AI agents: the content index is at /llms.txt. Every page is also available as Markdown — send the request header Accept: text/markdown, or append .md to the page URL.
We use necessary cookies (opens in a new tab) to run our website and improve your experience while browsing. Additional cookies are only used with your consent. You may revoke your consent on the Cookies Policy (opens in a new tab) page or in your browser at any time.
Is this really the version you are looking for? Kentico Xperience 12 Service Pack Documentation is no longer updated. Use the switcher in the header to choose your product version.
Personal data in Kentico | Kentico Xperience 12 Service Pack Documentation
Personal data in Kentico
This page provides information about personal data stored in Kentico, as well as the flow of this data and its purpose. You can use the information when analyzing the GDPR compliance of your websites.
Disclaimers
This page only covers the built-in Kentico functionality. You also need to check any customized functionality for personal data handling.
This page is provided for informational purposes only and should not be relied upon as legal advice. You can use the information to identify personal data and its flow in the system, and take appropriate measures. However, we recommend consulting with a legally qualified professional to verify that your project complies with the GDPR.
The following is a list of the most important entities in Kentico that hold personal data. For every entity, the page displays up to three sets of data organized into tables. The first table contains a list of data considered as personal according to the GDPR Article 4 (opens in a new tab), Paragraph 1, the corresponding database columns, as well as the purpose of the data. The second table contains a list of sources, describing the flow of personal data in the system. The third table contains information about other entities with personal data that contain a reference to the given entity. The data includes entities, database fields, purposes and sources that might under various conditions manipulate with personal information of natural persons (in the default Kentico functionality). Depending on your usage of features and configuration, parts of the information may not apply to your Kentico project.
Accounts are an on-line marketing entity representing organizations, companies, etc. They allow marketers to categorize contacts based on their affiliations.
Note: Account data can be considered as personal only in cases where the account represents a natural person, not an entire organization (for example individual contractors).
Displayed in various administration interface locations to identify accounts
May be used for contact segmentation and automated marketing (assigning entire accounts to Contact groups, account actions within Marketing automation)
Salesforce – the account name may be used to set the company name when replicating contacts to Salesforce leads
Activities are an on-line marketing entity which represents actions done on the live site by visitors (contacts). The system logs activities of various types, therefore activity records can contain different data based on the activity type. The type of each activity is determined by the value of the ActivityType column in the OM_Activity table.
Activities – Stored personal data
Activity personal data purpose
All activity data collected for contacts can be viewed by users of the administration interface in the activity log (in the Contact management application or displayed on dashboards using the Activities widget). Each activity may contain different data based on its type. For example, user registration activities contain a username in their title, but forum post activities do not.
The data of logged activities is also used by the system when evaluating on-line marketing conditions, macro rules and methods (for example for automation process triggers or in scoring rules).
Data
Column names
Description
Referring URL
ActivityURLReferrer
The URL referrer of the web request during which the activity occurred (for example may contain the URL of a site from which a visitor arrived)
Title
ActivityTitle
The activity title contains personal data for the following activity types:
Blog post subscription (blogpostsubscription) – the subscribed email address
User login (userlogin) – the full name and email address of the authenticated user
User registration (userregistration) – the full name and email address of the registered user
URL
ActivityURL
The URL where the activity occurred contains personal data for the following activity types:
Opened marketing email (newsletteropen) – a tracking link which includes the email address of the recipient
Opted out from all marketing emails (newsletterunsubscriptionfromall) – an unsubscription link which includes the email address of the recipient
Unsubscription from a single email feed (newsletterunsubscription) – an unsubscription link which includes the email address of the recipient
ActivityContactID – the contact who performed the activity (for all activity types)
ActivityItemID – contains references to objects related to the activity. The type of the object is determined by the activity type:
Blog comment (blogcomment) – the posted blog comment
Blog post subscription (blogpostsubscription) – the added blog post subscription
Clicked link in marketing email (newsletterclickthrough) – the email feed related to the email where the link was clicked
Event booking (eventbooking) – the attendee who registered for the event
Form submission (bizformsubmit) – the form for which the data record was submitted
Forum post (forumpost) – the forum where the post was added
Forum post subscription (forumpostsubscription) – the forum where the subscription was added
Message board comment (messageboardcomment) – the message board where the post was added
Message board subscription (messageboardsubscription) – the message board where the subscription was added
Opened marketing email (newsletteropen) – the email feed related to the opened email
Opted out from all marketing emails (newsletterunsubscriptionfromall) – the email feed issue where the unsubscription link was clicked
Purchase (purchase) – the created order
Subscription to a newsletter (newslettersubscription) – the newsletter (email feed) for which the subscription was added
Unsubscription from a single email feed (newsletterunsubscription) – the email feed for which the unsubscription occurred
User login (userlogin) – the user who signed in to the website
User registration (userregistration) – the registered user
ActivityItemDetailID – contains references to additional objects related to the activity. The type of the object is determined by the activity type:
Clicked link in marketing email (newsletterclickthrough) – the email feed issue where the link was clicked
Form submission (bizformsubmit) – the specific form data record that was submitted
Forum post (forumpost) – the added forum post
Forum post subscription (forumpostsubscription) – the added forum post subscription
Message board comment (messageboardcomment) – the added message board post
Message board subscription (messageboardsubscription) – the added message board subscription
Opened marketing email (newsletteropen) – the email feed issue that was opened
Subscription to a newsletter (newslettersubscription) – the added newsletter subscription
Unsubscription from a single email feed (newsletterunsubscription) – the email feed issue where the unsubscription link was clicked
Activities – Personal data sources
Source
Data flow
User and visitor actions
The system logs new activities when users or website visitors perform any of the monitored actions. Activity data is loaded from various types of related entities.
Manual editing
Users with access to the administration interface can manually edit the Title and URL values of logged activities in the Contact management application or using the Activities dashboard widget.
The Banned IP entity represents IP addresses that the system prohibits from accessing your website or from performing certain actions on your website, according to the specified ban type.
Banned IPs - Stored personal data
Data
Column names
Purpose / Description
IP address
IPAddress
IPAddressRegular
Blocking users with a banned IP address from accessing the website
Blocking banned actions within various system pages, web parts and controls – signing in, registering, E-commerce actions (such as ordering, editing shopping cart content, paying, etc.), other membership actions, subscribing to newsletters, registering for events, voting in polls, contributing to message boards, blog comment actions, registering into groups, contributing to forums, rating content of pages, reporting website abuses, and user contribution actions.
Blocking authentication via external services for users with a banned IP address
Redirection of banned users to a predefined page
System data
IPAddressLastModified
IPAddressID
IPAddressGUID
IPAddressLastModified – timestamp used by the system
IPAddressID and IPAddressGUID – used as identifiers within the system
Banned IPs - Personal data sources
Source
Data flow
Banned IPs
Administrators manually enter banned IP addresses in the Banned IPs application. The system automatically generates a matching regular expression into the IPAddressRegular column.
The Blog comment entity represents individual comments made by either anonymous or authenticated users. The comments are related to blog post pages located in the content tree of the website.
CommentPostDocumentID – ID of the blog post to which the comment was submitted
Blog comments – Personal data sources
Source
Data flow
Blog comments
Users submit comments for blog posts on the live site.
Users with access to the administration interface approve or edit comments in the Blogs application or on the live site.
Blog comments – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is a blog comment for activities of the Blog comment type – i.e., when the value of the ActivityType column is blogcomment.
The Blog subscription entity represents subscriptions of users to comment sections of blog posts. When a new blog comment is submitted, the system retrieves subscriptions related to the blog post and sends notification emails to the email addresses provided by subscribers.
A user selects the Subscribe to this blog post check box while posting a blog post comment.
A user submits their email address through the subscription form.
Blog subscriptions – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is a blog subscription for activities of the Blog post subscription type – i.e., when the value of the ActivityType column is blogpostsubscription.
The system creates and stores invitations when users invite someone else to join a community group.
