Articles 30 and 30-2: every controller establishes and publishes a privacy policy stating purposes, processing and retention periods, third-party provision, destruction procedures and legally retained items, how sensitive information may be exposed and how to opt out, outsourcing, pseudonymised-data processing, rights and how to exercise them, the privacy officer or responsible department, automatic collection devices and how to refuse them, and other decree items (including any domestic representative); where the policy and a contract differ, the version favourable to the data subject applies; the Commission evaluates policies and may recommend improvements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.