Data subject rights

In the Data subject rights area, super admins handle requests under the General Data Protection Regulation (GDPR) and erase data once the deadlines have passed.

Location: Compliance, in the tabs next to Consents. Visible to: super admins. Background: Why fepli does not erase some data.

The seven rights

A request names one of seven rights. For each, the case file of the person has an action.

The rights under the GDPRSeven rights, seven places in the case file

Access (Art. 15) · Deadline: 1 month from receiptIn the case file under “Rights”: row “Give access”, action “Provide access”

Find a person/Jo Beispiel

Jo BeispielAccount · jo@example.org · 2 participants

No restriction

Rights

Give access Art. 15Report with all data as PDF, with files as ZIP. · PreviewProvide access …

Transfer data Art. 20Only data the person provided, machine-readable.Export …

Rectify Art. 16Change it in the account or the person; it is logged.Edit

Restrict processing Art. 18The data stays but is not used.Restrict …

Objection Art. 21An objection to marketing applies at once; one on grounds of a particular situation is weighed. · Particular situation …Record …

Erase Art. 17Registrations stay pseudonymised, receipts stay.Erase …

Consents

Photos on the website · AlexGivenWithdraw

Newsletter · Jo BeispielDeclined

Deadline1 month from receipt

Received1 monthExtend deadline: + 2 months

If the deadline falls on a weekend, the next working day applies. It can be extended once.

Right	Article	Row of the case file	Action	Deadline
Access	Art. 15	Give access under Rights	Provide access (Rights)	1 month from receipt
Rectification	Art. 16	Rectify under Rights	Edit	1 month from receipt
Erasure	Art. 17	Erase under Rights	Erase	1 month from receipt
Restriction	Art. 18	Restrict processing under Rights, afterwards Lift the restriction	Restrict, afterwards Lift (Processing status)	1 month from receipt
Data portability	Art. 20	Transfer data under Rights	Export	1 month from receipt
Objection	Art. 21	Objection under Rights	Record for marketing, Particular situation for legitimate interest	immediately; the request shows “act immediately”
Withdrawal of consent	Art. 7 III	the consent under Consents	Withdraw	immediately; the request shows “act immediately”

Tabs

Tab	Contents
Requests	Requests with a deadline; counter of open requests
Find a person	Search for people; a hit opens the case file in the side panel: marks on the processing, open requests, rights, data held, consents, earlier requests, log
Retention	Erasure runs that are due
Log	All actions

Beside them, not as a tab: the link Settings · Privacy to Settings.

Global admins	Effect
In the tenant of their own account	All 4 tabs.
In another tenant	Only the tab Retention. Requests, case file, person search and log answer with “403”. The link to the log disappears from the page Retention.

Requests

Element	Contents
States	Open, Unverified, Due within 7 days, Overdue, Closed, All
Columns	Person, Right, Deadline, State, Assignee
Search	Name, email or reference (format `YYYY-NNNN`)
Filters	Right, Assignee, Channel, Received (one field for the first and the last day, like Period of the payments)

Record request

Field	Meaning	Values	Effect
Person	Account or participant	Search	The account includes the assigned participants.
What is it about?	Right	Access, Rectification, Erasure, Restriction, Data portability, Objection, Withdrawal of consent	Deadline: 1 month from receipt, immediately for objection and withdrawal. If the deadline falls on a weekend, the next working day applies.
Received	Date of receipt	not in the future	–
Channel	How the request came in	Email, Letter, Phone, In person, Form	–
What exactly is requested	Note	Text	–
Identity verified	Proof of identity	on, off; note	Until it is confirmed, all steps for this request are locked.
Assignee	Person handling the request	Account	–

Action	Effect
Record and open case file	Creates the request.
Confirm identity	Records how the identity can be recognised.
Extend deadline	Once by 2 months, with a reason and the confirmation that the person has been informed.
Close request	Outcome Done or Refused (with a note); mandatory checkbox “The person has received the answer”.