Community group invitations – Stored personal data
Data
Column names
Purpose / Description
Email address
InvitationUserEmail
Stores the email address that was set when inviting people who are not registered users on the site (invitations to existing site users do not directly store an email address)
Email engine – used to send email invitations to the person who was invited to join the group
Can be displayed on the live site by the My sent invitations web part (to the user who sent the invitation)
ChatMessageCreatedWhen and ChatMessageLastModified – timestamps used by the system
ChatMessageID – used as an identifier within the system
References to other entities
ChatMessageRecipientID
ChatMessageUserID
ChatMessageRecipientID – the chat user to which the message was sent (for whisper messages)
ChatMessageUserID – the chat user who sent the message
Chat messages – Personal data sources
Source
Data flow
Related table
Chat users
System messages containing user names load values from the nick name field of the related chat user.
Chat_User
Sending of chat messages
Chat messages can be created in the following ways:
Users with access to the administration interface send announcements or standard messages for chat rooms in the Chat application.
Users with access to the administration interface initiate chat requests with an online user or contact on the On-line users tab in the Users or Contact management application.
Users on the live site send messages using chat web parts (Chat web part, Chat send message, Chat support request, Automatically initiated chat).
The system automatically creates messages when users perform chat actions (joining/leaving chat rooms, sending room invitations, etc.).
The message IP address value is loaded and stored automatically when a chat message is created.
The Chat functionality allows users in the administration interface (website staff) to initiate chat requests with currently online visitors. The system stores information about the chat requests to allow the conversations to persist even if one of the involved users goes offline.
Chat requests – Stored personal data
Data
Column names
Purpose / Description
Nick name
InitiatedChatRequestInitiatorName
Stores the chat nick name of the administrator who initiated the chat request
Displayed on the live site by the Initiated chat web part to users who receive the chat request
InitiatedChatRequestContactID – the contact for which the chat request is intended
InitiatedChatRequestUserID – the user for which the chat request is intended
InitiatedChatRequestInitiatorChatUserID – the chat user (administrator) who initiated the chat request
Chat requests – Personal data sources
Source
Data flow
Related table
Chat initiation
Users with access to the administration interface initiate chat requests with an online user or contact on the On-line users tab in the Users or Contact management application.
Chat users
The chat request nick name value is loaded from the nick name of the chat user (administrator) who initiated the request.
Contacts are an on-line marketing entity representing website visitors and users. During the first visit of the website, an anonymous contact is created and linked to the current session. If further information is provided by the visitor through various sources, the system updates the contact and adds the information.
Contacts aggregate information about page visitors. This information is further processed by the system and can be used to deduce conclusions, such as marketing prospectiveness, about visitors and customers.
All of the data acquired by contacts may be viewed in the Contact management application.
Contacts – Stored personal data
Data
Column names
Purpose / Description
Address
ContactAddress1
ContactCity
ContactZIP
User interface – displayed in the Contact management application
ContactCountryID – country of the contact's address
ContactStateID – (federated) state of the contact within the given country
ContactPersonaID – persona to which the contact is assigned
ContactOwnerUserID – user responsible for managing the contact
ContactSalesForceLeadID – identifier of a third-party Salesforce entity matching the contact
Contacts – Personal data sources
Source
Data flow
Related tables
Blogs
Creation of blog comments saves the author's last name into the contact.
Subscription to blogs saves the given email address into the contact.
Blog_Comment
Blog_PostSubscription
Campaigns
When a contact is created within the context of a specific campaign, the campaign's name is saved into the contact's data.
Contact editing
Users with access to the administration interface manually create or edit contacts in the Contact management application.
Contact import
Manual import of contacts creates new contacts in the system or updates existing ones.
Customers
When a customer is created or updated, the system transmits data to contact fields according to mapping configuration.
Update of account details and processing of information obtained from the purchase order creates user relationships and updates the contact's properties.
Billing or shipping addresses used in a customer's orders are saved into the address fields of the corresponding contact.
COM_Customer
Forms
Form submissions transmit data to contact fields according to mapping configuration.
Separate database table generated for each form.
Forums
Creation of forum posts saves the author's last name and email address into the contact.
Subscription to forum posts saves the given email address into the contact.
Forums_ForumPost
Forums_ForumSubscription
Geolocation
If enabled, the Geolocation feature can update the contact's properties based on the visitor's IP address.
Message boards
Creation of message board comments saves the author's last name into the contact.
Subscription to message boards saves the given email address into the contact.
Board_Message
Board_Subscription
Personas
Updates of personas or contact scores trigger a re-evaluation of personas and assign contacts to the corresponding personas.
Subscribers
When a subscriber is created or updated, the system transmits data to contact fields according to mapping configuration.
Subscription to newsletters saves the given first name and last name into the contact.
Subscription to newsletters without double opt-in and access to approval pages or pages containing Subscription approval web part updates the contact's properties.
Newsletter_Subscriber
Users
When a user is created or updated, the system transmits data to contact fields according to mapping configuration.
Retrieval of contact information from the login or register activity, submission of forms from the Custom registration, My profile, and My account web parts and My profile application creates user relationships and updates the contact's properties.
Usage of the My newsletter subscriptions web part updates the contact's properties.
CMS_User
Contacts – References from entities containing personal data
Entity (Database table)
Column name
Description
Accounts (OM_Account)
AccountPrimaryContactID
AccountSecondaryContactID
Primary and secondary contacts set for accounts.
Activities (OM_Activity)
ActivityContactID
The contact who performed the given activity.
Chat requests (Chat_InitiatedChatRequest)
InitiatedChatRequestContactID
The contact for which the chat request is intended.
Contact membership relationships (OM_Membership)
ContactID
The contact related to a user/customer. The table contains records representing relationships between contacts and users/customers.
Contact-account relationships (OM_AccountContact)
ContactID
Binding table containing relationships between accounts and the assigned contacts. The optional role of the contact in the account is stored in the ContactRoleID column, which references a role from the OM_ContactRole database table.
Marketing automation states (CMS_AutomationState)
StateObjectID
The contact related to the given state of a marketing automation process. The type of the referenced object is stored in the StateObjectType column (the value is om.contact for contacts).
On-line users (CMS_Session)
SessionContactID
The contact related to the session stored for on-line user/contact entities.
Queued marketing emails (Newsletter_Emails)
EmailContactID
The contact who is the email recipient.
Shopping carts (COM_ShoppingCart)
ShoppingCartContactID
The contact related to the shopping cart. The system uses the reference to track abandoned shopping carts.
Scoring is an on-line marketing feature that evaluates each contact based on their profile information and activity on the website. Score definitions can store an email address, which is used to send notification emails when a contact reaches a specified score value.
Contact scores – Stored personal data
Data
Column names
Purpose / Description
Email address
ScoreNotificationEmail
Email engine – the system sends notification emails to the given address when a contact reaches a certain score value (specified in the ScoreEmailAtScore column)
Customers are an e-commerce entity representing users who make purchases on the website. Every completed order is linked with a specific customer. Customers can either be anonymous (created for one specific order) or registered (linked with a user account).
Customer data is required to process orders and payments, and maintain e-commerce records.
Note: For registered customers, the system automatically synchronizes name, email address and phone number data with the corresponding user account. The synchronization works in both directions whenever changes occur for the related entity.
CustomerID and CustomerGUID – used as identifiers within the system
CustomerCreated and CustomerLastModified – timestamps used by the system
References to other entities
CustomerUserID
CustomerSiteID
CustomerUserID – the user related to the customer (for registered customers)
CustomerSiteID – the site on which the customer was created (only for anonymous customers)
Customers – Personal data sources
Source
Data flow
Related tables
Order checkout
Customers submit data when checking out orders on the live site (via the Customer detail web part). For new customers, the web part creates the customer object when the visitor inputs valid data into the customer form and moves to the next checkout step.
Customer editing
Users with access to the administration interface manually edit customer data in the Customers application.
Users with access to the administration interface can add new customers while manually creating orders in the Orders application.
Customers edit their data on the live site through the My account or Customer edit company details web parts.
Users
When the name, email address and phone number data of a user account is modified, the system automatically transfers the values to all customer objects associated with the given user.
CMS_User
CMS_UserSettings
Customers – References from entities containing personal data
Entity (Database table)
Column names
Description
Contact membership relationships (OM_Membership)
RelatedID
The customer related to a given contact. The table contains records representing relationships between contacts and users/customers.
Records representing customer relationships have the value of the MemberType column set to 1.
