Automated Vendor Coordination

While the underlying functionality of using emails to prompt vendors (and internal users in your organization) remains unchanged, we've added functionality that allows you to customize the email digests, and other associated settings, at the integration level.

In most cases, Transcend aims to provide an API-based integration into your SaaS tools and internal systems. Sometimes, the API based approach may not be possible due to restrictions such as:

  • The SaaS vendor has no API for a certain type(s) of privacy requests, and requires you to send an email in a specific template.
  • The SaaS vendor only provides a self-serve dashboard to submit data privacy requests, and someone on your team would need to log in and submit the request through their browser.
  • You want to notify an internal team to perform a manual process against a database or internal tool.

In these cases, you can configure your Transcend instance to automate the sending of an email template whenever a particular type of data subject request is made. These emails can be sent to the SaaS vendor directly, or to an individual in your organization.

In order to use this feature, you will need to grant Transcend the ability to send emails from a domain you own. This allows for all emails sent to your vendors to come from an address like automation@privacy.<company.com>. Most vendors require that the emails be sent from a domain that your company owns.

To allow Transcend to send emails from this domain, your IT team will need to set 5 DNS Records of types TXT, CNAME and MX.

  1. Navigate to your Email Domains page.

  2. Determine the subdomain that we should send and receive emails for. We recommend that you grant us permission of the privacy.<company.com> subdomain, so emails would be sent from the address automation@privacy.<company.com>. If you want to send/receive emails from another subdomain, toggle the "Custom Domain" option.

  3. Copy the DNS records and configure them from your end.

  4. Once the records are set, you will see the status update to "Verified" from the Transcend Admin Dashboard. Note: after updating the records, it may take a couple of hours until the status updates.

Each integration that you configure with email notifications can have its own custom email template. You can customize each email template to have instructions for the team on how to fulfill the request, or you can simply use the default email template to notify a vendor to respond to a data privacy request.

By default, your organization will come with an email template named "Automated Vendor Coordination". Each integration will default to this email template. If you want to change the default language for all vendor emails, edit this template.

The following template variables are available when sending emails relating to data subject requests.

In TemplateVariable meaning
{{organizationName}}The name of your company or organization, as configured on here.

Ex: Acme Corp.
{{completionText}}Text that instructs the receiver on what they need to do in order to mark a request as complete.

In the case where you configure the integration to not send a completion link, as you want the datapoints to be automatically resolved after sending the email to the vendor.
{{completionLink}}A magic link the email recipient can click to mark the request as completed, without a login session to Transcend. Note: a login session is currently required to upload files for a data subject access request.

Ex:
https://app.transcend.io/privacy-requests/bulk-requests?token=supersecrettoken123
{{dataSiloTitle}}The title of the integration being processed.

Ex: Rockerbox
{{requestId}}The ID of the request being processed.

Ex: e18cf2f4-b7ca-447a-9520-698046b9dce5
{{requestDetails}}The request details provided in the Privacy Center form. This is only available when using the "Per Data Subject Request" Email Digest setting.

Ex: I would like to update my address to 123 South St.
{{actionTitle}}The name of the data subject request type being submitted

Ex: Erasure

Learn more about creating and modifying email templates here.

Go to the Integrations page. If you are searching for a particular vendor, use the search bar to find them. Transcend has presets for each vendor even if they are just email based. Any integration that requires emails to be sent will be labeled with the blue "Email Automation" tag.

If you are setting up an internal email notification, or don't see the vendor you want to connect with:

  1. Search for the "Prompt a Person" integration.
  2. Click on the "Prompt a Person" card to open the configuration window.
  3. Review the Data Points that are in scope for this integration, and click on "+ Add"
  4. On this page, you can create an Integration Title (to make it easier to find this integration) and configure the assignee for requests reaching this integration.

See more in Connecting integrations.

If you need to retroactively change/remove/add an email address or email template for an existing integration, follow these steps:

  1. Go to your Integrations
  2. Search for your integration and click on the tile to open the settings
  3. Click the "Email Automation" button

Here you can add, remove, or edit the email addresses to be notified, as well as editing the email template to be used.

If you need to update the frequency of emails being sent to that integration, you can do so under the "email frequency" section within the same page.

  1. Go to your Integrations
  2. Search for your integration and click on the the tile to open the settings
  3. Click the "Email Automation" tab
  4. Specify whether emails should be batched across multiple requests ("Across Active Data Subject Requests") or sent for one request at a time ("Per Data Subject Request").
    • If "Across Active Data Subject Requests" is selected, you can change the "Email Frequency" to specify how often email notifications should be sent (per hour, per day, per week, etc…)
  5. If the "Include identifiers in email" toggle is active, a CSV will be included in the email notification.
  6. Determine whether to expose the bulk respond processing interface to be available for individuals without an account on app.transcend.io.
    • The default setting for "Prompt a Person" silos is to "Require receiver(s) to log in with SSO or username/password"
    • The default setting for third party vendors (i.e. privacy@vendor.com) is "Allow anyone receiving the email to view outstanding requests for this integration".
    • A third option of "Send no link and automatically mark datapoints as resolved once email is sent" can be selected. This disables the bulk respond interface entirely for the integration. Instead, an email will be sent to the vendor with the CSV of identifiers attached. The request will immediately mark those integrations as completed and continue processing the request without waiting for the vendor to respond.

Read more about connecting and configuring integrations.

Once a Vendor Coordination integration is live, Data Subject Requests will be added to the queue for that integration and the email address configured for that integration will start getting notified of incoming requests. The best place to manage the status of these requests is by using our bulk respond interface. To navigate to the Bulk Respond interface:

a) If you are logged in, go to https://app.transcend.io/privacy-requests/bulk-requests and use the dropdown to find your integration. b) If you are logged in on the settings page for an integration, open the "Connection" tab dropdown and click "Manage requests for this integration" c) If you are a third party vendor, or do not have an account log in to Transcend, you will need to click the magic link from your email and it will bring you to the interface.

From the bulk respond interface for your integration, you will be able to see the list of active requests that require your attention, as well as past requests that have already been resolved.

Using the checkboxes next to each request, you can select the requests that you want to process. Once selected you can:

  • View the type of request (Access, Erasure, Opt Out…)
  • View the identifiers associated with the request
  • Upload files to the access requests
  • Export the selected requests to a CSV
  • Add notes on how the requests need to be processed
  • Mark all selected requests as Exception
  • Mark all selected requests as Not Found
  • Mark all selected requests as Completed

Additionally, you can apply a set of filters across the requests:

  • Filter by the type of request (Access, Erasure, Sale Opt Out…)
  • Filter by the email batch. When receiving email notifications for an integration, the link in the email will include a filter for that email batch. This means that if you set up the integration to send weekly emails, the link in the email would show all the requests that were received within the past week. Note: if a request fails to be responded to after 2 weeks, it will be re-queued in the next email batch.

Some access requests are a bit unique when they are processed manually. Rather than marking the requests as completed, these requests require data to be uploaded back into Transcend so that the data can be sent to the end user on the Privacy Center.

In order to do this, you will first need to navigate to the "Bulk Respond" tab under Privacy Requests, then find and select the relevant integration you would like to process requests for. If you are logged in, you can navigate directly to Bulk Respond

  1. Select the relevant integration
  2. Select all the Access requests you would like to process
  3. Add all the data relevant to the request, by using the "upload" option for each datapoint
  4. Once all the files have been uploaded for the selected requests, click on "Mark as Complete" to complete the request.