Person (case file)

Area	Contents
Search	Name, email or phone, at least 2 characters; All, Accounts, Participants
Hits	Opens the case file in the side panel, as a list with avatar, open requests and a mark restricted
Data held	Per category the number of entries: master data, Registrations, Payments & receipts, Reductions (only for participants with a reduction), Consents, Emails sent, Change and access logs. If the account has objected to the measuring of email opens, “Objection to measuring email opens” follows with 1 entry. If the account has credentials or leads offers, Trainers & credentials follows (Trainers & credentials: Data subject rights). If the account has given a direct debit mandate, Direct debit mandates follows (SEPA direct debit). Below it: “Purpose, recipients, retention and source per category are in the access report:” with the link Preview.
Marks below the name	“Processing restricted (Art. 18)”, “Objection: marketing”, “Objection: legitimate interest” and “blocked”, otherwise “No restriction” (Processing status)
Consents	For each consent the state Given, Revoked or Declined. The action Withdraw exists only for consents that were given and not withdrawn; field Note (optional, logged). A revocation is final (Consents). Afterwards the organizers or the team receive an email (Notification of a revocation). The case file of an account also shows the consents of its erased participants.
Rights	Access, export, rectification, restriction, objection, erasure (Rights)
Log	Actions concerning this person

Processing status

Processing restricted (Art. 18)What happens to the data

Alex Beispielrestricted

StoredThe person's datastays
UseErasure run · Place allocation · Moving up · Newsletter · Participant export · Merging with a duplicatesuspended
Deleteon the website · under Accounts and Participants · via the APIblocked
Deletein the case filepossible

The block also applies to the account of a restricted participant and to the participants of a restricted account.

Status	Effect
Processing restricted (Art. 18)	Set with Restrict, lifted with Lift under Rights. The data stays stored and is not used otherwise: no erasure run, no allocation of places, no moving up, no newsletter, no participant export, no merging with a duplicate. Mark restricted. Deletion is blocked on the website, under Accounts and Participants and through the API, also for the account of a restricted participant and for the participants of a restricted account. Only Erase in the case file erases anyway.
Objection: marketing	Recorded with Record under Rights. Applies immediately: no more newsletters. Messages about booked offers continue.
Objection: legitimate interest	Recorded with Particular situation under Rights. Is weighed; meanwhile the processing can be restricted.
blocked	The person has unsubscribed through the link in an email. Display only; the mark leads to Unsubscribed contacts.

Rights

Action	Effect
Provide access	In the case file: “Report with all data as PDF, with files as ZIP.” Opens the dialog “Provide access”: “Creates the report as PDF. The download is logged as access granted.” Preview shows the report in advance, Create PDF creates it in the background (Understanding the interface: Exports). As soon as the file has been created, the access is logged as provided (Access).
Export	Opens the dialog “Data export”: the data the person provided themselves, As JSON or As CSV. Each reduction of a participant comes with its number, “valid until”, submission date and the file name of the copy. Logged.
Edit	Opens the form of the record.
Erase	Opens the dialog “Erase data of {name}” with a preview per Category with Count and what it Becomes (deleted, pseudonymised, blocked) and the link Preview as report. Confirm erasure, Erase. The same erasure as under Accounts (Accounts: Delete): receipts under a retention duty are blocked, not deleted; the registrations stay pseudonymised. The log keeps the ID, not the name, also in earlier entries.

Erase in the case fileWhat becomes of each category

Erase data of Jo Beispiel

Receipts under a retention duty are blocked, not deleted. Preview:

CategoryCountBecomes

Account master data2deleted

Participants master data2deleted

Registrations · stays as statistics5pseudonymised

Payments & receipts · § 147 AO, 8 years2blocked

Consents · stays in force until withdrawn, proof kept 3 years after1blocked

Emails sent12deleted

Change and access logs7deleted

Preview as report

In the dialog	Contents
Preview	Master data, Reductions with the uploaded copy of the evidence, Emails sent and Change and access logs: deleted. Registrations with “stays as statistics”: pseudonymised. Payments & receipts with “§ 147 AO, {count} years”: blocked.
Consents	Consents that were given appear as blocked with “stays in force until withdrawn, proof kept {count} years after”. An objection to the measuring of email opens appears as blocked with “kept with a hash of the email address, without the address”; fepli deletes the contact at Brevo (Delivery tracking). Below the preview, the dialog asks, as under Accounts, which consents the person revokes with the erasure.
Restricted processing	“Processing is restricted (Art. 18). Erase only if the person expressly requests it.” The erasure is possible anyway.
Upcoming offers	“… Erasure withdraws it, the place goes to the waiting list.” With it, a note on the paid registrations among them whose participation fee lapses; it reads as under Accounts.
Open fees	“One fee is still open.” or “{count} fees are still open.”, plus “After the erasure it can no longer be billed, because the registration then belongs to no account. Bill it first or remove the payment obligation.” The note reads as under Accounts. Open fees do not hold up the erasure.
Adult participants on the account	“{names}: of age. Their data is erased too. The request must come from them as well.”

