Personal data requests

People can ask what you hold about them, and ask you to delete it (GDPR articles 15 and 17). The desk answers both from the contact's page, with the permissions Export a contact’s data (privacy.export) and Erase a contact (privacy.erase), both held by Account Manager:

• Export data gives a ZIP of everything about the person.
• Delete permanently removes it all and leaves a note that it happened.
• A legal hold on a case keeps it, whatever the request.

Request → Export data → Delete permanently → Tombstone
Request → Delete permanently: they asked for deletion only, not a copy
Delete permanently → Refused: one of their cases is under legal hold, or restricted to countries you don't work in

Exporting a contact's data

1. Open the contact (Accounts and contacts → Contacts, or the requester's name on a case).
2. Pick Export data in the … menu at the top right.
3. The browser downloads contact-<email>-<date>.zip with:

File	What's in it
contact.json	The contact: email, name, phone, language, notes, whether they're registered and when they last signed in; the organization; their account's name.
cases/<ref>.json	One per case: subject, status, priority, unit, labels, dates, what they sent in (the form or portal fields), every message they could see (theirs and your replies, with signatures), internal notes (marked seenByRequester: false), the timeline's events and their rating.
attachments/<ref>/	The files on each case, theirs and yours.

The export is the contact in one organization: the same address in another organization is another contact, with its own export. It is written as it downloads, so a contact with many files doesn't strain the desk. Each export is in the audit log as Exported a contact's data, with the number of cases and files.

[!WARNING] Internal notes are included because they are about the person. Read them before you send the ZIP on, and leave out what you may withhold (for example notes about a legal claim).

If some of their cases are restricted to staff in countries you don't work in, the export is refused rather than incomplete: someone allowed to handle those cases must make it.

Deleting a contact permanently

1. Pick Delete permanently… in the same menu.
2. Type their email address to confirm.

The desk then removes for good:

• the contact, and their cases with every message, note, file (in storage too), rating and automation history,
• their portal sign-ins and pending sign-in codes,
• incoming emails on their cases, and those from their address that matched no case (in Email review) in this organization, and webhook deliveries about them. On a desk with several organizations, an email that matched no case can't be placed in one, so it stays until it is discarded from Email review or removed by housekeeping.

[!CAUTION] This can't be undone; export first if they asked for a copy.

Cases merged from someone else into one of theirs go with it; their own messages already merged into another person's case stay there.

The same email in another organization is another contact and isn't touched. Restricted cases stop it like the export.

Tombstones

What stays is a tombstone: the organization, the date, who deleted the contact and how many cases, messages, files and other records went. The email address is kept only as a keyed hash (HMAC with the installation's ENCRYPTION_KEY): it can be checked against an address, but not read back.

The deletion is in the audit log as Deleted a contact permanently, with the counts and no address.

To answer "did we delete this person, and when?", type their email address in the filter on Settings → Audit log. A note above the list says when they were deleted, from which organization and by whom.

[!WARNING] Changing ENCRYPTION_KEY makes old tombstones unmatchable.

If the person writes in again later, they become a new contact.

Legal hold

Put a case under legal hold when it must be kept, for example during a dispute or because an authority asked. In the case's … menu, whoever holds the Legal holds permission (case.legal_hold; Administrators do):

1. Picks Legal hold….
2. Gives a reason.

While it's on:

• the case shows Legal hold next to its status, and the reason, date and who set it above the conversation; the inbox shows Legal hold on its row,
• housekeeping skips it (closed cases, automation history and its incoming emails), and its files stay,
• Delete permanently on its requester is refused, and the dialog says which cases are held and why,
• it can't be merged into another case (other cases can still be merged into it).

Work on the case goes on as usual: replies, notes and status changes. Change legal hold reason… updates the reason; Lift legal hold ends it. Setting and lifting are on the case's timeline and in the audit log.

Problems and changes can be put under legal hold the same way, with the same permission, from their own pages (problems, changes): housekeeping then leaves them alone.

Over the API

Request	Does	Needs
POST /api/v1/cases/{ref}/legal-hold with { "reason": "…" }	Sets a legal hold.	case.legal_hold
DELETE /api/v1/cases/{ref}/legal-hold	Lifts it.	case.legal_hold
GET /api/v1/contacts/{id}/export	Exports a contact's data.	privacy.export
DELETE /api/v1/contacts/{id} (with { "email": "…" })	Deletes a contact permanently.	privacy.erase

A token needs the admin scope.