Why fepli does not erase some data
fepli stores personal data of families. Data protection requires erasing it as soon as it is no longer needed. Receipts, however, must be retained under tax law, and a consent applies until it is revoked. If you know how fepli reconciles the two, you understand what remains after an erasure.
Erasure after a period
Personal data should stay only as long as it is needed. Super admins set a retention period for this. When it has expired, fepli flags the participants for erasure or erases them itself at night, depending on the setting.
If no period is entered, two years after the last season apply. In this way a family that skips one summer is still there the next. This default period only flags: it sends no notice email and erases nothing by itself. Otherwise fepli would write to families or erase data although nobody had chosen a period.
Flagging is the more cautious way. Someone checks the list and confirms the erasure run. The log records who erased what and when.
On request, families receive a notice email beforehand. Anyone who registers again afterwards restarts the period. In this way nobody disappears who still uses the programme.
A notice email and flagging exclude each other. A notice announces an erasure on a date, and a list that someone confirms has none. It is therefore a choice of three options: flag, notice email followed by automatic erasure, or automatic erasure without notice. With flagging, no email goes to the family.
Files that families upload with a registration or send by email also have a period of their own: without an entry, one year after the end of their season. A swimming badge is needed as long as the offer is upcoming and for queries afterwards, but not as long as the registration itself. The registration and the message stay; only the file is deleted. Unlike receipts and proofs of consent, fepli deletes these files at night without any further setting: no retention obligation attaches to them that someone would have to check first.
Copies of sent emails and text messages have a period of their own, without an entry two years from sending. In this way a delivery can still be clarified if a family asks months later. Here too fepli erases nothing by itself; deletion at night happens only when someone selects Automatic in the row Emails and text messages. The conversations on the record and the dispatch log stay.
The dispatch log records, without texts, who received which message and when. The nightly runs use it to recognise whether a reminder or list has already been sent; if the entry were missing, they would send it again. Entries on current offers and seasons therefore stay beyond the period, as do entries on messages in the outbox. Without a period of its own, three years apply, one year longer than for the copies, so that the proof of dispatch outlasts its text; deletion at night here too happens only with Automatic.
Why registrations and receipts stay
If a family has paid, a receipt exists. Under tax and commercial law, receipts must stay unchanged for years; without a setting of its own, it is eight years. Their line items refer to registrations with offer and fee. fepli therefore never erases a person's registrations along with the person.
fepli pseudonymises them: a registration loses its link to the participant, as well as their answers, files and comments. For a registration without an account, the address is also removed. Offer, status, fee and age stay so that receipts, places and statistics remain correct. The billing details on the receipt itself stay because of the retention obligation.
The pseudonym keeps the registrations of an erased person together so that the statistics of a season can count children. If a period is entered in the row Pseudonyms, fepli removes it that many years after the end of the season. The registrations then stay but belong to nobody any more. This is switched off by default, because the statistics of those seasons then no longer count individual children.
Once the retention period has expired, a run under Data subject rights removes name, address and email address from the receipts. Amount, number and line items stay, because bookkeeping and statistics access them and the number sequence is to have no gap. Together with the details, the run deletes the receipt's stored PDF, because it names the payer just as much. A super admin starts the run; it runs at night only when someone selects Automatic in the row Receipts.
Why consents stay
A consent permits something that goes beyond participation. The photos from the tent camp are still on the club's website when the family has long since deleted its account. As long as nobody revokes it, the consent continues to apply, and the club must be able to prove it.
fepli therefore does not erase a given consent along with the person. The entry loses its connection to account and participant and keeps the name. Without a name it would be no proof, and nobody could revoke the consent later.
Anyone who has their data erased often also means the revocation, but not always. Some families want to get rid of their account and have nothing against the photos of last summer. fepli does not decide that for them: every deletion dialog asks, and without an answer the consent stays. The erasure run asks nobody and therefore revokes nothing.
A revocation helps the family only if whoever holds the photos learns of it. fepli therefore sends an email to the organizers after every revocation, and for a consent of the season also to the team. The email gives the person's name, unlike the other emails to organizers. After an erasure, only a pseudonym appears in the participant list.
Not every consent reaches that far. A swimming permission is settled when the offer is over. The Duration of a declaration determines when that is.
After a consent has ended, its proof is still needed in case someone later doubts the processing. After the period in the row Proofs of consent, fepli erases it too. Without a setting of its own, that is three years from the end of the year, because claims can usually be asserted that long.
A declined declaration permitted nothing and proves nothing. It belongs to the person's data and is erased with them.
Why an objection to measuring stays
Whoever objects to the measuring of email opens (Art. 21 GDPR) does not want to be measured even after the account is deleted and the address turns up again. If fepli dropped the objection with the account, the same address would count as “no decision” again.
For this reason fepli keeps a hash of the email address for an objection, with the time and means of the objection. It keeps neither the address itself, nor the name, nor the link to the account. The hash applies until an account with that address takes the objection over. There is no period, because an objection does not end by itself.
A consent to measuring, by contrast, ends with the account, and whoever never decided leaves nothing. In both cases fepli deletes the contact it created at Brevo for the decision. No address remains in clear text after the erasure.
Why every erasure runs the same way
A person can be erased in five places: on the website by the family itself, under Accounts or Participants, in the case file of the data subject rights, through the API and in the erasure run. All routes erase the same data. In this way the same remains of a person whoever erases them, and receipts and statistics are correct afterwards.
Registrations for offers that are still upcoming are first set to withdrawn by fepli. The places then go to the waiting list as after any withdrawal; otherwise an erased person would hold places. Only then are the registrations pseudonymised and account and participants deleted, with contact details, addresses, passkeys and emails.
For the payment obligation, the rules of withdrawal by the family apply. In the free period and with an immediate cancellation it lapses. After the deadline Free of charge until before the start it stays, as it does where Not at all after the period or Not after the registration deadline block the withdrawal. Otherwise deleting the account would be a way to avoid a fee.
fepli does not itself pay back paid fees whose payment obligation lapses. Every deletion dialog therefore names them beforehand, and afterwards the registrations are under Refund due until the team has refunded them.
A fee that would still be open after the erasure could no longer be billed to anyone, because the registration then belongs to no account. A family therefore deletes its account only once it has paid. Until then the website shows it the open fees.
The team decides for itself. Its deletion dialogs name open fees beforehand so that it can settle them or remove the payment obligation; it can still delete. Erasures through the API and in the erasure run do not wait for open fees either.
Every erasure appears in the log of the data subject rights, with the route by which it was triggered. The log keeps the person's identifier; it removes their name from earlier entries too. Otherwise the log would remain the last thing that still makes the person identifiable.
Erase or restrict?
Anyone who restricts processing erases nothing. The data stays stored, but fepli includes it neither in lotteries nor in newsletters or erasure runs. This fits as long as a person disputes the accuracy of their data or rejects the erasure and demands retention.
A restriction therefore often means that the person wants to keep their data. fepli then blocks every erasure except the erasure through a request under Data subject rights. On the website too, the family cannot then delete its account itself; it must contact the team.
Restricting a participant also blocks deleting their account, because the account would take them along when deleted. Restricting an account blocks deleting its participants, just as it applies to them in the lottery and in moving up.
Why the route runs through the data subject rights
The log records every erasure, but only the case file of the data subject rights connects it with a request. There the identity is verified and the deadline visible, and the log entry refers to the reference number. The request keeps the name as proof, the log only the identifier.
The case file also shows beforehand what happens to the data of each category. It is the only route that bypasses a restricted processing, because only here is there a verified request from the person. If a person demands the erasure of their data, the route therefore runs through their request.