The system stores various types of addresses (billing, shipping or company) for Customers who make purchases on the website. The addresses are required to process orders and payments, deliver order shipments, and maintain e-commerce records.
Used to process e-commerce orders (billing, shipping and company addresses). Automatically saved into the address values of created orders.
Billing addresses are sent to third-party payment gateways when performing payment transactions (by default used by the PayPal and Authorize.Net gateways).
Used to prefill address values during checkout for existing customers (done by the Customer address checkout web part).
Billing address values are saved into the address fields of contacts representing customers.
User interface – displayed in the Customers application under the Addresses tab.
Displayed on the live site by checkout web parts, the My account and Customer edit address form web parts.
Name
AddressPersonalName
Labels addresses with the customer's name for easier identification
User interface – displayed in the Customers application under the Addresses tab
Displayed on the live site by checkout web parts, the My account and Customer edit address form web parts
Phone number
AddressPhone
Saved into the mobile phone field of contacts representing customers.
User interface – displayed in the Customers application under the Addresses tab
Displayed on the live site by checkout web parts, the My account and Customer edit address form web parts
System data
AddressID
AddressGUID
AddressLastModified
AddressID and AddressGUID – used as identifiers within the system
AddressLastModified – timestamp used by the system
References to other entities
AddressCustomerID
AddressCountryID
AddressStateID
AddressCustomerID – the customer related to the address
AddressCountryID – country of the customer address
AddressStateID – (federated) state within the given country
Customer addresses – Personal data sources
Source
Data flow
Order checkout
Customers submit billing/shipping address data when checking out orders (via the Customer address web part).
The AddressName value is a summary, automatically composed from the other address data fields.
When creating addresses, the customer's name is saved into the AddressPersonalName field.
Address editing
Users with access to the administration interface manually edit customer addresses in the Customers application.
Customers edit their address data on the live site through the My account or Customer edit address form web parts.
Customer addresses – References from entities containing personal data
The billing, shipping and company addresses specified for the given shopping cart. The billing address is always required for completed shopping carts, the shipping and company addresses are optional.
Orders represent purchases that customers make on e-commerce websites. Typically, customers create orders on the live site by going through a checkout process. Users with access to the administration interface can also edit or create orders in the Orders application.
Order data is required to process orders and payments, generate invoices, and maintain e-commerce records.
The order entity can be used to obtain information about the products purchased by specific customers (when combined with the data of the related order items).
Orders – Stored personal data
Data
Column names
Purpose / Description
Date and time
OrderDate
The date and time when the customer placed the order
Used by the system when recalculating existing orders (for example to evaluate discount validity)
User interface – displayed in the Orders application and by the Orders dashboard widget
Invoice
OrderInvoice
Stores the full HTML code of the invoice for the order. May contain personal data of the related customer.
May be sent to third-party payment gateways when performing payment transactions (for example PayPal)
User interface – displayed in the Orders application and by the Orders dashboard widget
Tracking number
OrderTrackingNumber
User interface – displayed in the Orders application and by the Orders dashboard widget
Can be displayed on the live site (by default via the My account web part)
System data
OrderID
OrderGUID
OrderLastModified
OrderID and OrderGUID – used as identifiers within the system. The OrderID value is used to generate invoice numbers by default.
OrderLastModified – timestamp used by the system
References to other entities
OrderCustomerID
OrderCreatedByUserID
OrderCustomerID – the customer who created the order
OrderCreatedByUserID – the user who created the order (for registered customers)
Orders – Personal data sources
Source
Data flow
Related tables
Invoice template
The system generates the invoice for orders according to a template defined in the Store configuration or Multistore configuration application (when creating new orders or if an administrator re-generates an invoice in the Orders application).
Order editing
Users with access to the administration interface manually edit or create orders in the Orders application.
Payment options
The system's payment gateways set the payment data for orders when processing payments.
Shopping carts
When a customer completes checkout on the live site, the system automatically creates a new order based on the customer's shopping cart. Transfers information, such as the order note.
COM_ShoppingCart
Orders – References from entities containing personal data
Entity (Database table)
Column names
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is an order for activities of the Purchase type – i.e., when the value of the ActivityType column is purchase.
Order items (COM_OrderItem)
OrderItemOrderID
The order containing the given order item (product).
Order status changes (COM_OrderStatusUser)
OrderID
The order whose status was changed.
The COM_OrderStatusUser table tracks changes in statuses for orders. The ChangedByUserID column of this table can be used to connect the order with a user (the administrator who performed the order status change).
Every order item represents one or more units of a given product within an Order created by a customer. Order items can either be standard products, product variants, or product options that were purchased together with another product.
Order item data is required to process orders and payments, generate invoices, and maintain e-commerce records.
Order items do not directly contain any personal data, but can be used to obtain information about the products purchased by specific customers (when combined with the data of the related order).
Order items – Stored personal data
Data
Column names
Purpose / Description
References to other entities
OrderItemSKUID
OrderItemOrderID
Each item stores a reference to the related product and order
Processed by the system when calculating and evaluating orders (total prices, shipping, discounts, etc.)
Used to display the products contained within orders:
In the Orders application of the administration interface
Order items are sent to certain third-party payment gateways when performing payment transactions (by default used by the PayPal gateway)
Order items – Personal data sources
Source
Data flow
Related tables
Order editing
Users with access to the administration interface can add, remove or update order items in the Orders application (only for orders that have not been paid yet).
Shopping cart items
When a customer completes checkout on the live site, the system automatically creates order items for the new order based on the customer's shopping cart.
The system stores various types of addresses (billing, shipping or company) for Orders. The addresses are required to process orders and payments, generate invoices, deliver order shipments, and maintain e-commerce records.
Order addresses – Stored personal data
Data
Column names
Purpose / Description
Address
AddressCity
AddressLine1
AddressLine2
AddressZip
Used to process orders (billing, shipping and company addresses)
Billing addresses are sent to third-party payment gateways when performing payment transactions (by default used by the PayPal and Authorize.Net gateways)
User interface – displayed in the Orders application when editing orders on the Shipping and Billing tabs
AddressStateID – (federated) state within the given country
AddressOrderID – the order where the address is used (a single order can have multiple related addresses, each with a different AddressType – billing, shipping or company)
Order addresses – Personal data sources
Source
Data flow
Related tables
Customer addresses
When a customer completes checkout on the live site, the system automatically creates order addresses based on the customer's shopping cart and the data of the referenced customer addresses.
COM_Address
Address editing
Users with access to the administration interface manually edit order addresses in the Orders application.
Customers purchase products by browsing the website and adding items to their shopping cart. The system stores the shopping cart of each customer until they complete the checkout process, or until the cart is abandoned and cleared. When a customer completes checkout, the system automatically converts the given shopping cart into an order and then deletes the cart.
The shopping cart entity can be used to obtain information about the products in which specific users or customers were interested (when combined with the data of the related shopping cart items).
Shopping carts – Stored personal data
Data
Column names
Purpose / Description
User input
ShoppingCartNote
Stores the text of notes that customers can add to their purchase during the checkout process
When the customer completes checkout, the system copies the shopping cart note into the resulting order
ShoppingCartBillingAddressID, ShoppingCartShippingAddressID, ShoppingCartCompanyAddressID – the customer address used for the shopping cart's billing, shipping or company address respectively. The billing address is always required for completed shopping carts, the shipping and company addresses are optional.
ShoppingCartContactID – the contact related to the shopping cart. The system uses the reference to track abandoned shopping carts (logging of activities of the Shopping cart abandoned type).
ShoppingCartCustomerID – the customer who created the shopping cart.
ShoppingCartUserID – the user related to the shopping cart (for registered customers).
Shopping carts – Personal data sources
Source
Data flow
Product catalog
The system automatically creates shopping carts for customers when they add the first product to their cart (by clicking on a link generated by the CartItemSelector control or the GetAddToShoppingCartLink macro method).
Order checkout
Shopping cart addresses are assigned by customers when checking out orders (via the Customer address web part).
Customers can input a note when checking out orders (via the Order note web part).
Shopping carts – References from entities containing personal data
Entity (Database table)
Column names
Description
Shopping cart items (COM_ShoppingCartSKU)
ShoppingCartID
The shopping cart containing the given shopping cart item (product).
