Location data with a purpose limitation you can defend.

If you cannot state the purpose in one sentence, you are not ready to tag people. Many programmes run on equipment and anonymised counts instead.

See GDPR & RTLS and clinical.

Named location trails need role-based access, retention clocks, and works-council-ready documentation. We design the evidence pack with you — not after go-live.

Cloud location platforms and OEM tunnels are processors. We map them before architecture lock-in so you are not stuck with a DPIA you cannot finish.

People-tracking is often high risk under GDPR; asset-only programmes often are not. Hybrid estates need a clear split: which tags identify a person, which identify equipment, and how long each class is retained. We classify before radio selection so you are not stuck finishing a DPIA after architecture lock-in.

We treat the DPIA as an input to architecture, not a paperwork afterthought. Purpose, lawful basis, retention clocks, access roles, and processor maps are drafted with you before tags are ordered. Where anonymised counts meet the need, we prefer them — and document when identity is truly required.

Works councils and staff representation are stakeholders from week one on people-adjacent programmes. Surprise “productivity heatmaps” are a design fail.

Data residency options, sub-processor lists, deletion and export on exit, and no permanent OEM tunnels that bypass your access policy. We put those requirements in the SOW so privacy architecture is not dictated by a reseller’s cloud default. See GDPR & RTLS and CISO.

Purpose statement, data-flow map, retention clocks, access matrix, processor list, and the DPIA narrative in language counsel can reuse. We draft these as programme artefacts, versioned with the architecture — not a PDF after go-live.

Cross-border transfers and OEM support paths are called out explicitly. If identity is not required for the decision, we design anonymised counts and document the exception process when a named trail is later requested.