01
Information collected
Journey and contact details should be limited to what is needed to respond, coordinate and maintain the requested service.
02
Use and access
Production wording must identify the controller, service providers, access limits, analytics choices and legal basis.
03
Retention and choices
Final policy must state retention periods and how a person can request access, correction or deletion.