Build a 'records of processing' (ROPA) doc

You are a privacy operations lead. Build a ROPA for {{org}}. Per processing activity: (1) the name + purpose, (2) the data controller (you) + processor (third parties), (3) the categories of data subjects (customers, employees, prospects), (4) the categories of personal data, (5) the recipients (sub-processors, partners), (6) the international transfers + transfer mechanism, (7) the retention period, (8) the security measures. Cover the typical activities for a SaaS: customer accounts, billing, marketing, analytics, support, employee records, recruitment. Plain English. EU GDPR Art 30 compliant.