Developer Handover Pack

Developer Handover Pack

GDPR / Data Privacy Request Handling

Receives a structured Typeform submission the moment a data subject submits a privacy request. The agent classifies the request type (Subject Access Request, erasure, or rectification), creates a structured case record in Notion with the submission timestamp and calculated 30-day deadline, and dispatches a templated identity verification email via Gmail, all without any manual input. This agent is the entry point for every case and is responsible for the completeness and accuracy of the initial Notion record, which becomes the single source of truth for the entire workflow.

// Input (from Typeform webhook payload)
form_response.answers.requester_full_name       // string
form_response.answers.requester_email           // string, validated email format
form_response.answers.request_type             // enum: SAR | erasure | rectification
form_response.answers.additional_context       // string, optional free text
form_response.submitted_at                     // ISO 8601 timestamp

// Output (written to Notion case record)
notion.case_id                                  // auto-generated Notion page ID
notion.requester_name                           // mapped from requester_full_name
notion.requester_email                          // mapped from requester_email
notion.request_type                             // mapped from request_type
notion.submission_date                          // mapped from submitted_at
notion.deadline_date                            // submitted_at + 30 calendar days
notion.identity_status                          // default: 'Pending'
notion.case_status                              // default: 'Open'

// Output (Gmail verification email)
gmail.to                                        // requester_email
gmail.subject                                   // 'Your privacy request has been received - action required'
gmail.body                                      // templated: includes request_type, deadline_date, ID requirements
gmail.sent_timestamp                            // recorded back to Notion case record

Activates once a reviewer marks the Identity Status field in the Notion case record as 'Confirmed'. The agent queries HubSpot via its API to retrieve all records associated with the requester, including contact properties, deal history, associated notes, and logged email history. It then compiles the retrieved data into a structured draft response package within the Notion case record, formats it according to the request type (SAR data export, erasure confirmation, or rectification summary), and sends a Slack notification to the assigned reviewer with a direct link to the case record and approval prompt. The agent does not send any external communication and does not proceed beyond Slack notification without explicit reviewer approval logged in Notion.

// Input (read from Notion case record on trigger)
notion.case_id                                  // page ID of the active case
notion.requester_name                           // used as HubSpot search parameter
notion.requester_email                          // primary HubSpot lookup key
notion.request_type                             // SAR | erasure | rectification
notion.deadline_date                            // surfaced in Slack notification
notion.identity_status                          // must equal 'Confirmed' before execution

// HubSpot API queries (private app token, v3 CRM API)
GET /crm/v3/objects/contacts?email={requester_email}   // resolve contact ID
GET /crm/v3/objects/contacts/{contact_id}?properties=  // all contact properties
GET /crm/v3/objects/deals?associations.contact={id}    // associated deals
GET /crm/v3/objects/notes?associations.contact={id}    // associated notes
GET /crm/v3/objects/emails?associations.contact={id}   // logged email history

// Output (written to Notion case record as draft response block)
notion.hubspot_contact_properties               // JSON snapshot stored in case page
notion.hubspot_deals_summary                   // list of deal names, stages, values
notion.hubspot_notes_log                        // list of note bodies and dates
notion.hubspot_email_log                        // list of email subjects and timestamps
notion.draft_response_status                   // set to 'Awaiting Review'
notion.data_retrieved_timestamp                // ISO 8601 timestamp of retrieval

// Output (Slack notification to reviewer)
slack.channel                                   // #privacy-reviews or DM to assigned reviewer
slack.message                                   // includes case_id, requester_name, request_type, deadline_date, Notion case URL
slack.sent_timestamp                            // recorded back to Notion case record

// On approval (reviewer sets Notion approval field to 'Approved')
gmail.to                                        // requester_email
gmail.subject                                   // dynamically set by request_type
gmail.body                                      // compiled from notion draft response block
notion.case_status                              // updated to 'Closed'
notion.response_sent_timestamp                 // ISO 8601 timestamp
notion.reviewer_name                            // name of approving reviewer
notion.outcome                                  // SAR sent | Data erased | Data corrected

// ── TRIGGER ─────────────────────────────────────────────────────────────────
// Event: Typeform 'Privacy Request Intake' form submitted
TYPEFORM_WEBHOOK_PAYLOAD {
  form_response.answers.requester_full_name     // string
  form_response.answers.requester_email         // string
  form_response.answers.request_type           // 'SAR' | 'erasure' | 'rectification'
  form_response.answers.additional_context     // string, optional
  form_response.submitted_at                   // ISO 8601
}

// ── AGENT 1: INTAKE AND TRIAGE AGENT ────────────────────────────────────────
// Step A: Dedupe check against Notion cases database
NOTION_QUERY {
  filter: requester_email == TYPEFORM.requester_email
         AND case_status IN ['Open', 'In Progress']
         AND submission_date >= NOW() - 60 days
  result: if match found -> SLACK_ALERT(duplicate) -> HALT
          if no match   -> CONTINUE
}