Customers purchase products by browsing the website and adding items to their shopping cart. Every item represents one or more units of a given product. Shopping cart items can either be standard products, product variants, or product options that were purchased together with another product.
Shopping cart items do not directly contain any personal data, but can be used to obtain information about the products in which specific customers were interested (when combined with the data of the related shopping cart).
The system automatically deletes all items together with the related shopping cart when it is converted into an order upon successful checkout, or after it is abandoned and cleared.
Shopping cart items – Stored personal data
Data
Column names
Purpose / Description
References to other entities
SKUID
ShoppingCartID
Each item stores a reference to the related product and shopping cart
Activities – activities of the Product added to shopping cart and Product removed from shopping cart types are logged when shopping cart items are created or removed
Used to display shopping cart content on the website (via the Shopping cart content web part)
The system creates the content of orders based on shopping cart items when the customer completes the checkout process
Shopping cart items – Personal data sources
Source
Data flow
Product catalog
The system automatically creates shopping cart items when a customer adds a product to their shopping cart on the live site (by clicking on a link generated by the CartItemSelector control or the GetAddToShoppingCartLink macro method).
E-commerce sites can store objects representing suppliers of products. Supplier data can be considered as personal only in cases where the supplier is a natural person.
Can be displayed on the live site by web parts using a product data source or via macros (for example in product details)
Name
SupplierDisplayName
SupplierName
User interface – displayed in the Suppliers application and when editing products in the Products or Pages application
Can be displayed on the live site by web parts using a product data source or via macros (for example in product details)
System data
SupplierID
SupplierGUID
SupplierLastModified
SupplierID and SupplierGUID – used as identifiers within the system
SupplierLastModified – timestamp set by the system
Suppliers – Personal data sources
Source
Data flow
Suppliers
Users with access to the administration interface manually create suppliers in the Suppliers application or directly from product editing forms (in the Products or Pages application).
Wishlist items are records representing relationships between products and users. Each record means that a user (customer) has added a given product to their wishlist on an e-commerce website. Wishlists are only available for customers who are registered as users.
Wishlist items – Stored personal data
Data
Column names
Purpose / Description
References to other entities
SKUID
UserID
Each item stores a reference to the product that was added to the wishlist and the related user
Used by the Wishlist web part to display wishlist content for users
Activities – activities of the Product added to wishlist type are logged when wishlist items are created
Wishlist items – Personal data sources
Source
Data flow
Wishlist
The system automatically creates wishlist items when a registered customer adds a product to their wishlist on the live site (by clicking on a link generated by the CartItemSelector control or the GetAddToWishListLink macro or API method).
The system stores records of sent emails according to the settings configured in the System -> Emails category of the Settings application. This includes:
Queued emails that are waiting to be sent to the SMTP server for mail out
Emails whose sending failed
Archived emails that were successfully sent (stored for a limited number of days)
EmailID and EmailGUID – identifiers used within the system
EmailCreated, EmailLastModified and EmailLastSendAttempt – timestamps used by the system
EmailLastSendResult – displayed in the Email queue application
For emails whose sending failed, stores error messages that may in some cases contain related email address values
References to other entities
EmailSiteID
EmailHeaders
EmailSiteID – the site for which the email was sent (0 for global emails)
EmailHeaders – custom email message headers that may contain references to related entities for certain types of emails (for example contact or subscriber identifiers)
Emails – Personal data sources
Source
Data flow
Administration interface
Various applications in the system provide an interface for sending emails or configuring email parameters. The input is then used to set the email address values and content of the given emails.
Email templates
Automated emails sent by the system load their email address values and content from Email templates.
Settings
Various settings configured by administrators are used to set the From and To addresses of sent emails.
SMTP servers
When sending of emails fails on the side of the used SMTP server, third-party error messages are saved into the EmailLastSendResult field (may contain email address values).
User entities
For emails related to user entities within the system (users, contacts, customers, etc.), the system automatically:
Sets From and To addresses based on the corresponding email address values stored for the given entity.
Saves the identifier referencing the given entity into the email's EmailHeaders field.
Web parts
Instances of certain web parts have properties that determine the From and To addresses of emails sent by the system.
Email feeds are an on-line marketing entity representing a newsletter or an email campaign. Email feeds are managed in the Email marketing application.
Email feeds – Stored personal data
Data
Column names
Purpose / Description
Email address
NewsletterSenderEmail
User interface – displayed in the Email marketing application
Used as the sender address of the feed's marketing emails and automatic subscription status notifications
Name
NewsletterSenderName
User interface – displayed in the Email marketing application
Used as the sender of the feed's marketing emails and automatic subscription status notifications
NewsletterID and NewsletterGUID – used as identifiers within the system
NewsletterLastModified – timestamp used by the system
Email feeds – Personal data sources
Source
Data flow
Email marketing
Users with access to the administration interface manually submit the name and email address of the sender in the Email marketing application.
Campaigns
Users with access to the administration interface manually submit the name and email address of the sender in the Campaigns application.
Email feeds – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is an email feed for activities of the Clicked link in marketing email, Opened marketing email, Subscription to a newsletter and Unsubscription from a single email feed types – i.e., when the value of the ActivityType column is newsletterclickthrough, newsletteropen, newslettersubscription or newsletterunsubscription.
Email feed issues represent individual emails related to an email feed. An email feed may contain multiple issues which can be viewed on the Emails tab of the email feed in the Email marketing application.
Issues – Stored personal data
Data
Column names
Purpose / Description
Email address
IssueSenderEmail
User interface – displayed in Email marketing application
Used as the sender address of marketing emails
Name
IssueSenderName
User interface – displayed in Email marketing application
IssueID and IssueGUID – identifiers used within the system
IssueLastModified and IssueMailoutTime – timestamps used by the system
References to other entities
IssueNewsletterID
IssueVariantOfIssueID
IssueNewsletterID – email feed to which the issue is related
IssueVariantOfIssueID – the original issue for emails that are A/B testing variants
Issues – Personal data sources
Source
Data flow
Related tables
Email feeds
When issues are created, the sender name and email address are preloaded from the related email feed.
Newsletter_Newsletter
Email marketing application
Users with access to the administration interface manually submit the name and email address of the sender in the Email marketing application.
Issues – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is an email feed issue for activities of the Opted out from all marketing emails type – i.e., when the value of the ActivityType column is newsletterunsubscriptionfromall.
Activities (OM_Activity)
ActivityItemDetailID
The additional object related to the logged activity is an email feed issue for activities of the Clicked link in marketing email, Opened marketing email and Unsubscription from a single email feed types – i.e., when the value of the ActivityType column is newsletterclickthrough, newsletteropen or newsletterunsubscription.
The email feed issue from which the given email address is unsubscribed.
Queued marketing emails (Newsletter_Emails)
EmailNewsletterIssueID
The issue related to the given queued email item. Queued emails are temporary objects created by the system when sending emails to individual recipients.
The Clicked link entity represents user actions of opening links in received marketing emails. Multiple clicks may be registered for the same email recipient and link if the user clicks the link multiple times. The purpose of this entity is to track how recipients react to marketing emails.
Clicked links – Stored personal data
Data
Column names
Purpose / Description
Email address
ClickLinkEmail
User interface – displayed in the Email marketing application in the Clicks report of individual emails
Matching clicked links to contacts – used for displaying contact demographic insights when viewing click details in the Overview report of individual emails in the Email marketing application
System data
ClickedLinkID
ClickedLinkGUID
ClickedLinkTime
ClickedLinkID and ClickedLinkGUID – identifiers used by the system
ClickedLinkTime – stores the time when the link was clicked, but the system does not display or process the value by default (the column is obsolete)
References to other entities
ClickedLinkNewsletterID
ClickedLinkNewsletterID – the email feed issue where the link was clicked
Clicked links – Personal data sources
Source
Data flow
Clicked links
New clicked links are registered and stored when a recipient clicks a link in a marketing email, including the recipient's email address.
The Opened email entity represents user actions of opening received marketing emails. The purpose of this entity is to track how users react to marketing emails.
