Skip to main content

Anonymise a customer

Anonymising blanks a customer's personal data — name, email, phone and addresses — and marks the record as anonymised.

Use it when someone asks you to remove their data and the request did not come through a connected store.

What it does and does not do​

Removes the personal data identifying the person.

Keeps the customer record and every order against it. Those are accounting records of real transactions with real tax, and removing them would leave your books unable to explain themselves.

So afterwards you know an order happened, what was on it and what it was worth. You do not know who bought it.

This is not deletion of the row. If your obligation is erasure of the record itself rather than the personal data in it, this does not do that.

Steps​

  1. Open the customer.
  2. Use the anonymise action on their record.
  3. Confirm.

Their name, email, phone and addresses blank out. The record and its orders remain.

Check you have the right records first​

Email is not unique in Yessort. The same person may hold several customer records — guest checkouts repeat an address freely, and someone may buy both privately and for a business.

Anonymising one record leaves the others holding that person's data. Search the email and deal with all of them, or the request is only partly honoured.

A request arriving through a connected store does this for you: it matches by email and anonymises every live record with that address. Doing it by hand, you have to do the same.

Requests through a store​

Where a customer asks a connected store to remove their data, the store passes it on and Yessort acts on it. Nothing needs doing.

Requests for a copy of their data are handled by an export.

It happens automatically anyway, eventually​

Every customer carries a retention horizon, and a background job anonymises records that pass it. The horizon is pushed back each time they order, so it applies to customers who have stopped buying.

The default window is seven years. Anonymising by hand is for a request arriving before that.

Doing it twice is harmless​

The action is idempotent — anonymising an already-anonymised customer does nothing further and causes no error.

Data retention and anonymising for the retention horizon and the automatic pass.