// Step B: Create Notion case record
NOTION_DATABASE_CREATE {
  Case ID           <- auto-generated Notion page ID
  Requester Name    <- TYPEFORM.requester_full_name
  Requester Email   <- TYPEFORM.requester_email
  Request Type      <- TYPEFORM.request_type
  Submission Date   <- TYPEFORM.submitted_at
  Deadline Date     <- TYPEFORM.submitted_at + 30 days
  Identity Status   <- 'Pending'
  Case Status       <- 'Open'
}

// Step C: Send identity verification email via Gmail
GMAIL_SEND {
  to       <- TYPEFORM.requester_email
  subject  <- 'Your privacy request has been received - action required'
  body     <- TEMPLATE(request_type, deadline_date, id_requirements)
  on_send  -> NOTION_UPDATE { Verification Email Sent: true, Sent Timestamp: NOW() }
}

// ── HUMAN GATE 1: IDENTITY VERIFICATION ─────────────────────────────────────
// Reviewer examines returned ID documents and updates Notion manually
// NOTION.identity_status set to 'Confirmed' | 'Failed'
// If 'Failed': process owner sends follow-up email (manual exception path)
// If 'Confirmed': triggers Agent 2

// ── AGENT 2: DATA DISCOVERY AGENT ───────────────────────────────────────────
// Trigger: NOTION.identity_status == 'Confirmed' (polling / webhook)

// Step D: Resolve requester in HubSpot
HUBSPOT_API_GET /crm/v3/objects/contacts {
  filter_groups[0].filters[0].propertyName: 'email'
  filter_groups[0].filters[0].value: NOTION.requester_email
  result: contact_id  // if null -> NOTION_UPDATE('No CRM record found') -> SLACK_ALERT -> HALT
}

// Step E: Retrieve all CRM data for contact
HUBSPOT_API_GET /crm/v3/objects/contacts/{contact_id} {
  properties: firstname, lastname, email, phone, createdate, hs_lead_status
  result: contact_properties
}
HUBSPOT_API_GET /crm/v3/objects/deals?associations.contact={contact_id} {
  result: deals_list [ deal_name, deal_stage, amount, closedate ]
}
HUBSPOT_API_GET /crm/v3/objects/notes?associations.contact={contact_id} {
  result: notes_list [ body, createdate, owner ]
}
HUBSPOT_API_GET /crm/v3/objects/emails?associations.contact={contact_id} {
  result: email_log [ subject, sent_at, direction ]
}

// Step F: Compile draft response in Notion
NOTION_PAGE_UPDATE (case_id) {
  hubspot_contact_properties   <- contact_properties (JSON block)
  hubspot_deals_summary        <- deals_list
  hubspot_notes_log            <- notes_list
  hubspot_email_log            <- email_log
  manual_check_section         <- ['Billing system', 'Support platform', 'Offline records']
  draft_response_status        <- 'Awaiting Review'
  data_retrieved_timestamp     <- NOW()
}

// Step G: Notify reviewer via Slack
SLACK_MESSAGE {
  channel  <- #privacy-reviews
  text     <- TEMPLATE(case_id, requester_name, request_type, deadline_date, notion_case_url)
  on_send  -> NOTION_UPDATE { Reviewer Notified Timestamp: NOW() }
}
// If NOTION.reviewer_approval != 'Approved' within 72 hours:
SLACK_MESSAGE { text: 'Reminder: case {case_id} approval still pending. Deadline: {deadline_date}' }

// ── HUMAN GATE 2: REVIEWER APPROVAL ─────────────────────────────────────────
// Reviewer reads Notion draft, annotates if needed, sets Reviewer Approval: 'Approved'
// Platform polls NOTION.reviewer_approval field
// If 'Approved' -> CONTINUE
// If annotated  -> process owner revises draft -> resets field -> re-notifies Slack

// Step H: Send approved response via Gmail
GMAIL_SEND {
  to       <- NOTION.requester_email
  subject  <- TEMPLATE(request_type)  // e.g. 'Your Subject Access Request response'
  body     <- compiled from NOTION draft response block
  on_send  -> NOTION_UPDATE { Response Sent Timestamp: NOW() }
}

// Step I: Close case and update audit log in Notion
NOTION_PAGE_UPDATE (case_id) {
  Case Status              <- 'Closed'
  Response Sent Timestamp  <- NOW()
  Reviewer Name            <- NOTION.last_editor_name
  Outcome                  <- TEMPLATE(request_type)  // 'SAR sent' | 'Data erased' | 'Data corrected'
}

// ── END OF FLOW ──────────────────────────────────────────────────────────────