Responding to a GDPR data-subject request

Open /settings/privacy → DSR workbench.

Search for the subject by email or ID. The workbench lists every record, attachment, and audit event tied to them across all modules.

Click "Export" for a subject-access request (SAR) — delivers a machine-readable zip.

Click "Erase" for a right-to-erasure. Records are pseudonymised; legally retained items (tax, accident records) get a flag explaining why they cannot be fully deleted.

Every DSR action is logged, immutable, and exported to your DPO address quarterly.