A buyer asks for their data or wants it erased

Anyone who bought a ticket from you may ask what data you hold about them, and may ask you to erase it. That is set out in privacy law (the GDPR). You decide, because you are the seller; we give you the buttons to do it in two minutes.

Only the owner and the administrator see these buttons.

Where do you find the buttons?

In two places:

• on an order: open the order via Orders. At the top you will find Export this buyer's data and Erase this buyer's data. The order's email address is used;
• on the Settings → Export data screen: at the top you will find Export one buyer's data and Erase one buyer's data. You type the email address yourself. Useful when someone emails without an order number.

For us, a buyer is their email address. Everything with that address counts: their orders, the tickets on them, season passes in their name and gift vouchers sent to them. Capital letters do not matter.

"What data do you hold about me?"

1. Click Export this buyer's data.
2. You get a file (JSON) with everything your organisation holds for that address: orders, tickets, season passes, vouchers, invoice requests, invoices and whether they unsubscribed from the newsletter.
3. Send that file to the buyer.

You must reply within one month. It is good practice to do it straight away.

"Erase my data"

1. Click Erase this buyer's data.
2. Enter a reason, for example "buyer's request by email of 24/9".
3. Click Erase permanently.

This cannot be undone.

What disappears

• name, email address and phone number on their orders;
• the names on their tickets;
• name and email address on their season passes;
• name, email address and message on gift vouchers for them;
• the email address on an online top-up of balance on their pass;
• contact person and email address on an invoice request; if you had not yet issued an invoice, also the company and the address;
• their consent to the newsletter.

What stays, and why

• the order itself, with its amounts and VAT. That is your accounting, and you must keep it for years. Without a name it can no longer be traced back to them;
• an invoice you already issued, with name and address. An invoice without a buyer is not an invoice, and the law requires you to keep it. Only the email address is removed;
• the till journal. It is protected against changes and contains no contact details;
• an unsubscribe from the newsletter, so they never receive promotional email again by mistake;
• a UiTPAS or museumPASS number on a sale: the municipality or the publisher uses it to pay you the difference.

Their tickets keep working

A ticket or season pass that is still valid stays valid. The QR code does not change. If they turn up at your door next week, you simply scan it; you just no longer see a name.

What goes into the activity log

Who erased, when, the reason and the order numbers. Not the email address: an erasure request that leaves the address in the log is no erasure.

Common mistakes

Erasing a buyer with a pending refund. Refund first, then erase. After erasing you no longer know to whom.

Typing the wrong address. Check the address first with Export one buyer's data: you then see exactly what will disappear.

Frequently asked questions

Do I always have to erase when someone asks? Almost always. What you must keep by law, such as invoices, stays in place; the button takes care of that for you.

Does this also erase the data at another organisation? No. If the same person also bought from another organisation, that is their business.

More about exporting in Exporting your data.