Your customers' privacy requests

When one of your customers asks to access, correct or delete their data, the request is yours to decide: your brand is the controller of that data. Razviel carries out your instruction across its services and proves what was done. You record the request and follow it in Privacy requests, on the Privacy screen of the workspace.

Who can use it

Only the workspace owner and members with the Admin role see Privacy requests. For other roles the tab does not appear.

When a customer writes to Razviel

A customer's request normally reaches you, not Razviel. If a customer writes to Razviel directly, Razviel does not answer the request itself: it directs the customer to you, and you receive a notice in Updates. You decide whether to record it.

Record a request

1. Open Privacy from the Workspace section of the account menu.
2. Open the Privacy requests tab and choose New request.
3. Choose the right: access, rectification, erasure, portability, restriction or objection.
4. Enter the customer's email address and the date the customer made the request.
5. Add a note if you need one, then create the request.

For a rectification, you correct the data in your own Shopify store or Gorgias helpdesk, and Razviel reads it again from there.

Follow a request

The list shows each request with its right, the customer's masked email, the date received, the due date and the status. A request moves through Received, Verifying and Executing, and ends as Done, with its outcome and a certificate, or as Refused, with the reason.

Each request shows two dates: the one by which Razviel completes its part, and the one that applies to your brand toward your customer. Razviel carries out a documented request within 10 business days, or sooner when the law that applies to you requires it.

When a request is done

Opening a request shows how many tickets were found, never their content. A finished request ends with one of three outcomes, each with a certificate you can download:

• Erased — the data covered by the request was deleted.
• Partial retention — the data was deleted, except records kept on a ground the Data Processing Addendum allows, such as a legal obligation. The certificate names what was kept and why.
• Not found — Razviel held nothing for that customer.

For an access request, you can also download the package with the customer's data.