

Cookiesrequired

Data conservation rules

Active base:

No statutory period. The lifetime of cookies and similar technologies, and the period for which consent choices are kept, are set by the controller and must be proportionate to the purpose (ICO guidance on the use of storage and access technologies).

Destruction

Settlement / Payment

UK sources: Limitation Act 1980, s.5; Companies Act 2006, s.388; HMRC record-keeping requirements; Information Commission (ICO) guidance on storage limitation.

Data details

Paymentoptional

Payment terms and conditions (e.g., discounts, down payments, rebates)optional

RIP/RIBoptional

check numberoptional

Credit card numberoptional

Credit card expiration dateoptional

Visual cryptogramoptional

credit terms and conditionsoptional

Balances and credits taken out (amount and duration, name of the lending institution) in case of financing the order by creditoptional

Data conservation rules

Active base:

Data necessary for the performance of a contract are kept for the duration of the business relationship. After the contract ends, they are moved to intermediate archiving where the controller has a legal obligation to keep them (for example accounting and tax records) or needs them as evidence in case of a dispute, within the applicable limitation period. Card details are kept after the transaction only where the customer has agreed to their storage for future purchases, and never include the card security code.

Intermediate archiving:

6 years after the end of the contract or the last transaction

Limitation Act 1980, s.5 (6 years for contract claims); HMRC requires company and VAT records to be kept for 6 years.

Destruction

Transaction

UK sources: Limitation Act 1980, s.5; Companies Act 2006, s.388; HMRC record-keeping requirements; Information Commission (ICO) guidance on storage limitation.

Data details

transaction numberrequired

Details of the purchase, subscription, good or service subscribed tooptional

Data conservation rules

Active base:

Intermediate archiving:

6 years after the end of the contract or the last transaction

Limitation Act 1980, s.5 (6 years for contract claims); HMRC requires company and VAT records to be kept for 6 years.

Destruction

Notice

Data relating to people who submit reviews of products or services, including their pseudonym.

Data details

Pseudonymrequired

Data conservation rules

Active base:

Until the review is deleted, where it is published. Data necessary for the performance of a contract are kept for the duration of the contractual relationship.

Destruction

Data subject (3)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Clients
Former Customers
Prospects

Created at:04/11/2023

Updated on:10/05/2026

Nb using:44