##  3. Scope of Processing
### Data types collected and relevant purpose of processing
  * Personal master data: name, surname, job title, profile picture (optional), user role in the software, subscriptions of objects, e-mail address, individual use case
    * Purpose: user management, functions in the software such as subscriptions of objects
  * Communication data type: e-mail, user activity in the software, browser identification, IP address
    * Purpose: user management, functions in the software such as notifications, error analysis, quality assurance of the operation and the faultlessness of the software, user support and information about news, individual user training


### Methods of processing
The Data Controller takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.
The Data processing is carried out using computers and/or IT-enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Data Controller, the Data may be accessible to certain types of external parties (such as third-party technical service providers, hosting providers, or IT companies) appointed, if necessary, as Data Processors by the Data Controller. The updated list of these parties may be requested from the Data Controller at any time.
### Legal basis of processing
Legal basis is the respective contract between the Data Subject and the Controller (Art. 6 (1)(c) GDPR).
Unless SAP LeanIX is the Data Controller, the data processing occurs in order to fulfill the SaaS contract between the Data Controller and SAP LeanIX.
### Places of processing
Hosting - The Data is hosted in the hosting region chosen by the Data Controller as it subscribed for the SAP LeanIX software. To know which data region has been chosen by your Data Controller, please contact your Data Controller. Among others, SAP LeanIX offers as hosting regions
  * Germany
  * Netherlands + Ireland
  * United Kingdom
  * Switzerland
  * Australia
  * USA
  * Canada
  * UAE
  * Singapore
  * Brazil
  * Japan


Further places of processing - The Data is then accessed and processed at the Data Controller's operating offices and in any other places where the parties involved in the processing are located. That might include SAP LeanIX subprocessors.
Subprocessors - SAP LeanIX relies on subprocessors for processing Data. To learn where such subprocessors are located, what is the purpose of the transfer towards this subprocessors and what are the safeguards that we have put in place to ensure that any data processing is executed in accordance with applicable legislations, please visit [https://www.leanix.net/en/legal/list-of-subprocessors![Information published on non-SAP site](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/themes/sap-light/img/3rd_link.png)](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Fwww.leanix.net%2Fen%2Flegal%2Flist-of-subprocessors "https://www.leanix.net/en/legal/list-of-subprocessors").
### Retention time
Personal Data shall be processed and stored for as long as required by the purpose they have been collected for.
In due course, Personal Data will be deleted 30 days upon expiration or termination of the contract between Data Controller and SAP LeanIX at the latest.
Once the retention period listed above expires, Personal Data shall be deleted. Therefore, the right to access, the right to erasure, the right to rectification, and the right to data portability cannot be enforced after the expiration of the retention period.
