Automated Vendor Coordination

While the underlying functionality of using emails to prompt vendors (and internal users in your organization) remains unchanged, we've added functionality that allows you to customize the email digests, and other associated settings, at the integration level.

We're still in the process of migrating the naming across our application.

In most cases, Transcend aims to provide an API-based integration into your SaaS tools and internal systems. Sometimes, the API based approach may not be possible due to restrictions such as:

  • The SaaS vendor has no API for a certain type(s) of privacy requests, and requests you to send an email in a specific template.
  • The SaaS vendor only provides a self-serve dashboard to submit data privacy requests, and someone on your team would need to log in and submit the request through their browser.
  • You want to notify an internal team to perform a manual process against a database or internal tool.

In these cases, you can configure your Transcend instance to automate the sending of an email template whenever a particular type of data subject request is made. These emails can be sent to the SaaS vendor directly, or to an individual in your organization.

In order to use this feature, you will need to grant Transcend the ability to send emails from a domain you own. This allows for all email sent to your vendors to come from an address like automation@privacy.<company.com>. Most vendors requires that the email be sent from a domain that your company owns.

To allow Transcend to send emails from this domain, your IT team will need to set 5 DNS Records of types TXT, CNAME and MX.

  1. Navigate to your Email Domains page.

  2. Determine the subdomain that we should send and receive emails for. We recommend that you grant us permission of the privacy.<company.com> subdomain, so emails would be sent from the address automation@privacy.<company.com>. If you want to send/receive emails from another subdomain, toggle the "Custom Domain" option.

  3. Copy the DNS records and configure them from your end.

  4. Once the records are set, you will see the status update to "Verified" from the Transcend Admin Dashboard. Note: after updating the records, it may take a couple of hours until the status updates.

Each integration that you configure to have email notifications can have it's own custom email template. You can customize each email template to have instructions for the team on how to fulfill the request if the request is for an internal team, or you can simply use the default email template to notify a vendor to respond to a data privacy request.

By default, your organization will come with an email template named "Automated Vendor Coordination". Each integration will default to this email template. If you want to change the default language for all vendor emails, you should edit this template.

The following template variables are available when sending emails within the context of data subject request.

In TemplateVariable meaning
{{organizationName}}The name of your company or organization, as configured on here.

Ex: Acme Corp.
{{completionText}}Text that informs the receiver what they must do in order to mark a request as complete.

In the case where you configure the integration to not send a completion link, as you want the datapoints to be automatically resolved after sending the email to the vendor.
{{completionLink}}A magic link the email recipient can click to mark the request as completed, without a login session to Transcend. Note: a login session is currently required to upload files for a data subject access request.

Ex:
https://app.transcend.io/privacy-requests/bulk-requests?token=supersecrettoken123
{{dataSiloTitle}}The title of the integration being processed.

Ex: Rockerbox
{{requestId}}The ID of the request being processed.

Ex: e18cf2f4-b7ca-447a-9520-698046b9dce5
{{requestDetails}}The request details provided in the Privacy Center form. This is only available when using "Per Data Subject Request" Email Digest settings.

Ex: I would like to update my address to 123 South St.
{{actionTitle}}The name of the data subject request type being submitted

Ex: Erasure

See more about creating and modifying email templates here.

Go to the Integrations page. a) If you are searching for a particular vendor, use the search bar to find them. Transcend has presets for each vendor even if they are just email based. Any integration that requires emails to be sent will be labeled with the blue "Email Automation" tag.

If you are setting up an internal email notification, or don't use see the vendor you want to connect, instead search for the "Prompt a Person" integration. 2. Confirm the email address and email template you want to use 3. Click "Connect" See more in Connecting integrations.

If you need to retroactively change/remove/add an email address or email template for an existing integration, you can do so by:

  1. Go to your Integrations
  2. Search for your integration and click on the tile to open the settings
  3. Click the "Edit integration" button
  4. Assign an owner by clicking the blue "Update" button, then select an owner from your company

Once you have a Vendor Coordination integration on your Integrations, you can customize the email settings for each integration to meet the needs of the team or person manually fulfilling the request.

  1. Go to your Integrations

  2. Search for your integration and click on the the tile to open the settings

  3. Click the "Email Automation" tab

  4. Specify whether emails should be batched across multiple requests ("Across Active Data Subject Requests") or sent for one request at a time ("Per Data Subject Request").

    • If "Across Active Data Subject Requests" is selected, you can change the "Email Frequency" to specify how often email notifications should be sent (per hour, per day, per week, etc…)

  5. If the "Include identifiers in email" toggle is active, a CSV will be included in the email notification.

  6. Determine whether to expose the bulk request processing interface to be available for individuals without an account on app.transcend.io.

    • The default setting for "Prompt a Person" silos is to "Require receiver(s) to log in with SSO or username/password"
    • The default setting for third party vendors (i.e. privacy@vendor.com) is "Allow anyone receiving the email to view outstanding requests for this integration".
    • A third option of "Send no link and automatically mark datapoints as resolved once email is sent" can be selected. This disables the bulk request interface entirely for the integration. Instead, an email will be sent to the vendor with the CSV of identifiers attached. The request will immediately mark those integrations as completed and continue processing the request without waiting for the vendor to respond.

Read more about connecting and configuring integrations.

Once a Vendor Coordination integration is live, Data Subject Requests will be added to the queue for that integration and the email address will begin to be notified about incoming requests. The best place to manage the status of these requests is by using our Bulk Request Interface. You can navigate to this interface by:

a) If you are logged in, go to https://app.transcend.io/privacy-requests/bulk-requests and use the dropdown to find your integration. b) If you are logged in on the settings page for an integration, open the "Control Panel" dropdown and click "Manage requests for this integration" c) If you are a third party vendor, or do not have an account log in to Transcend, you will need to click the magic link from your email and it will bring you to the interface.

From the Bulk Request Interface for your integration, you will be able to see the list of active requests that require attention, as well as the set of pass requests that have already been resolved.

Using the checkboxes next to each request, you can select the request that you want to process. Once selected you can:

  • View the type of request (Access, Erasure, Opt Out…)
  • View the identifiers that make up the request that should be processed
  • Export the select requests to a CSV
  • Mark all selected requests as completed

Additionally, you can apply a set of filters across the requests:

  • Filter by the type of request (Access, Erasure, Sale Opt Out…)
  • Filter by the email batch. When receiving email notifications for an integration, the link in the email will include a filter for that email batch. This means that if you set up the integration to have weekly emails, the link in the email would show all the requests that were received within the past week. Note: if a request fails to be responded to after 2 weeks, it will be re-queued in the next email batch.

Access requests are a bit unique when they are processed manually. Rather than marking the requests as completed, these requests require data to be uploaded back into Transcend so that the data can be sent to the end user on the Privacy Center.

To upload data for a particular request, click on the icon in the top left corner. This will bring you to a view for that specific request where you can select the datapoint ("test") and upload data using the "Upload" button. Once the data is uploaded, the 'Mark as "No Data"' button should change to 'Mark as "Ready"'. Once this button is clicked the manual action item for this request will go away.