{"generated_at":"2026-05-07T19:10:58.364Z","period":{"from":"2026-04-07","to":"2026-05-07"},"framework":"gdpr","evidence":{"data_subjects_count":8,"supplier_records_count":16,"invoice_records_count":0,"processing_activities":[{"activity":"Procurement requisition processing","data_subjects":"Employees (requestors)","personal_data":"Name, email, department, Telegram ID (optional)","legal_basis":"Contractual necessity (employment contract)","retention":"7 years (Dutch accounting law)","location":"Supabase EU (Frankfurt)"},{"activity":"Supplier management","data_subjects":"Supplier contacts","personal_data":"Name, email, phone, IBAN","legal_basis":"Contractual necessity","retention":"7 years post-relationship","location":"Supabase EU (Frankfurt)"},{"activity":"Invoice processing","data_subjects":"Vendor contacts","personal_data":"Invoice metadata (no PII in LLM prompts)","legal_basis":"Legal obligation (Dutch VAT law)","retention":"10 years (fiscal records)","location":"Supabase EU (Frankfurt)"},{"activity":"AI agent reasoning","data_subjects":"None (pseudonymised)","personal_data":"Procurement metadata only — no names or emails sent to LLM","legal_basis":"Legitimate interest","retention":"90 days rolling","location":"OpenRouter US (anonymised)"}],"data_residency":"EU (Supabase Frankfurt region)","dpo_contact":"peter.slakhorst@gmail.com","retention_policy":"Financial records 10 years per Dutch law; operational logs 90 days rolling; PII deleted on data subject request within 30 days"}}