# VCDPA Compliance Assessment Report

## Organization Information

| Field | Value |
|-------|-------|
| **Organization** | Liberty Commerce Inc. |
| **Assessment Date** | 2026-03-14 |
| **Assessor** | Robert Kim, Data Protection Officer |
| **Virginia Consumer Count** | 145,000 |
| **Revenue from Data Sale** | 12% |
| **Applicable** | Yes — meets threshold (1): 100,000+ Virginia consumers |

## Consumer Rights Implementation

| Right | Section | Implemented | Channel | Response SLA |
|-------|---------|-------------|---------|-------------|
| Access | §59.1-577(A)(1) | Yes | Web portal, email | 45 days |
| Correct | §59.1-577(A)(2) | Yes | Web portal, email | 45 days |
| Delete | §59.1-577(A)(3) | Yes | Web portal, email | 45 days |
| Portability | §59.1-577(A)(4) | Yes | Web portal (JSON export) | 45 days |
| Opt-out: targeted ads | §59.1-577(A)(5) | Yes | Privacy page toggle | Immediate |
| Opt-out: sale | §59.1-577(A)(5) | Yes | Privacy page toggle | 15 business days |
| Opt-out: profiling | §59.1-577(A)(5) | Yes | Privacy page toggle | 15 business days |
| Appeal | §59.1-578(C) | Yes | Email to privacy@libertycommerce.com | 60 days |

## Sensitive Data Processing

| Category | Collected | Consent Mechanism | Purpose | Opt-in Rate |
|----------|-----------|-------------------|---------|-------------|
| Precise geolocation | Yes | Checkbox at first use | Delivery tracking, store finder | 78% |
| Racial/ethnic origin | Yes (optional survey) | Checkbox on survey form | Aggregate diversity reporting | 23% |
| Health information | Inferred from purchases | Not collected directly — exemption assessment pending | Product recall notifications | N/A |

## Data Protection Impact Assessments

| DPIA ID | Activity | Trigger | Risk Score | Status | Next Review |
|---------|----------|---------|------------|--------|-------------|
| DPIA-VA-001 | Targeted advertising (AdReach) | §59.1-580(A)(1) | MEDIUM | Approved | 2026-09-14 |
| DPIA-VA-002 | Marketplace seller data sale | §59.1-580(A)(2) | MEDIUM | Approved | 2026-09-14 |
| DPIA-VA-003 | Buy-now-pay-later credit scoring | §59.1-580(A)(3) | HIGH | Under review | — |
| DPIA-VA-004 | Precise geolocation processing | §59.1-580(A)(4) | LOW | Approved | 2027-01-14 |
| DPIA-VA-005 | Diversity survey (sensitive data) | §59.1-580(A)(4) | LOW | Approved | 2027-01-14 |

## Processor Agreements

| Processor | Purpose | Agreement Status | Includes Required Terms |
|-----------|---------|-----------------|------------------------|
| PaySecure Corp. | Payment processing | Executed | Yes — all §59.1-579 terms |
| SwiftShip Logistics | Shipping and delivery | Executed | Yes |
| DataInsight Analytics | Analytics | Executed | Yes |
| AdReach Network | Targeted advertising | Executed | Yes |
| CloudStore Hosting | Infrastructure | Executed | Yes |

## Privacy Notice Checklist

| # | Item | Section | Status |
|---|------|---------|--------|
| 1 | Categories of PI processed | §59.1-578(B)(1) | PASS |
| 2 | Purposes for each category | §59.1-578(B)(2) | PASS |
| 3 | Consumer rights exercise instructions | §59.1-578(B)(3) | PASS |
| 4 | Appeal process instructions | §59.1-578(B)(3) | PASS |
| 5 | Categories of data shared with third parties | §59.1-578(B)(4) | PASS |
| 6 | Categories of third parties | §59.1-578(B)(5) | PASS |
| 7 | Contact information | §59.1-578(B)(6) | PASS |
| 8 | Sale disclosure | §59.1-578(B) | PASS |
| 9 | Targeted advertising disclosure | §59.1-578(B) | PASS |
| 10 | Profiling disclosure | §59.1-578(B) | PASS |

## Sign-Off

| Role | Name | Date |
|------|------|------|
| DPO | Robert Kim | 2026-03-14 |
| Legal | Marcus Chen | 2026-03-14 |
| CPO | Sarah Mitchell | 2026-03-14 |