1. What this inventory is for

This inventory gives Quillmarrow a working view of the personal data it collects, uses, stores and shares. The 25 inventory records, PD-01 to PD-25, and the accompanying data flow map support decisions about privacy notices, retention, vendor due diligence, overseas transfers and breach assessment.

The inventory is a starting point, not proof that a particular control is operating. Quillmarrow’s appointed Data Protection Officer (DPO), the Head of Operations, should use it with the B2 gap tracker, B8 retention schedule, B9 vendor questionnaire and B11 breach management plan. Where information is missing or based on a description rather than supporting evidence, it should remain open until the relevant owner confirms it.

The inventory also helps staff identify which data and systems may be affected by an incident or an access or correction request. It does not replace an incident assessment, a search for the records relevant to a request, or advice from a Singapore-qualified lawyer.

2. How it was built

The programme’s fieldwork uses interviews with process owners, document review and system walk-throughs based on descriptions and screenshots with personal data masked. The inventory groups information by record type and links it to the systems and business activities described in the case file.

No customer database was received and no records were extracted for this inventory. No client personal data was put into AI tools. System locations, configurations and supplier practices that have not been supported by evidence are identified as questions, not presented as verified findings.

The DPO should confirm the relevant entries with the Head of Customer Service, Head of Marketing, HR Manager, IT Manager and other process owners before treating the inventory as complete.

3. How to read the inventory

Each PD record has one row in the inventory table and the workbook. The columns answer the questions the DPO will be asked during a request, an incident or a vendor review:

A row is treated as confirmed only when the owner has checked it against the system or a masked screenshot and the DPO has recorded the date. Until then it stays draft.

4. Key flows in words

The five flows below summarise where information is collected and where it is understood to go. The detailed map and inventory provide the record-level view.

1. Web-shop orders and returns. Customers provide account, order and delivery information through the web shop. Fictional ShopCloud holds or processes web-shop information; payment is handled through Fictional PayGate, and Quillmarrow does not see full card numbers. Customer service and returns may involve Fictional Helpdesk and Microsoft 365. Relevant records include PD-01, PD-02, PD-03, PD-06 and PD-12. Owner: Head of Customer Service, with the IT Manager for system questions.

2. Malaysia fulfilment. Malaysia order and delivery data is shared with DV-01, Tanjung Contoh Logistics Sdn. Bhd., for picking, packing and delivery in Johor. This is an overseas transfer involving PD-11. The reported contract has a confidentiality clause but no data-protection clauses; the DPO should obtain the contract and assess the transfer arrangements. Owner: Head of Operations, appointed DPO, with the Warehouse Manager.

3. Marketing and telemarketing. Information is collected through B2B account forms, showroom sign-ups and prospect-list activity. Marketing email data is held in Fictional MailBurst; PD-08, PD-09 and PD-10 need clear links between the collection point, choice recorded and later use. The case file does not establish a DNC register-check process for the planned campaign. Owner: Head of Marketing.

4. Recruitment and employment. Job applications and employee information, including PD-15 to PD-19, are used for recruitment and employment administration. Fictional PeopleDesk is used for HR and payroll, with Microsoft 365 also in the organisation’s system set. The precise routes, access and retention arrangements for each record need owner confirmation. Owner: HR Manager.

5. Showroom, operational and support records. CCTV footage is recorded on site; visitor records, calls, requests and support activity create further information across PD-07, PD-13, PD-14 and PD-25. Fictional Harbour IT, DV-03, has administrator access to Microsoft 365 and the file server. Its access scope and review evidence need confirmation. Owners: Showroom Supervisor for CCTV; Head of Customer Service for calls and requests; IT Manager for DV-03 access.

Fictional ShopCloud is DV-02. Its hosting region is to be confirmed; the inventory must not assume that web-shop data is hosted in Singapore or overseas. Any legal questions about transfer safeguards should be confirmed with a Singapore-qualified lawyer.

5. What the inventory shows

• NRIC or FIN copies: PD-19 is collected at staff onboarding. The HR Manager should review why copies are needed, who can access them and the proposed retention decision in RS-15.
• Call recordings: PD-07 covers sales-line recordings. The case file does not establish what notice callers receive; obtain the current script and recording arrangements before concluding whether a notice is missing.
• CCTV purpose: PD-13 was used once for a staff timekeeping dispute outside the stated purpose. Review that use and the stated purpose under G-03; no CCTV signage is reported under G-04.
• Marketing choices: the B2B marketing tick-box is reported as pre-ticked, and no consent records are reported for showroom sign-ups. Review PD-08 and PD-09 against G-02.
• Telemarketing: PD-10 contains SME owners’ mobile numbers, while no DNC register-check process is reported. The Head of Marketing should establish the campaign process under G-11 before use.
• Website analytics: PD-24 identifies analytics and cookies. The case file does not establish the tools, data collected or current cookie notice; confirm these before deciding what changes are needed.
• Retention: the case file reports no schedule and general indefinite retention. B8 proposes decisions for RS-01 to RS-20, but Quillmarrow must confirm them; the reported CCTV overwrite remains unverified.
• Vendors and access: DV-01 receives Malaysia delivery data, DV-02’s hosting region is unknown, and DV-03 has administrator access that has not been reviewed. These are evidence and decision gaps under G-07 and G-09.

6. Open questions and owners

Dates are proposed targets for Quillmarrow to confirm.

7. Maintenance

The DPO owns the inventory and should review it with process owners at least annually. The relevant owner should tell the DPO before a new system, vendor or collection point is introduced, or when an existing purpose, data flow, overseas location or access arrangement changes.

For each change, update the affected PD record, owner, system, recipient, location and evidence status. Check whether notices, B8 retention decisions, B9 vendor questions, B11 breach planning or the B2 tracker also need updating. Record the date and owner of the review; leave unresolved questions visible until supported by evidence.

8. Status and sign-off

Data flow map

Figure: main flows from collection points to systems, vendors and overseas recipients. Client-reported; owner Head of Operations (DPO).

Inventory, part 1: what is held and why

Inventory, part 2: where it lives, who sees it and how long it is kept