# Art. 34 Data Subject Notification — Checklist and Tracking Log

## Pre-Dispatch Checklist

### Content Verification

- [ ] Nature of breach described in clear, plain, non-technical language
- [ ] DPO contact details included (Dr. Elena Vasquez, dpo@stellarpayments.eu, +49 30 7742 8001)
- [ ] Likely consequences described in terms the average person understands
- [ ] Measures taken by the controller described (containment + remediation)
- [ ] Actionable protective steps for the data subject included
- [ ] Communication is standalone (not bundled with marketing or routine correspondence)
- [ ] Subject line clearly identifies this as a security/breach notification
- [ ] Credit monitoring enrollment instructions included (if applicable)
- [ ] Supervisory authority complaint information included

### Art. 34(3) Exemption Assessment

- [ ] Art. 34(3)(a) encryption exemption evaluated — result: NOT EXEMPT (keys compromised)
- [ ] Art. 34(3)(b) subsequent measures exemption evaluated — result: NOT EXEMPT (ongoing investigation)
- [ ] Art. 34(3)(c) disproportionate effort exemption evaluated — result: NOT EXEMPT (92% valid contacts)

### Language and Accessibility

- [ ] German version reviewed and approved
- [ ] English version reviewed and approved
- [ ] French version reviewed and approved
- [ ] Dutch version reviewed and approved
- [ ] Readability score: Flesch-Kincaid Grade Level 8 or below
- [ ] No technical jargon or unexplained acronyms
- [ ] Large print version available on request

### Legal Review

- [ ] In-house legal counsel sign-off: Sarah Chen, General Counsel — 14 March 2026
- [ ] External counsel review: Freshfields Bruckhaus Deringer — 14 March 2026
- [ ] No inadvertent admissions of liability
- [ ] No waiver of legal privilege
- [ ] Compliant with all applicable jurisdictions

### Support Infrastructure

- [ ] Breach hotline activated: +49 30 7742 9000
- [ ] Hotline operators trained with FAQ document (version 1.2, 14 March 2026)
- [ ] Hotline staffing confirmed: 10 operators per shift for initial 2 weeks
- [ ] Breach support web page live: stellarpayments.eu/breach-support
- [ ] Auto-acknowledgment configured for breach-support@stellarpayments.eu
- [ ] Credit monitoring enrollment portal activated: stellarpayments.eu/breach-support/enroll
- [ ] Activation codes generated and assigned to each affected data subject

## Communication Dispatch Log

### Email Distribution

| Batch | Date | Time (UTC) | Recipients | Delivered | Bounced | Status |
|-------|------|-----------|------------|-----------|---------|--------|
| 1 | 16 March 2026 | 06:00 | 10,000 | 9,847 | 153 | Complete |
| 2 | 16 March 2026 | 07:30 | 4,012 | 3,965 | 47 | Complete |
| **Total** | | | **14,012** | **13,812** | **200** | **Complete** |

### Postal Distribution

| Batch | Date | Recipients | Method | Tracking | Status |
|-------|------|------------|--------|----------|--------|
| Email bounces | 18 March 2026 | 200 | Registered mail | Yes | Dispatched |
| No-email group | 17 March 2026 | 1,218 | Registered mail | Yes | Dispatched |
| **Total** | | **1,418** | | | **Dispatched** |

### Supplementary Channels

| Channel | Date | Recipients | Status |
|---------|------|------------|--------|
| In-app notification | 16 March 2026 | 14,012 | Active — triggers on next login |
| SMS alert | 16 March 2026 | 10,661 | Sent |
| Website banner | 16 March 2026 | N/A (public) | Live at stellarpayments.eu |

## Post-Dispatch Monitoring

### Week 1 Metrics (16-22 March 2026)

| Metric | Value |
|--------|-------|
| Email open rate | 73.2% |
| Hotline calls received | 2,847 |
| Average call duration | 4.2 minutes |
| Web portal unique visitors | 8,934 |
| Credit monitoring enrollments | 6,218 (40.8% of affected) |
| Data subject rights requests (Art. 15) | 34 |
| Supervisory authority complaints | 2 |
| Media inquiries | 7 |

### Week 2 Metrics (23-29 March 2026)

| Metric | Value |
|--------|-------|
| Email open rate (cumulative) | 81.4% |
| Hotline calls received | 1,203 |
| Credit monitoring enrollments (cumulative) | 9,412 (61.8% of affected) |
| Data subject rights requests (cumulative) | 67 |
| Supervisory authority complaints (cumulative) | 3 |

### Escalated Issues

| Issue | Date | Resolution |
|-------|------|-----------|
| 12 data subjects report they were not in our customer database | 17 March 2026 | Investigated — confirmed records from a legacy system migration in 2024. Accurate notification. |
| 3 data subjects request immediate account closure | 18 March 2026 | Processed under Art. 17 erasure right within 72 hours |
| Frankfurter Allgemeine Zeitung publishes article on the breach | 19 March 2026 | Communications team issued prepared statement; CEO interview conducted |

## Final Summary

| Element | Status |
|---------|--------|
| Total data subjects notified | 15,230 |
| Notification channels used | Email, postal mail, SMS, in-app, website |
| Time from risk assessment to first notification | 3 calendar days |
| Art. 34(2) compliance | Verified — all mandatory content elements present |
| Credit monitoring enrollment (final) | 11,847 (77.8%) |
| Complaints to supervisory authority | 5 |
| Supervisory authority follow-up | Berliner BfDI acknowledged notification; no further action to date |