Qonto RGPD Register

Your bank account knows your data processors better than you do. Qonto access is read-only: the skill detects, classifies and drafts; a human validates. The connected model processes spending data, and HTML export may write a local file. Every output carries the same disclaimer — draft register, not legal advice, to be validated by a DPO or lawyer.

Prerequisites

1. get_organization first → legal name, legal form, address, country. That block becomes the mandatory Article 30 header (data controller identity), and list_transactions requires bank_account_id/iban anyway.
2. Pan-European by design: all Qonto countries are in the EU, so GDPR applies everywhere. In France the register follows the CNIL card model; elsewhere the structure is identical and references switch to the local supervisory authority (BfDI/LfDI, AEPD, Garante, DSB, AP, APD/GBA, CNPD).
3. Vendor knowledge = Claude's general knowledge (headquarters, processor role, typical data categories). A SaaS is recognized from its first occurrence — no frequency threshold — and every classification is tagged "to validate".
4. Empty or thin history → the skill says what it could not detect and still delivers the register skeleton with the controller block filled.

Workflow

1. Identify the controller

get_organization: legal name, legal form, address, country → the register header. State the Article 30(5) nuance honestly: the under-250-employee exemption is narrower than people think — non-occasional processing (payroll, CRM, prospecting) already requires the register, so in practice almost every company needs one.

2. Scan the spending (12–24 months)

list_transactions per account (side: debit), paginate per_page: "50" in 3-month windows; complement with list_supplier_invoices (cleaner vendor names than card labels). Normalize counterparty spellings and merge — the same vendor shows up as GOOGLE *WORKSPACE, GOOGLE IRELAND LTD, Google Cloud EMEA: one vendor. Track each vendor's last-seen date (use emitted_at for card payments — settled_at lags 1–2 days) for the freshness flag.