Opened emails – Stored personal data
Data
Column names
Purpose / Description
Email address
OpenedEmailEmail
User interface – displayed in the Email marketing application in the Opens report of individual emails
Matching opened emails to contacts – used for displaying contact demographic insights when viewing open details in the Overview report of individual emails in the Email marketing application
System data
OpenedEmailD
OpenedEmailGUID
OpenedEmailTime
OpenedEmailID and OpenedEmailGUID – identifiers used by the system
OpenedEmailTime – displayed in the Email marketing application in the Opens report of individual emails
References to other entities
OpenedEmailIssueID
OpenedEmailIssueID – the related email issue
Opened emails – Personal data sources
Source
Data flow
Opened marketing emails
New opened emails are logged when a recipient opens an email in their email client for the first time, or when they click a link within the email. The saved data includes the recipient's email address and the open time.
SubscriberID and SubscriberGUID – identifiers used within the system
SubscriberLastModified – timestamp used by the system
References to other entities
SubscriberRelatedID
SubscriberType
SubscriberRelatedID – the subscribed contact or contact group object
SubscriberType – specifies the type of the subscribed object (contact or contact group)
Together both fields reference a contact or contact group, which is used to:
Get the recipient addresses when sending marketing emails
Provide information about the newsletter subscriptions of contacts/users in various parts of the administration interface and within live site components
Newsletter subscriptions – Personal data sources
Source
Data flow
Related tables
Subscription
Data of newsletter subscriptions is created or updated when:
Users or anonymous visitors fill in a newsletter subscription form on the live site (through the Newsletter subscription web part/widget or Custom subscription form web part).
Authenticated users manage their newsletter subscriptions (using the My subscriptions or My account web part on the live site, or the Users or My profile applications in the administration interface).
Users with access to the administration interface manually subscribe a contact to a newsletter in the Email marketing or Users application.
Contacts
The system automatically updates email address and name data of subscriptions when the related contact is updated (from any source).
OM_Contact
Newsletter subscriptions – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemDetailID
The additional object related to the logged activity is a newsletter subscription for activities of the Subscription to a newsletter type – i.e., when the value of the ActivityType column is newslettersubscription.
Queued marketing emails (Newsletter_Emails)
EmailSubscriberID
Subscription related to the given queued email item. Queued emails are temporary objects created by the system when sending emails to individual recipients.
Email feed unsubscriptions represent email addresses that are opted out from receiving newsletters and email campaigns. Unsubscriptions can either be for a specific email feed or all feeds in the system.
Unsubscriptions – Stored personal data
Data
Column names
Purpose / Description
Email address
UnsubscriptionEmail
User interface – displayed in the Email marketing application:
On the Opt-out list tab
In the Contact loss details of marketing email reports
Matching opted out email addresses to contacts – used to evaluate and display the "Receiving marketing email" status of contacts
UnsubscriptionNewsletterID – email feed from which the email address is unsubscribed (if the unsubscription is not for all email feeds)
UnsubscriptionFromIssueID – the specific email feed issue from which the recipient unsubscribed (only for unsubscriptions created via unsubscription links in marketing emails)
Unsubscriptions – Personal data sources
Source
Data flow
Marketing emails
New email feed unsubscriptions are created when recipients click unsubscription links in the content of marketing emails. The unsubscription links either target a default system page or a custom page where the Email feed unsubscription web part processes the request.
Email marketing application
Users with access to the administration interface manually add or edit email addresses in the opt-out list in the Email marketing application.
When a user in the administration interface initiates the sending of a marketing email issue, the system generates a sending queue of emails, with separate records for individual recipients. The queued emails are deleted immediately after sending is successfully finished.
Queued emails – Stored personal data
Data
Column names
Purpose / Description
Email address
EmailAddress
Email engine – sending of marketing emails to recipients
System data
EmailID
EmailGUID
EmaiIID and EmailGUID – identifiers used within the system
The system sends automatic emails for various purposes, such as password reset emails, workflow notifications, etc. The content of such emails is based on Email templates, which can also store email address values used for sender, copy and reply-to addresses.
Email engine – used to fill the email address header fields (sender, copy, reply-to) for emails based on templates. Typically sent automatically by the system.
User interface – displayed in the Email templates application
Sending of registration notification emails to attendees
Sending of mass emails to attendees from the Events application
Activities – logged activities of the Event booking type store and display the attendee email address
Processed to prevent multiple registrations of the same address to a single event (by the Event registration web part and when manually creating attendees in the Events application)
Displayed in the Events application when viewing event details on the Attendees tab
Displayed by the Event management dashboard widget when viewing event details
System data
AttendeeID
AttendeeGUID
AttendeeLastModified
AttendeeLastModified – timestamp used by the system
AttendeeID and AttendeeGUID – used as identifiers within the system
References to other entities
AttendeeEventNodeID
AttendeeEventNodeID – the page representing the related event (contains detailed information about the event, including the location and start/end date)
Event attendees – Personal data sources
Source
Data flow
Registration of event attendees
Users enter personal data when registering for an event on the live site through the Event registration web part.
Users with access to the administration interface manually create or edit attendees in the Events application.
Event attendees – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is an event attendee for activities of the Event booking type – i.e., when the value of the ActivityType column is eventbooking.
The system automatically creates records within an Event log to keep track of errors and many types of events. The event log helps administrators and developers find sources of problems, identify potential security threats, and monitor the behavior of the system.
Event log records – Stored personal data
Event log personal data purpose
All types of data stored within event log records can be used by the system in the following ways (depending on the configuration of settings):
Displayed in the Event log application
Displayed on dashboards by the EventLog widget
Sent within error notification emails (for error events)
Saved into the CMS\App_Data\logEvents.log file on the server's file system
Logged into the Windows Event Viewer on the server's operating system
Data
Column names
Description
Browser user agent
EventUserAgent
User agent providing information about the browser and operating system of the user or visitor who triggered the event
Event details
EventDescription
A detailed description of the event, which may contain personal data in certain cases. For example, if the Log metadata changes setting is enabled, the system logs events for all updates of objects, including the values of the modified object fields. If the given object field contains personal data, the values are stored in the description of the corresponding event.
IP address
IPAddress
The IP address of the user or visitor who triggered the event
Referring URL
EventUrlReferrer
The URL referrer of the web request during which the event occurred (for example may contain the URL of a site from which a visitor arrived)
User name
UserName
The user name of the user that triggered the event
System data
EventTime
EventID
EventTime – timestamp identifying when the event occurred
EventId – used as an identifier within the system
References to other entities
SiteID
UserID
SiteID – the site on which the event occurred
UserID – the user who triggered the event
Event log records – Personal data sources
Source
Data flow
System activity and user actions
The system logs events based on user actions or automated processes.
Not all types of personal data are logged for all events. Events that are not directly triggered by a user's web request do not contain any of the user-related data. Events that do not occur within the context of a specific site are global and do not reference a site, etc.
PoastParentID – the forum post under which the post was added (for forums that use a hierarchical tree structure for posts)
PostApprovedByUserID – the user responsible for approval of the post on moderated forums
PostUserID – the user who created the post
Forum posts – Personal data sources
Source
Data flow
Related table
Forums
Users submit forum posts on the live site (via forum web parts or widgets).
Users with access to the administration interface approve or edit posts in the Forums or Groups applications, or on the live site.
Users
Post signature values are loaded from the UserSignature column of the author's user settings.
CMS_UserSettings
Forum posts – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemDetailID
The additional object related to the logged activity is a forum post for activities of the Forum post type – i.e., when the value of the ActivityType column is forumpost.
Forum subscriptions (Forums_ForumSubscription)
SubscriptionPostID
The post for which the subscription was added. Also stores the ID of the subscribed user (in the SubscriptionUserID column).
References to Users and Forums (or individual forum posts) to which a given subscription is related
Used to store and display the subscriptions of a user
Forum subscriptions – Personal data sources
Source
Data flow
Forums
New forum subscriptions are created when:
Users subscribe to forums or specific posts on the live site (through forum web parts).
Users with access to the administration interface manually create subscriptions in the Forums or Groups application.
Forum subscriptions – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemDetailID
The object related to the logged activity is a forum subscription for activities of the Forum post subscription type – i.e., when the value of the ActivityType column is forumpostsubscription.