Access

Element	Contents
Copy per registration	Answers to the season questions and the additional questions, also to questions the offer no longer asks; uploaded files; status history with trigger and the reason from the lottery; comments with attachments
Reductions	Per reduction of a participant: name, number, “valid until”, status and “submitted on {date}” as well as “File: {name}”. The copy of the evidence is in the archive, which is then a ZIP.
Further copies	Notes and comments on the person and the account; all receipts with lines, billing address and email address, also receipts to the account's debtor; every email and text message still stored, with its text
Account	Last signed in and Measuring whether emails are opened with “Consented”, “Objected” or “No decision made” are added to the master data. After a decision, Decided on and Decision made follow: “In the account under “Notifications & privacy”” or “Through the link “Stop measuring whether these emails are opened” in an email”. Passkeys with Name and Set up on, plus “Also stored are the public key and an identifier used to check the sign-in; they are not printed here. When a passkey was last used is not stored.” Saved lists with their offers and the day each was added, also a deleted saved list as long as it is stored: “deleted on {date}, still stored”
Friend and access codes	Code, For (“Friend code for “{offer}”, group of {count} participants” or “Access code “{strategy}””), for an account the participant, and the date. The access report does not name the other participants of a friend group.
Storage period of consents	“Until withdrawn, or until done with its offer or season, then {count} years to the end of the year as proof (Art. 7 I, Art. 17 III e GDPR). A consent that was given stays in force after the master data is erased; refusals are erased with the master data” with the period from the row Proofs of consent (Settings)
Objection to measuring email opens	Only for an account that has objected. The access report names fields, purpose, recipients, storage period and source: after the account is deleted, the objection is kept with a hash of the email address until an account with that address takes it over.
Storage period of emails	“{period} after sending” with the period from the row Emails and text messages (Settings)
Who acted	Account, Team, Organizer, API, Lottery or System; never the name of a person on the team
Links in emails	Links that work like a key, such as sign-in and payment links, appear as `******`, also in emails that fepli stored before this rule.
Files	If uploaded files or attachments belong to the copy, the dialog states their number in advance: “{count} uploaded files are part of the copy. The download is therefore a ZIP archive with the PDF and the files.” The report names each file in the archive.
Missing file	A file that is missing from the storage is also missing from the archive. The log entry of the access records its name.
Log	Access provided, with the format PDF or ZIP

Retention

Below the rules: “A run first shows what it does and is logged with your name: Runs.” The link Runs opens the group Runs in the Log.

Without a period enteredWhen which data is deleted

Participants past the retention periodfrom the end of their last season2 years
Accounts without participantssince the account has been dormant2 years
Unconfirmed registrationsfrom registration4 days
Unconfirmed applications without an accountfrom applying30 days
Closed requestsfrom the end of the year in which they were closed3 years
Uploads from familiesfrom the end of their season, else from arrival1 year
Sent emails and text messagesfrom sending2 years
Dispatch logfrom sending3 years
Pseudonyms of erased participantsfrom the end of their seasonoff
Proofs of consents that are overfrom the end of the year in which the consent ended3 years
Receipts past their retention dutyfrom the end of the booking year8 years

deletes nightly by itself
only flagged, deleted by hand
off until a period is entered

Rule	What happens	Execution
Participants past the retention period	“Master data is deleted, registrations pseudonymised.” The same erasure as under Accounts (Accounts: Delete): the registrations stay pseudonymised, with offer, status, status history, fee and the age at the start of the offer. Address, answers, files and comments of the registrations are removed. Receipts stay unchanged.	Erase records; nightly with Notice by email, then erase automatically or Erase automatically without notice and a period entered
Accounts without participants	Participant accounts without participants that have been dormant for as long as the period states are deleted with their addresses, activity and sent emails.	Erase records; nightly with Notice by email, then erase automatically or Erase automatically without notice and a period entered
Unconfirmed registrations	Are deleted with their passkeys 4 days after registration if the email address was never confirmed	automatic only (“runs daily”)
Unconfirmed applications without an account	“Master data is deleted, registrations pseudonymised · 30 days after applying, if the email address was never confirmed.” Participants without an account are deleted if all their registrations have the status email confirmation pending, have been unchanged for 30 days and carry no payment obligation. The erasure is the same as for Participants past the retention period. Participants with another registration, with restricted processing or linked as a duplicate are not deleted. Every run that deletes someone appears in the log. The number shows the people the next run deletes.	automatic only (“runs daily”)
Closed requests	Are deleted 3 years after the end of the year in which they were closed	Erase records
Uploads of families	“Files of registrations and attachments of email replies are deleted · {period} after the end of their season, else after they arrived”	nightly as long as Automatic is selected in the row Uploads from families (default); Delete files
Sent emails and text messages	“Deleted with their delivery events · {period} after sending”	Delete messages; nightly with Automatic in the row Emails and text messages
Dispatch log	“Entries are deleted · {period} after sending”	Delete entries; nightly with Automatic in the row Dispatch log
Pseudonyms of erased participants	“Removed, the registrations stay unlinked · {period} after the end of their season”	Remove pseudonyms, and nightly, only with a period entered
Proofs of consents that are over	“Are deleted with their document · {period} after the end of the year in which the consent was withdrawn, expired or was done with its offer or season (Art. 7 I GDPR, § 195, § 199 BGB)”	Delete proofs; nightly with Automatic in the row Proofs of consent
Receipts past their retention duty	“Name, address and email address are removed and the stored receipt file is deleted, amount and receipt number stay · {period} from the end of the booking year (§ 147 AO, § 257 HGB) · next release {date}”	Remove details; nightly with Automatic in the row Receipts

