A controller must provide a reasonably accessible and clear privacy notice, updated at least annually, stating: the categories of personal data processed, including sensitive data; the purposes of processing; how consumers exercise their 501.705(2) rights and appeal; any categories of personal data shared with third parties; the categories of third parties receiving data; and the request methods under 501.709.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.