Stores the name of the user who last posted within the forum (ForumLastPostUserName for approved posts, ForumLastPostUserNameAbsolute includes unapproved posts)
Displayed in the following locations:
The Forums and Groups applications in the administration interface
Forum web parts (Forum group, Forum search results, Group forums)
ForumLastPostTime and ForumLastPostTimeAbsolute – stores the date and time when the last post was added to the forum (ForumlastPostTimeAbsolute includes unapproved posts)
Displayed in the administration interface in the Forums and Groups application, and within forum web parts and widgets
ForumID and ForumGUID – used as identifiers within the system
Forums – Personal data sources
Source
Data flow
Forums
When a new forum post is added, the system automatically updates the last user name and last post time values for the given forum.
Forums – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is a forum for activities of the Forum post and Forum post subscription types – i.e., when the value of the ActivityType column is forumpost or forumpostsubscription.
Boards-related web parts (Board messages data source, Group message board, Group message board viewer, Group message boards, Message board, Message board RSS feed, Message board viewer)
Boards-related web parts (Board messages data source, Group message board, Group message board viewer, Group message boards, Message board, Message board RSS feed, Message board viewer)
Boards-related web parts (Board messages data source, Group message board, Group message board viewer, Group message boards, Message board, Message board RSS feed, Message board viewer)
MessageBoardID – the message board where the post was added
MessageApprovedByUserID – the user responsible for approval of the post on moderated boards
MessageUserID – the user who created the post
Message board posts – Personal data sources
Source
Data flow
Message boards
Users submit message board posts on the live site.
Users with access to the administration interface approve or edit comments in the Message boards or Groups application, or on the live site.
Message board posts – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemDetailID
The additional object related to the logged activity is a message board post for activities of the Message board comment type – i.e., when the value of the ActivityType column is messageboardcomment.
SubscriptionLastModified – timestamp used by the system
SubscriptionID and SubscriptionGUID – used as identifiers within the system
References to other entities
SubscriptionBoardID
SubscriptionUserID
References to Users and Boards to which a given subscription is related
Used to store and display the subscriptions of users
Message board subscriptions – Personal data sources
Source
Data flow
Message boards
New message board subscriptions are created when:
The Subscribe to this board check box is selected while submitting a post.
A user submits their email address through the subscription form.
Users with access to the administration interface manually create subscriptions in the Message boards or Groups application.
Message board subscriptions – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemDetailID
The object related to the logged activity is a message board subscription for activities of the Message board subscription type – i.e., when the value of the ActivityType column is messageboardsubscription.
Message boards enable site visitors to comment on the content of particular pages. Each message board is related to a page on which it is placed, and optionally to a user or group.
Message boards – Stored personal data
Data
Column names
Purpose / Description
User name
BoardLastMessageUserName
Stores the name of the user who posted the board's last message, but the system does not display or process the value by default (the column is obsolete).
When a new message is posted on a message board, the BoardLastMessageTime and BoardLastMessageUserName of the given board are updated.
Message boards – References from entities containing personal data
Entity (Database table)
Column name
Description
Activities (OM_Activity)
ActivityItemID
The object related to the logged activity is a message board for activities of the Message board comment and Message board subscription types – i.e., when the value of the ActivityType column is messageboardcomment or messageboardsubscription.
Many types of objects in the system support versioning. If enabled, the system creates and stores separate versions of these objects when they are edited and saved. Object versions are also created when objects are deleted to the recycle bin. The recycle bin functionality can include objects that do not otherwise support versioning (for example personal data entities, such as users).
Every object version record stores all data of the original object in XML format, so any personal data contained in the given object is also stored in the version history. Users in the administration interface can restore objects from the recycle bin, or roll objects back to previous versions.
Object version history – Stored personal data
Data
Column names
Purpose / Description
Object data
VersionXML
Contains all data of the versioned or deleted object in XML format
Allows the system to restore deleted objects from the recycle bin, compare different versions of an object's history, or roll objects back to older versions
User interface – used and displayed in the following locations:
On the Versions tab when editing an object that supports versioning (see supported object types)
In the Recycle bin application on the Objects tab
By the Object recycle bin dashboard widget
Object name
VersionObjectDisplayName
Identifies the original object related to the version history record
May contain personal data for certain types of objects (for example a user name for user objects in the recycle bin)
VersionModifiedByUserID – the user who modified the versioned object
VersionDeletedByUserID – the user who deleted the object to the recycle bin
VersionObjectSiteID – the site to which the versioned or deleted object belongs
VersionObjectID and VersionObjectType – these two columns together reference the object to which the version history data belongs. VersionObjectType stores the type of the referenced object and VersionObjectID holds the identifier of a specific object.
Object version history – Personal data sources
Source
Data flow
Modification of versioned objects
Users in the administration interface update and save an object for which versioning is enabled, and the system creates a new record in the object's version history.
Deleting of objects to the recycle bin
Users in the administration interface (or scheduled/automated processes) delete an object, and the system creates a new object version history record for the recycle bin.
If monitoring of on-line users is enabled, along with the Settings -> Security & Membership -> Store on-line users in database setting, the system stores data about the sessions of authenticated and anonymous users who are currently connected to the website.
Information about the users is displayed in the Users and Contact management applications. The system allows users of the administration interface to perform actions, such as initiating chat and kicking users. The data can also be displayed on the pages of websites through the On-line users web part or widget.
On-line users – Stored personal data
Data
Column names
Purpose / Description
Email address
SessionEmail
Displayed in the administration interface on the On-line users tab in the Users and Contact management applications
Name
SessionFullName
SessionNickName
SessionUserName
Displayed in the administration interface on the On-line users tab in the Users and Contact management applications
Website location
SessionLocation
Stores the path of the user's current page
Displayed in the administration interface on the On-line users tab in the Users and Contact management applications
SessionLastActive, SessionLastLogon, SessionUserCreated – timestamps used by the system, displayed in the administration interface on the On-line users tab in the Users and Contact management applications
SessionID and SessionIdentificator – used as identifiers within the system
References to other entities
SessionUserID
SessionContactID
SessionUserID – the user related to the on-line user session (for authenticated users)
Processed by the On-line users web part and widget to display the data of authenticated on-line users
SessionContactID – the contact related to the on-line user session (if contact tracking is enabled)
Processed by the administration interface to allow viewing of contact details in the Users and Contact management applications
On-line users – Personal data sources
Source
Data flow
Related tables
Contacts
If contact tracking is enabled, the system sets the SessionContactID and transfers any available name and email address data from the contact related to the on-line user session.
OM_Contact
HTTP session
When the system creates or updates an HTTP session for a user or visitor on the website, the location and system data is automatically set for the matching on-line user record.
Users
For authenticated users, the system sets the SessionUserID and transfers any available name and email address data from the user related to the on-line user session.
ReportSubscriptionReportID – the report to which the subscription applies
ReportSubscriptionUserID – the user who created the subscription (the user does not need to match the subscription's email address)
ReportSubscriptionGraphID – a graph from the report for subscriptions to a specific graph (component that retrieves data and displays it in various formats)
ReportSubscriptionTableID – a table from the report for subscriptions to a specific table (component that retrieves data and formats it into a table)
ReportSubscriptionValueID – a value from the report for subscriptions to a specific value (component that retrieves a single scalar value)
Report subscriptions – Personal data sources
Source
Data flow
Reporting
Users with access to the administration interface can enter their email address and subscribe to reports displayed in various applications (Reporting, Web analytics, Store reports, Pages, A/B testing, MVT testing, Banners, Facebook, LinkedIn, Twitter)
Users with access to the Reporting application can manually create, edit or delete subscriptions for reports.
Authenticated users can subscribe to reports on the live site through web parts or widgets from the Reporting category.
SavedReportDate and SavedReportLastModified – timestamps used by the system
SavedReportID and SavedReportGUID – used as identifiers within the system
References to other entities
SavedReportReportID
SavedReportCreatedByUserID
SavedReportReportID – the original report
SavedReportCreatedByUserID – the user who saved the report
Saved reports – Personal data sources
Source
Data flow
Reporting
The system generates Saved Report HTML content when users in the administration interface manually save reports (for example in the Reporting, Store reports or Web analytics applications).
The system creates and stores the following types of synchronization tasks:
Export delete tasks – serve as representations of object delete operations, and can be included within Export packages.
