GDPR disclosure & deletion for a contact

When do you need this?

If a person formally requests access under Art. 15 GDPR or deletion under Art. 17 GDPR, you must respond within one month. Theatilo offers both directly on the contact.

Access (Art. 15 GDPR)

1. Open the contact.
2. Click "Privacy" › "GDPR data export (JSON)".
3. A file with all stored details is downloaded: basic details, tags and links to invoices, transactions and events.

The access request is logged.

Deletion (Art. 17 GDPR, "right to be forgotten")

1. Open the contact.
2. Click "Privacy" › "GDPR deletion".
3. Read what happens to linked records and type DELETE to confirm.
4. Click "Delete permanently".

What Theatilo does:

• Cash book transactions: name, IBAN and address are transferred into the transaction if empty there. Values entered by hand stay untouched.
• Invoices and manual invoices: recipient details are added if fields are empty.
• Links to events: are removed without replacement.
• Then the contact with its tags and links is deleted for good.

Afterwards Theatilo shows how many records were completed and links removed. The deletion is logged.

Archiving vs. GDPR deletion

Archiving only hides the contact and can be undone at any time. GDPR deletion removes it for good. For a formal request under Art. 17 GDPR you need the real deletion.

Permissions

You need Handle GDPR requests. By default only administrators have it.