Written by DROPS.ST.
Map customer information from its collection point to its purpose, destination and responsible owner. Use record categories and verified descriptions, not customer values. Mark an unknown transfer as unknown rather than completing the diagram from a vendor logo or assumption.
DROPS links Customer Accounts with orders and items, giving a cannabis-shop team a concrete core relationship to start from. Website and connected Telegram shopping share the catalogue and order path. Those facts do not automatically describe every outside service, copied file or support conversation around the shop.
Start with one actual task
Choose a bounded task such as placing an order or answering an order question. Identify the information involved and which parts are needed for that task.
A form label, staff note, contact route and exported file are different collection or copying points. Do not combine them into one vague box called “customer data.”
The OPC’s privacy-management guidance recommends examining the personal information held, where it is held and why it is collected, used or disclosed. Use that inventory principle with the requirements applicable to your business. OPC privacy-management guidance.
Use an information-flow worksheet
This original worksheet describes questions to verify. It is not a confirmed list of DROPS processors or native mapping software.
| Map entry | What to establish | Evidence or owner |
|---|---|---|
| Collection point | Actual form, conversation or task | Current documented workflow |
| Information category | Contact, order item or other necessary category | Field list without real values |
| Identified purpose | Decision or service the information supports | Responsible business owner |
| Recipient or copy | Internal record, working file or verified connected service | Actual interface or provider description |
| Access responsibility | Who may handle it for the task | Supported permissions and approved process |
| Retention responsibility | Applicable treatment and copies needing review | Named owner and relevant policy |
Draw a connection only after establishing what moves and why. “Connected” does not prove every field transfers, and “technical service” does not prove no personal information is involved.
Separate a core relationship from an external transfer
Customer-linked order items establish a relationship within the shop’s working records. A separate provider or download creates another scope to assess.
Ask for the actual fields, recipient, purpose and owner of that transfer. Do not name a payment, analytics, email or support provider unless its involvement in the reviewed workflow is verified. A marketing page alone is not a deployed data-flow description.
The data-location guide addresses where storage, access and processing occur. This worksheet answers what information moves between the confirmed points.
Hypothetical example: an optional support copy
A fictional shop proposes sending a limited order reference to an optional support process. The owner maps the original collection point, intended purpose and proposed recipient before enabling anything.
They discover that the available output would include unrelated contact details. The map records that gap and names the person who must resolve the scope. It does not mark the transfer approved merely because the tool can produce a file.
This hypothetical proposal describes no actual DROPS third party or active connection.
Check the map with synthetic records
Use an agreed demonstration and fictional field values. Confirm the relevant inputs, resulting records and any approved copied output. Inspect only the necessary scope and avoid creating real customer exports to illustrate the map.
Before a platform move, compare the required public and staff views with the proposed setup using fictional values. Include copied files and provider evidence in that review. A matched catalogue or AI-assisted product plan does not establish customer-record migration or privacy acceptance.
Record which connections are demonstrated, documented or still uncertain. If evidence conflicts, identify the exact question and owner rather than choosing the more reassuring description.
DROPS order and account downloads have different access guards. A permitted download does not establish appropriate onward distribution or complete privacy-response coverage. The export guide explains that separate decision.
Keep the map current enough to use
Review affected entries when the business changes a form, adds a connection, changes an approved purpose or creates another working-copy process. Assign responsibility for the update.
Use the map when coordinating a customer privacy request, but do not treat it as proof that every record or recipient has been found. A complete response needs the actual search and decision process.
DROPS supplies connected customer and order context. Pair that foundation with a verified purpose-and-recipient map so the team can explain the information handling around its shop.
Explore DROPS.ST and the shop demos. Start with one fictional order task, identify its categories and leave unverified connections visibly open for review.