Integration tasks – synchronize data with external systems or applications via the Integration bus. The system automatically deletes integration bus tasks after they are successfully processed.
Staging tasks – synchronize content and objects between different Kentico instances via Staging. The system automatically deletes staging tasks after they are successfully synchronized.
Web farm tasks – synchronize cached data and files between Kentico servers in a Web farm environment. The system automatically deletes web farm tasks after they are successfully processed.
Synchronization tasks store the data of the related object in XML format, so personal data contained in the given object can also be stored within corresponding tasks. This may include sensitive objects such as users, contacts or customers.
Export, Integration, and Staging tasks – Stored personal data
Data
Column names
Purpose / Description
Object data
TaskData
Contains data of the related object in XML format (may include sensitive objects such as users, contacts or customers)
Allows the system to synchronize objects to other instances or external systems (staging and integration tasks) or identify objects that need to be deleted when importing a package (export tasks)
User interface – the data can be viewed in the following locations:
In the Integration bus application (integration tasks)
In the Staging application (staging tasks)
For export tasks, the data can be included within export packages that the system creates on the file system.
Task name
TaskTitle
Describes the type of the synchronization task (create, delete, update, etc.) and identifies the related object
May contain personal data for certain types of objects (for example the user name of deleted or modified user objects)
In the Integration bus application (integration tasks)
In the Staging application (staging tasks)
In the Sites application on the Tasks tab of the View export history page, and in the export/import wizard (export tasks)
System data
TaskID
TaskTime
TaskID – used as an identifier within the system
TaskTime – timestamp storing the time when the task was logged (matches the time when the related create, update or delete action was performed)
References to other entities
TaskSiteID
TaskObjectID
TaskObjectType
TaskSiteID – the site for which the task was logged
TaskObjectID and TaskObjectType – these two columns together reference the object related to the synchronization task. The type of the referenced object is stored in the TaskObjectType column and TaskObjectID holds the identifier of a specific object.
Web farm tasks – Stored personal data
Data
Column names
Purpose / Description
Object data
TaskTextData
Stores data of the related object in XML format (may include sensitive objects such as users, contacts or customers). The data primarily includes object identifiers and/or names.
Allows the system to synchronize cached data and files between Kentico servers when running in a web farm environment
User interface – the data can be viewed in the Web farm application
System data
TaskID
TaskGUID
TaskCreated
TaskID and TaskGUID – used as identifiers within the system
TaskCreated – timestamp storing the time when the task was logged (matches the time when the related action was performed)
References to other entities
TaskTarget
Stores the type of the object related to the web farm task. Used to reference the related object in combination with the identifier data stored in the TaskTextData column.
Staging tasks – References from entities containing personal data
Entity (Database table)
Column name
Description
Staging task users (Staging_TaskUser)
TaskID
The system stores relationships between staging tasks and users. Every relationship indicates that the specified user performed the change which caused the system to log the given staging task (referenced in the TaskID column).
Export tasks – Personal data sources
Source
Data flow
Object deletion
If the Log export tasks setting is enabled, the system creates export tasks when an object is deleted (by a user in the administration interface or by a scheduled/automated process).
Integration tasks – Personal data sources
Source
Data flow
Object changes
If the Integration bus is enabled and appropriate connectors for outgoing synchronization are created in the system, the system logs integration tasks when objects are created, updated or deleted (by a user in the administration interface or by a scheduled/automated process).
External systems
If the Integration bus is enabled and appropriate connectors for incoming synchronization are created in the system, the system logs integration tasks based on data transfers from the related external application or system.
Staging tasks – Personal data sources
Source
Data flow
Object changes
If staging is enabled, the system logs staging tasks when pages or objects are created, updated or deleted (by a user in the administration interface or by a scheduled/automated process).
Manual staging synchronization
Users with access to the administration interface can manually run synchronization of objects, pages or custom table data in the Staging application.
Manual synchronization creates update staging tasks for the related objects and immediately runs them. All successfully synchronized tasks are immediately deleted.
Web farm tasks – Personal data sources
Source
Data flow
Object changes
If running in a web farm, the system logs synchronization tasks for every available server when objects are created, updated or deleted (by a user in the administration interface or by a scheduled/automated process).
Users are an entity representing people in Kentico. User accounts allow people to sign in on the live site and into the Kentico administration interface (depending on the user privilege level). New user accounts are typically created when a visitor goes through registration on the live site. However, administrators can also create accounts manually in the Users application.
The system stores user data within two coupled database tables – users (CMS_User) and user settings (CMS_UserSettings).
Users – Stored personal data
Data
Column names
Purpose / Description
Email address
Email
Email engine – sending various types of automated emails to users (notifications, password reset functionality, registration confirmation, etc.)
Used as the recipient address when sending emails to registered users (for example from the Users or Email queue applications)
Saved into the user's UserName field as an identifier if a separate value is not specified during registration
Used to validate email address values of new users if the Require unique user emails setting is enabled
Synchronized into the email address field of related customers and contacts (according to mapping configuration)
Saved into the email address field of corresponding on-line user objects (if tracking of on-line users is enabled)
Pre-filling of email address values for signed in users in various locations on the live website and the administration interface
Activities – saved into the titles of logged activities of the User registration and User login types
Avatars – used to generate Gravatar images for users
User interface – displayed as part of user information in various administration interface locations:
Users application
My profile application
Contact management application
User selection dialogs
Various lists of subscriptions (Reports, Forums, etc.)
Displayed on the live site through user-related and community web parts (User public profile, My profile, My account, listing web parts with a Users data source, etc.)
Last sign-in information
UserLastLogon
UserLastLogonInfo
UserLastLogon – the date and time of the user's last sign-in on the live website or into the administration interface
UserLastLogonInfo – stores the IP address and browser user agent of the user's environment at the time of their last sign-in
User interface – the last sign-in information is displayed in the Users application
Name
UserName
FirstName
MiddleName
LastName
FullName
UserName – serves as a unique identifier for users, most importantly when signing in (authentication)
Saved into the fields of various system objects to identify related users (event log records, staging tasks, security debug logs, etc.)
Stored as the value of the authentication cookie
Caching – username values are added to the names of cache keys to allow user-specific caching
FullName – the full name is automatically composed for each user from the first, middle and last name values (if not directly modified)
User interface – displayed throughout the administration interface to identify users
Displayed within user-related system emails based on the default email templates
Synchronized into the names fields of related customers and contacts (according to mapping configuration)
Saved into the name fields of corresponding on-line user objects (if tracking of on-line users is enabled)
Activities – user names are saved into the titles of logged activities of the User registration and User login types
Translation services – submissions for human translation services include an instructions file, which contains the full name of the user who created the submission (by default)
Displayed on the live site through user-related and community web parts (User public profile, My profile, My account,Current user, listing web parts with a , etc.)
Used to evaluate which non-activated users are automatically deleted based on the Delete non-activated users after (days) setting
Saved into the SessionUserCreated field of corresponding on-line user objects (if tracking of on-line users is enabled)
Displayed by user-related widgets (Workgroup administrators, Workgroup members, Recent users, Group administrators)
UserLastModified – timestamp used by the system
User settings – Stored personal data
Data
Column names
Purpose / Description
Contact information
UserPhone
UserSkype
UserIM
User interface – displayed in the Users and My profile applications
Can be displayed on the live site by the User public profile, My profile and My account web parts
UserPhone – synchronized into the phone number field of related customers
Descriptions
UserDescription
UserPosition
User interface – displayed in the Users and My profile applications
Can be displayed on the live site by the User public profile, My profile and My account web parts
External authentication IDs
WindowsLiveID
UserFacebookID
UserLinkedInID
Required for authentication via the corresponding external service. The IDs are valid only within the scope of the Kentico instance where they were generated.
UserRegistrationInfo – stores the IP address and browser user agent of the user's environment at the time of registration
UserCampaign – the name of a specific campaign if the user registered within the context of campaign
UserURLReferrer – the URL referrer of the web request during which the user registered (for example may contain the URL of a site from which a visitor arrived)
UserActivationDate – the date and time when the user account was activated via email confirmation or administrator approval
User interface – the registration information values are displayed when editing users in the Users application
System data
UserSettingsID
UserSettingsID – used as an identifier within the system
A user's last sign-in information is automatically updated when they sign in to the administration interface, or on the live site via the Logon form or Logon mini form web parts.
