# Personal data requests

> Recording and carrying out customers' access, deletion, rectification and objection requests concerning their personal data.

Source: /en/features/personal-data/

The **Rules and compliance › Personal data requests** screen is used to record and carry out customers' requests concerning their personal data (KVKK / GDPR). Access and deletion requests take effect as soon as they are recorded; rectification and objection requests are closed from the list after review.

This screen is only open to the **Administrator** role (the "Can handle personal data requests" permission) and can only be used with a panel session; it cannot be accessed with server keys.

## New request

The **Record a new request** button opens a four-step wizard:

1. **Person:** The email address of the customer making the request. A request made with a phone number also finds the reviews written from that number's orders.
2. **Request type:**

   | Type | Result |
   |---|---|
   | Access: a copy of their data | A copy of the customer's reviews, orders, invitations, sent emails, and photos and videos is prepared; it is downloaded and sent to the customer. |
   | Deletion: erasing their personal data | The customer's name is removed from their reviews, and their name and contact details are erased from the text of their reviews, questions and answers; the photos and videos they uploaded are deleted, and the contact details and order numbers on their orders are turned into pseudonyms. The rating, the rest of the text and the activity record are retained. |
   | Rectification | The request is recorded; it is completed from the list once the correction has been made. |
   | Objection | The request is recorded; after review it is completed from the list or refused with a written reason. |

3. **Records found:** The number of reviews, photos and videos linked to this address and the number of order records are shown. Below the numbers, the reviews linked to this address (the 50 newest) are listed with their rating, title or text, status and date; clicking a review opens its detail panel. Record the request even if no records are found; the record shows that the customer's application was answered. This lookup is recorded in the **Activity history** under a pseudonym for the person, not their address.
4. **Confirm:** The action to be taken and the records found are summarised. For a deletion request, the summary also has a **How it looks on the site** row: the reviews stay published and "Anonymous" appears instead of the author's name; the rating, the review text with the name and contact details taken out and the "Verified buyer" mark stay, and photos and videos are removed. Reviews that are not live yet cannot go live after the deletion. If the customer does not want the review shown either, open the review and use **Remove** with the reason "The customer's own request". For a deletion request, the box "I understand what will be deleted and confirm" must also be ticked.

The result card shows, for access requests, a table of the reviews found. The **CSV**, **Excel** and **JSON** options in the **Download** menu download the data copy for an access request, and the request record for the other request types. Every download is recorded in the **Activity history**. For rectification and objection requests, if reviews were found, the result card also lists this person's reviews: open the review and act on it, then complete the request in the **Requests** list.

A personal data request does not store the customer's email address, only a digest derived from it, and the data copy is not stored either. If the copy of a completed access request is needed again, open the **Download** menu on the request's row in the **Requests** list; in the **Download the copy again** part, type the email address from the request again and choose the format with the **CSV**, **Excel** or **JSON** button. If the address matches the stored digest, the copy is prepared again from the current records; if it does not, no copy is given. Every new download is recorded in the **Activity history**.

In reviews imported from a marketplace the email address is not known, so these reviews cannot be found with the wizard above; with the **Remove a marketplace review** button on the screen you search by the review text, the author name or the marketplace review number and remove the ones you select: [Marketplace reviews](/en/features/marketplace-reviews.md#personal-data-requests).

