Data Use Purpose Documentation
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document defines the specific purposes for which QA Touch collects, uses, and processes personal information, and establishes controls ensuring usage is restricted to those intended purposes. It supports SOC 2 Privacy criterion P3.2 (Use Limited to Identified Purposes) and demonstrates compliance with the purpose limitation principle under GDPR Article 5(1)(b), CCPA, and PIPEDA.
2. Data Use Register
| Personal Data | Permitted Uses | Expressly Prohibited Uses | Access Roles | Enforcement Control |
|---|---|---|---|---|
| Name, Email Address | Account management; workspace collaboration; transactional email; support communication; audit attribution. | Advertising; sale to third parties; profiling for non-service purposes; sharing with non-DPA-covered parties. | Platform application (session-scoped); Support team (ticket-level) | RBAC; employee AUP; DPA with email provider |
| Password Hash | Authentication only — compare hash on login. | Any other use; decryption attempts; logging; exposing in admin interfaces. | Authentication service only (read, never display) | Application isolates hash completely; no admin UI can access password data |
| IP Address (security logs) | Security monitoring; brute-force detection; geographic anomaly alerting; legal compliance if lawfully required. | User profiling; marketing segmentation; sharing with advertisers or non-law-enforcement third parties. | Security team; SIEM system (automated) | Access restricted to Security team; logs never exposed to product or support teams |
| Role and Permission Data | Access control enforcement; audit log attribution. | Performance management scoring; selling to third parties; cross-tenant analytics. | Application RBAC layer (automated) | Enforced at application layer; not exposed outside access control decision logic |
| Billing Contact Information | Payment processing; invoicing; subscription management; tax and legal compliance. | Product analytics; sharing with non-billing parties; cross-referencing with test data. | Finance team; billing system (PCI-scoped) | PCI-scoped access; payment processor isolation; no product team access |
| AI Prompt Content | Transmitting to LLM provider to fulfil AI generation request; optionally retaining for workspace reproducibility [VERIFY]. | Training QA Touch’s or provider’s AI models without explicit consent; sharing with marketing; cross-workspace analysis. | AI engineering team; LLM provider (under DPA) | DPA with provider; prompt content never logged in application or error logs |
| Audit Log Data | Security monitoring; compliance evidence; debugging; workspace admin view (own workspace only). | Individual employee surveillance without due process; cross-workspace audit queries; sharing without legal basis. | Security team; SIEM (automated); workspace admins (own workspace only) | Append-only; access controlled; cross-workspace access architecturally prohibited |
| Support Ticket Content | Resolving the specific support request; quality assurance review of support interactions. | Product roadmap analytics (without anonymisation); any sharing outside support context. | Assigned support agent (ticket-level access only) | Support system access controls; not accessible via main application database |
| Anonymised Usage Analytics | Product improvement; usability issue identification; feature prioritisation. | Identifying individual users; advertising targeting; third-party data brokerage. | Product and engineering teams (aggregated, anonymised data only) | Anonymisation applied before processing; re-identification technically prevented [VERIFY] |
3. Purpose Limitation Enforcement Controls
- Technical: RBAC restricts which employee roles can query which data; all personal data access by QA Touch personnel is logged.
- Policy: employees sign an Acceptable Use Policy (AUP) that explicitly prohibits use of customer data for unauthorised purposes.
- Contractual: sub-processor DPAs contractually restrict third-party use of data to the specified processing purpose only.
- Audit: quarterly access reviews verify that personnel access to personal data matches their current role and documented need.
- New use review: any new use of existing personal data must be assessed against this register; if not covered, the DPIA and consent process applies before processing begins.
4. Secondary Use Prohibitions
- Marketing or advertising use of customer test data is contractually and technically prohibited without explicit consent.
- QA Touch personnel accessing production customer data for any purpose other than documented support, security, or compliance activities is a disciplinary offence.
- Customer test data, defect descriptions, or requirements are never used for product demonstrations or training materials without explicit customer written authorisation and anonymisation.
- AI prompt data is not retained in QA Touch systems beyond the defined workspace retention period and is never used for any purpose other than generating the requested AI output.