The following web parts allow sign-in via specific external authentication services: LinkedIn logon, LinkedIn required data, OpenID logon, OpenID required data, Windows LiveID, LiveID required data, Facebook Connect logon. These web parts collect various types of user data, and automatically set the external authentication ID, last sign in information and registration information (for new users).
Customers
When the name, email address and phone number data of a customer is modified, the system automatically synchronizes the values to the associated user.
If the Register customer after first checkout setting is enabled or if a checkout page contains the Register after checkout web part, the system automatically creates new users based on the data of anonymous customers when they complete the order checkout process.
Administrators can create new users based on customer data in the Customers application when editing an anonymous customer on the Login details tab. For registered customers, the same interface also allows administrators to change the password for the associated user account.
COM_Customer
Emergency administrator recovery
Emergency recovery of administration interface access via the CMSAdminEmergencyReset web.config key can create a new user with the Global administrator privilege level and a specified username and password.
Password change
Users can change their password on the live site through the Reset password web part (after submitting a password change request with email verification) or directly using the Change password or My account web part.
Registration
Visitors create new user accounts by submitting data through the Registration form or Custom registration form web parts. The web parts automatically collect and save the user's registration information.
Registration of new users is also possible via the Checkout process (obsolete) web part.
User activation
When new users activate their account via email confirmation, the UserActivationDate is automatically set in the user settings.
If the system is configured to require approval for new users, the UserActivationDate and UserActivatedByUserID values are automatically set in the user settings when an administrator approves an account in the Users application.
User editing
Users with access to the administration interface manually create users or edit user and user settings data in the Users application.
Users with access to the administration interface edit their data in the My profile application.
Authenticated users edit their data on the live site through the My account or My profile web parts.
Users – References from entities containing personal data
Entity (Database table)
Column name
Description
Abuse reports (CMS_AbuseReport)
ReportUserID
The user who submitted the abuse report.
Considered as personal data, because the ReportWhen column of the abuse report contains a timestamp that could be used to track the user's activity.
The object related to the logged activity is a user for activities of the User login and User registration type – i.e., when the value of the ActivityType column is userlogin or userregistration.
Blog comments (Blog_Comment)
CommentUserID
CommentApprovedByUserID
The user who posted the blog comment (for non-anonymous comments) and the user who approved the comment (for moderated blogs).
Blog comment subscription (Blog_PostSubscription)
SubscriptionUserID
The user related to the blog comment subscription.
Chat requests (Chat_InitiatedChatRequest)
InitiatedChatRequestUserID
The user for which the chat request is intended.
Chat users (Chat_User)
ChatUserUserID
The user account related to the given chat user object.
Community groups (Community_Group)
GroupApprovedByUserID
GroupCreatedByUserID
The user who created and approved the community group.
Community group invitations (Community_Invitation)
InvitedByUserID
InvitedUserID
The users related to the community group invitation.
The user related to the customer (for registered customers).
Dashboard and user widget content (CMS_Personalization)
PersonalizationUserID
The user who created the given dashboard or user widget content.
Considered as personal data, because the PersonalizationLastModified column of the personalization record contains a timestamp that could be used to track the user's activity.
Event log records (CMS_EventLog)
UserID
The user who triggered the logged event.
External authentication records (CMS_ExternalLogin)
UserID
The user related to the given external authentication record (for users created as a result of authentication via an external provider).
Favorite forums (Forums_UserFavorites)
UserID
The user who added the given forum or post to their favorites list.
Forum posts (Forums_ForumPost)
PostUserID
PostApprovedByUserID
The user who added the forum post and the user who approved the post (for moderated forums).
Forum subscriptions (Forums_ForumSubscription)
SubscriptionUserID
The user related to the forum subscription.
Media files (Media_File)
FileCreatedByUserID
FileModifiedByUserID
The users who created and last modified the given media file.
Considered as personal data, because the media file record contains timestamps that could be used to track the user's activity.
Message board posts (Board_Message)
MessageUserID
MessageApprovedByUserID
The user who added the message board post and the user responsible for approving the post (on moderated message boards).
Message board subscriptions (Board_Subscription)
SubscriptionUserID
The user related to the message board subscription.
Online users (CMS_Session)
SessionUserID
The user related to the on-line user session (for authenticated users).
OpenID authentication records (CMS_OpenIDUser)
UserID
The user related to the given OpenID authentication record (for users created as a result of OpenID authentication).
Orders (COM_Order)
OrderCreatedByUserID
The user who created the order (for registered customers).
The web analytics feature stores data as statistics representing individual tracked events. Each statistic contains the type of the event and information about the context in which the event occurred (i.e., a related object, site, and culture).
Web analytic statistics – Stored personal data
Web analytics store all types of logged statistics within the Analytics_Statistics database table. The type of each statistic is determined by the value of the StatisticsCode column. For statistics with the registereduser, browsertype, countries, mobiledevice and urlreferralsStatisticsCode values, the data stored in the additional StatisticsObjectName column could be considered as personal (see the table below).
Only the Registered users statistics are directly linked to specific visitors (via a reference to the related user object). The other statistics are anonymous and do not contain any references to entities representing a natural person.
Data
Column names
Purpose / Description
Browser type
StatisticsObjectName
Displayed in the Browser types report in the Web analytics application
Processed and displayed by reports under the Web Analytics -> Browser capabilities -> Browser types category (accessible in the Reporting application)
Country name
StatisticsObjectName
Displayed in the Countries report in the Web analytics application
Processed and displayed by reports under the Web Analytics -> Countries category (accessible in the Reporting application)
Mobile device type
StatisticsObjectName
Displayed in the Mobile devices in the Web analytics application
Processed and displayed by reports under the Web Analytics -> Mobiles devices category (accessible in the Reporting application)
Referring URL
StatisticsObjectName
Displayed in the Traffic sources reports in the Web analytics application
Processed and displayed by reports under the Web Analytics -> Referrals and Referring sites categories (accessible in the Reporting application)
User name
StatisticsObjectName
Displayed in the Registered users report in the Web analytics application
Processed and displayed by reports under the Web Analytics -> Registered users category (accessible in the Reporting application)
Note: Some sites may use email addresses as user name values
System data
StatisticsID
StatisticsID – used as an identifier within the system
References to other entities
StatisticsObjectID
StatisticsSiteID
StatisticsObjectID – the object related to the logged statistic. The type of the referenced object depends on the type of the statistic (stored in the StatisticsCode column). For example, the object is a user for records of the Registered users statistic.
Web analytic statistics – Personal data sources
Source
Data flow
Web analytics
The system saves values into the StatisticsObjectName column when logging web analytics for website visitors. For example, when a user registers on the site with Registered users web analytics enabled, the user name of the new user is saved.
Marketing automation processes and advanced workflows consist of steps, which may in certain cases contain personal data. The most common example are email address values in the From / To parameters of Send email steps.
Workflow and automation process steps – Stored personal data
Data
Column names
Purpose / Description
Step configuration
StepActionParameters
Stores the parameter configuration for the step in XML format, which may include personal data in certain cases (e.g. email address values for Send email steps)
System data
StepLastModified
StepID
StepGUID
StepLastModified – timestamp used by the system
StepID and StepGUID – used as identifiers within the system
Workflow and automation process steps – Personal data sources
Source
Data flow
Step editing
Users with access to the administration interface manually enter parameter values for steps in the workflow / process designer interface (within the Workflows or Marketing automation application).
Workflow and automation process steps – References from entities containing personal data
Entity (Database table)
Column name
Description
Automation process history (CMS_AutomationHistory)
HistoryStepID
HistoryTargetStepID
The marketing automation steps related to the history record for a given process. Such history records are logged automatically when automation processes transition between steps. The history record also stores the ID of the user who approved the transition.
Workflow history (CMS_WorkflowHistory)
StepID
TargetStepID
The workflow steps related to the version history record for a given page. Such history records are logged automatically when pages transition between workflow steps. The history record also stores the ID of the user who approved the transition.
Step security settings (CMS_WorkflowStepUser)
StepID
The workflow or automation step which has security settings assigned for specific users. Each record also stores the ID of the assigned user.