## Effect of a deletion request

| Data | Action taken |
|---|---|
| Author name, email address and customer ID on the review | Deleted; the review becomes anonymous. In the panel, the review detail shows "Personal data erased (data request)" instead of the email address. |
| Review title, text and translations | Email addresses, phone, ID, IBAN and card numbers in the text, and the words that carry the person's name, are replaced with marks such as `[email]`, `[phone]` and `[name]`; review search no longer finds these words either. |
| Reviews that are not live (waiting for approval, rejected or hidden) | They cannot go live after the deletion; the **Approve** and **Show again** buttons do not appear in the review detail. |
| Photos and videos on the review | Deleted together with their resized copies |
| Email address, phone number and customer number on orders | Converted into a pseudonym that cannot be reversed. Even if the order is transferred again later, these fields are not restored to their previous values. |
| Order number | Turned into the same pseudonym on the order and in the review's proof of purchase; the **Order** row of the proof card in the review detail shows this value. If the platform sends the order again or a return arrives, it is applied to the same order and the person's details do not come back. |
| Questions and buyer answers | The name and email address on the question and the name and order reference on the answer are deleted; the name and contact details in the texts are replaced with marks. |
| Prepared data exports | Files ready for download are deleted and leave the list; an export being prepared is not completed. Request a new export if needed. |
| Open invitations of these orders (waiting to be sent or already sent) | Stopped ("No email address on the order"); no reminder goes out |
| Open invitation and correction links of these orders | They expire at once; a link in an email sent earlier can no longer be used to write or correct a review |
| Review text, rating and history | **Retained.** Article 28/B-4 of the Regulation on Commercial Advertising and Unfair Commercial Practices requires published reviews to remain published for at least one year; once the personal data has been removed, the review is kept for audit purposes. |
| Send records | The address digest on the records of invitations and notices sent to the person is deleted; the sending result and times remain. |
| List of people who do not want emails | The digest of the address stays on the list; the person gets no invitation again. |

Deletion cannot be undone and is recorded in the review's history as "Author's name and personal details in the text erased". Every completed deletion is also written to a log kept outside the database; if the system is restored from a backup, the deletions in this log are applied again.

:::note
If the customer also requests that the review be removed from the site altogether, you can remove it after the deletion with the **Remove** action and the reason "The customer's own request". For details, see [Reviews and approval](/en/features/reviews.md).
:::

## Access file

The copy of an access request is downloaded as JSON, CSV or Excel. The file is prepared to be handed to the customer; the note written on the request and the user who handled it are not included. The JSON file holds the request's details (ID, type, status, dates) and two parts:

- `export`: for each of the customer's reviews, the review ID, rating, title, text, author name, status, the date it was written, the market, the product, the aspect scores, the review topics and the brand's replies.
- `export_details`: the customer's other records:

| Part | Content |
|---|---|
| `subject` | The email address or phone number, the names used in the reviews and whether the address or number is on the list of people who do not want invitations |
| `orders` | For each order, the order number, order time, market, payment state, customer ID, phone number and lines (line ID, product code, product name, quantity, delivery state) |
| `invites` | The order each invitation belongs to, the invitation type, its status and the times it was created, sent and reminded |
| `deliveries` | The delivery updates of the orders: order, line, state, source, confidence and time |
| `emails` | The sending route, template, result and the times sent, delivered and opened of the invitation, rejection notice and answer notice messages sent to this person |
| `mail_events` | The delivery, open and bounce records received from the email provider for these messages |
| `questions` | The questions the person asked and the answers given to them |
| `answers` | The answers the person gave as a buyer |
| `consents` | The person's consent records: sending route, message type, when it was given and withdrawn, and its source |
| `media` | The review, type, description and upload time of the photos and videos attached to reviews |

In the CSV and Excel files the same information comes as one table per part: **Request**, **Person**, **Reviews**, **Orders** (each order line on its own row), **Invitations**, **Emails**, **Email events**, **Delivery updates**, **Review topics**, **Brand replies**, **Questions**, **Answers**, **Consents** and **Files**. In Excel each part is on its own sheet. The column names are the same as the field names in the JSON.

The request record does not store the customer's address in plain form, but as a value derived with Sayproof's secret key that cannot be turned back into the address.

## Request list

Requests are listed together with their status, and the counters filter the list by status. Access and erasure requests become **Completed** as soon as they are recorded; rectification and objection requests wait as **Received** and are closed from the relevant row as **Completed** or **Refused**. A note stating the reason is required when refusing.

On the row of a rectification or objection request, the **Related reviews** button lists the reviews linked to an address once you type the email address from the request and press **Find**. The address is not stored and is only used to find the reviews; the lookup is recorded in the **Activity history** under a pseudonym for the person. The **Request record** part of the **Download** menu on every row downloads the request record again as **CSV**, **Excel** or **JSON**; this download is also recorded in the **Activity history**.

The recording, completion and refusal of each request are recorded in the **Activity history**. The entry contains only the type of request, not the customer's address.

For other topics relating to the protection of personal data, see [Protecting personal data](/en/security/data-protection.md).