Uploads of families

Detail	Contents
Period	Row Uploads from families (Settings), 1 year without an entry
Counted from	The end of the last phase Publish offers of the season to which the offer of the registration or of the conversation belongs; seasons without this phase or without its end are left untouched. Attachments to a conversation through an account, a participant or an organizer profile count from their arrival.
Stays	The registration with its answers and the message with its text; files of people with restricted processing
Dialog	“Files of registrations and attachments of email replies whose season ended more than {period} ago.”
With Flag for deletion	“Deleted by hand only. Switch on automatic deletion in the settings.”

Sent emails and text messages

Detail	Contents
Period	Row Emails and text messages (Settings), 2 years without an entry
Stays	Conversations on a record, the dispatch log and the messages of people with restricted processing
Dialog	“The messages leave the outbox together with their delivery events.”
With Flag for deletion	“Deleted by hand only. Switch on automatic deletion in the settings.”

Dispatch log

Detail	Contents
Period	Row Dispatch log (Settings), 3 years without an entry
Stays	Entries that meet a condition under Dispatch log
Dialog	“Entries whose message is no longer in the outbox.”
Afterwards	The timeline of the registrations concerned no longer shows these messages.
With Flag for deletion	“Deleted by hand only. Switch on automatic deletion in the settings.”

Pseudonyms of erased participants

Detail	Contents
Period	Row Pseudonyms (Settings). Without a period, the rule shows “Off: the pseudonyms stay. Enter a period in the settings.”
Concerns	Pseudonymised registrations from seasons whose last phase Publish offers ended that long ago; seasons without this phase or without its end are left untouched
Stays	Offer, status, fee and age
Dialog	“Registrations of erased people lose their link. After that no access request can be answered.”
Afterwards	The statistics of those seasons no longer count individual children.

Proofs of consents that are over

Detail	Contents
Period	Row Proofs of consent (Settings), 3 years without an entry
Counted from	The end of the year in which the consent ended. When a consent ends and what stays: Consents: Retention of proofs
Dialog	“Consents that ended more than {period} ago, counted from the end of that year. Their document is deleted with them.”
With Flag for deletion	“Deleted by hand only. Switch on automatic deletion in the settings.”

Receipts past their retention duty

Detail	Contents
Period	Row Receipts (Settings), 8 years without an entry
Removed	Billing name and address, email address, the paying or recording account and the payment service's record; the stored PDF of the receipt is deleted
Stays	Amount, receipt number, status, lines and the checksum of the PDF. Open receipts and receipts whose payer is restricted stay unchanged.
Afterwards	A downloaded receipt is generated anew without a payer.
Counter	Covers receipts that still contain details about a person or a stored PDF
With Flag for deletion	“Removed by hand only. Switch on automatic deletion in the settings.”

Element	Contents
Show list / Hide list	Shows 5 entries (Name, Last season, Registrations, Account), then “First {count} of {total}”; Erasure list as CSV
Run by hand	Opens a dialog with what is due, what is affected and the time of erasure; for 5 of the rules, also a mandatory checkbox “I understand: this cannot be undone.” The dialog states that the run is logged with your own name (Run by hand).
Last run	Date of the last run
Default period	Without a period entered under Erase after, 2 years apply. The rule then shows “Default period 2 years: entries are only flagged. Enter a period of your own in the settings.” Under the default period, no notice email is sent, even if Notice by email, then erase automatically is selected; with Flag for deletion, a notice email is never sent.
Due date of a participant	Period from the latest end of the phase Publish offers among the seasons for which the participant was registered. If one of these seasons lacks the phase or its end, the participant stays. For a participant who was never registered, the period counts from creation. As long as the hold from the notice email applies, all participants of the account stay.
Access	Dashboard tile Erase data

Run by hand

The mandatory checkbox “I understand: this cannot be undone.” is required by the rules Participants past the retention period, Accounts without participants, Closed requests, Proofs of consents that are over and Pseudonyms of erased participants, because they permanently remove people, accounts, requests, proofs or the last link to a person.

