GDPR
Consho provides the technology; you are responsible for the content. This page describes what Consho does; it is not legal or tax advice.
Consho creates an access copy about a customer, carries out an erasure request and anonymises orders once the retention period has ended. Sending it out and checking the person's identity are up to you.
Retention period
In the shop configuration, in the “Retention and data protection” section:
| Retention period (years) | mandatory, without a default – you set the period. It is counted from the end of the calendar year of the latest document. |
|---|---|
| Anonymise automatically after the period | switched on by default. If it is switched off, only orders with an erasure request are anonymised. |
For reference, the help names the usual periods in Austria and Germany. Contao's cron anonymises daily.
Withdrawals not assigned – those without an order – have no document and do not follow this period: they are anonymised three years after the end of the year they came in, in every shop.
Access and erasure
Under Consho → Customers, “Show customer and orders”, section “Access and erasure”:
- Download access copy: a ZIP file with the data as JSON and the document PDFs. Withdrawals not assigned under the same e-mail address are included.
- Erase data: only with the confirmation that the person has requested the erasure and their identity has been checked. Orders past the end of the period are anonymised at once, orders still within it at the end of the period. Baskets and notes disappear at once; running subscriptions stay until the end of the contract. You delete the member account itself under “Members”. This cannot be undone.
What remains after anonymisation
Numbers, amounts, tax, lines, dates and the country remain – what accounting needs. Name, company, addresses, e-mail, phone, date of birth, VAT ID, the link to the account, texts of withdrawals and complaints, payment and shipment references and the archived PDFs are removed.
Findings
- No retention period entered: then nothing is anonymised, and an erasure request can only be noted. Warning, does not block.
- Anonymisation coming up (note): names the orders whose period ends within the next 30 days. Because every period ends on 31 December, it appears from the beginning of December for the whole year; anonymisation follows at the turn of the year.