A contact record holds everything the GDPR asks for: consents, export of the person's data and the right to be forgotten.
Consents
The Consents card shows, for each channel (email, phone, SMS, mail, other) and each purpose (newsletter, marketing offers, invitations, customer relationship follow-upā¦), whether the person may be contacted, with the legal basis and the date.
The rule depends on the legal basis:
- consent basis: without an explicit agreement in force, the person is not contacted;
- another basis (contract, legitimate interest, legal obligationā¦): the person may be contacted unless they refused or withdrew (right to object).
To record an agreement, a refusal or a withdrawal, choose the channel, the purpose, the status, if needed a legal basis other than the purpose's, and note the evidence (form text, email referenceā¦), then Record the consent. History is never rewritten: each record is added, and the latest one wins. Consent history lists them.
The other CRM features that send messages (sequences, campaigns, telephony) read these consents before contacting anyone.
Exporting a person's data
Export the person's data downloads a JSON file: the record, organizations, roles, consents, custom fields, history and the data of other features (activitiesā¦). It answers the right of access and the right to data portability. It requires the right to export contacts; each export is logged.
Right to be forgotten
Right to be forgotten: anonymize erases everything that identifies the person:
- name, contact details, social profiles, address, description, job title in each organization;
- custom field text;
- consent evidence;
- change history;
- personal data held by other features (content of exchangesā¦).
The record stays, with its links (organizations, roles), amounts and dates: statistics stay accurate. The record then shows Anonymized and can no longer be edited. The operation cannot be undone and requires the right to delete the contact. If it was interrupted, Run the erasure again completes it.