Rule	Button of the dialog	Message afterwards
Participants past the retention period	“Erase {count} people”	“{count} records erased.”
Accounts without participants	“Erase {count} accounts”	“{count} records erased.”
Closed requests	“Erase {count} requests”	“{count} records erased.”
Proofs of consents that are over	“Delete {count} consents”	“{count} proofs of consent deleted.”
Uploads of families	“Delete {count} files”	“{count} files of families deleted.”
Sent emails and text messages	“Delete {count} messages”	“{count} messages deleted from the outbox.”
Dispatch log	“Delete {count} entries”	“{count} entries deleted from the dispatch log.”
Pseudonyms of erased participants	“Remove pseudonym from {count} registrations”	“Pseudonym removed from {count} registrations.”
Receipts past their retention duty	“Remove details from {count} receipts”	“Name, address and email address removed from {count} receipts, and the stored file deleted.”

Dispatch log

The dispatch log records, without texts, who received which message and when. The run Dispatch log deletes an entry after the period in the row Dispatch log under Retention, unless one of these conditions applies.

Reference	The entry stays as long as …
Offer, directly or through a registration	the offer has no date, one of its dates ended less than the period ago (without an end: began) or is still ahead, its completion form was answered less than the period ago or its season is not over for that long yet
Season	the season is not over for that long yet. A season is over when its last phase Publish offers has ended; without this phase or without its end, it never counts as over.
Message	the copy of its message is in the outbox (Sent emails and text messages)
Account	the account is blocked and has never signed in
Person, through a registration, an account or a receipt	the processing of the person is restricted (Processing status)

Log

Element	Contents
Groups	All, Erasures, Access, Status, Requests, Runs, Support, Access
Columns	Time, Action, Concerns, By, Request
Filters	Data subject (name or ID), Article (article), only with a request, only irreversible; Period (one field for the first and the last day, plus the quick picks 30 days, 90 days and 1 year), default: the last 90 days
Proof as CSV	With more columns than the list: Time, Action, Article, Data subject, ID, Carried out by, Reference, Reason, Details
Erasures	Every erasure of a person writes an entry Data erased: “{count} deleted · {count} pseudonymised · {count} blocked”, where applicable “{count} registrations withdrawn” and “{count} of them paid, refund due” (paid registrations whose participation fee lapses), plus the trigger: “Delete account on the website”, “Delete in the admin”, “Erasure request under data subject rights” or “via the API”. An erasure run writes a collective entry Erasure run with “{count} people (batch run)”, the run for receipts with “{count} receipts (batch run)”, the one for consents with “{count} proofs of consent (batch run)”, the one for uploads with “{count} files of families (batch run)”, the one for sent messages with “{count} messages (batch run)”, the one for the dispatch log with “{count} dispatch log entries (batch run)” and the one for pseudonyms with “{count} registrations (batch run)”.
Access	Entries when the team uses someone else's account or changes access: Password link sent (Send password link), New sign-in address entered (when someone other than the account holder enters a new address, under Accounts, through the API or with Sign in as on the website; without the addresses), Sign-in link sent (with Send sign-in link, where applicable with “although sign-in by email link was turned off”), “Sign in as” started and “Sign in as” ended (with “in the admin panel” or “on the website”). With several tenants, also Switched into this tenant and Left this tenant when a global admin enters or leaves the tenant, and Opened this tenant’s CMS when they open the tenant's CMS. Entries Password set and Sign-in address changed date from before the update.
Carried out by	The signed-in account, while Sign in as the own account of the person who signed in as someone else; “The person themselves” for Delete account and when a consent is withdrawn on the website; for a revocation through the API with a service account, its name; “System” for automatic actions
Consents	Consent withdrawn for every revocation: on the website, in the admin panel (page Consents, registration, case file) and through the API, with the title of the declaration. Told of withdrawal as soon as the email about a revocation has been sent, with the title of the declaration (Notification of a revocation). Consent recorded again after withdrawal when someone in the admin panel enters a consent after the person revoked or declined it. Entries Withdrawal taken back date from before the update.
Data subject after an erasure	“ID {id}… (erased)”; the name also disappears from earlier entries about this person.
Merged participants	When two records are merged, fepli writes Records merged with “from ID {id}…” under the remaining record, in the group Status. The earlier entries and the requests of the removed record then appear under the remaining one. Searching for the ID of the removed record finds the entry Records merged.
Not in the log	Rectifying data