Name the ERP as a data source in the privacy notice
Personal data an application reads from the company’s ERP or CRM was not collected from the person it describes. The privacy notice then owes them more: where the data came from, what kinds of data, for what purpose and on what legal basis, and whether any of it came from publicly accessible sources.
Wildo derives that statement from the application’s declarations instead of leaving it to be written by hand. For every record type that is read live from, or copied from, a declared system of record, the notice draft receives an entry naming the connection and its vendor, the kinds of personal data its fields carry, and the purposes the binding links, with their legal basis. For a copy, the entry also says whether it is kept until erased or governed by a retention period.
Nothing in it is guessed. A personal field with no declared category is named as such, so an incomplete list says so. A purpose the binding does not link is not stated, and a link to a purpose that does not exist is reported as broken. Whether the data came from publicly accessible sources is the operator’s declaration per connection; when it is missing, the notice marks that point as owed rather than assuming “no”.
A connection is kept apart from the list of recipients given to a person who asks what was shared about them. That list names the service providers the application sends data to; a system of record is the company’s own deployment, and it answers requests about its own records, as each binding’s subject-rights posture states.
Example — Client contacts copied from the ERP
An application copies client account names and email addresses from the company’s Odoo to attribute work to clients. Its privacy notice draft names Odoo as the source of identity and contact data, for the service purpose and its contractual basis, states that none of it came from a public source, and says the copy is kept until erased unless a retention period is declared for it.
For engineers
Three declarations feed the entry; none of them is written for the notice. From Wonder Todos, comments omitted: the instance in wildo.saas.config.ts,
systemsOfRecord: {
odoo: {
vendor: 'odoo',
dialect: HttpApiTransportDialect.ODOO_JSONRPC,
partition: true,
personalDataOrigin: SystemOfRecordPersonalDataOrigin.NO_PUBLICLY_ACCESSIBLE_SOURCES,
},
},
the purpose linked on the pipeline’s binding in external-customers.resources-config.ts, which names a purposeRef of operatorComplianceIdentity.lawfulBases,
subjectRights: { posture: SystemOfRecordSubjectRightsPosture.OWNED_COPY },
purposeRefs: ['task-planning-service'],
and the categories on the destination’s fields in external-customers.schemas.ts:
name: z.string().optional().isSummaryField().excludeFromCreate().excludeFromUpdate()
.dataCategories(PersonalDataCategory.IDENTITY),
personalDataOrigin is NO_PUBLICLY_ACCESSIBLE_SOURCES or INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES. There is deliberately no default: an ERP contact may have been typed in from a public register, which nothing in the binding can tell.
What the fact contains
Each entry of the system-of-record-sources fact describes one resource and one flow:
| Field | From |
|---|---|
system, vendor | the instance the binding names, and its declared vendor |
flowKind, copiedLocally | a read-through binding (nothing kept locally) or a pipeline (a local copy) |
categories, uncategorizedPersonalFields | the .dataCategories() of the fields that come from the system; for a pipeline, only the mapped fields, constants excluded |
purposes, purposeRefsNamingNoPurpose | binding.purposeRefs resolved against the declared lawful bases |
keptUntilErased, retentionClass | for a copy: no retention class and no expiry, or the class it is bound to |
personalDataOrigin | the instance’s declaration, absent when it states none |
A flow that carries no personal data is left out. An application that declares no system of record gets an empty list, which is a true statement. One whose flows could not be read gets no answer at all, rather than an empty list that would claim nothing is obtained.
The same derivation feeds the evidence collector, so what the notice states and what the evidence measures cannot disagree. The privacy notice’s data-and-sources clause cites the fact, and the companion computes it from the application’s materialized resources when a notice is drafted.
What it does not do
It does not decide a purpose: a flow with no linked purpose states none. It does not add the ERP to the recipients a person is told about in an export or an erasure receipt. In the processing record, the instance is listed as a processor holding the categories its flows carry.