| Tähelepanu! Tegemist on välisvõrgust saabunud kirjaga.
Tundmatu saatja korral palume linke ja faile mitte avada. |
Hello,
We operate a small B2B SaaS infrastructure tool under the 1seal project, via Mudria OÜ (Estonia).
Our service processes only business email addresses and basic contact details of institutional clients (no consumer data, no special categories, no profiling).
I would like to kindly ask for clarification on the minimal GDPR expectations for such a micro-enterprise:
-
How should records of processing activities under Article 30 be handled for a very small controller in this situation?
-
In a B2B-only context (business contacts of client organisations), when would a DPO appointment become necessary, if at all?
-
Are there any recommended retention periods or best practices for business contact information used only for service provision and invoicing?
Use case: offline-verifiable transaction receipts for institutional clients – only business contact details, no private individuals.
This is a request for non-binding compliance guidance, not a complaint.
Thank you in advance for any pointers or links to existing materials.
Best regards,
Oleh Konko