Privacy and personal-data access
Use Settings → Privacy & access requests to prepare a reviewed Article 15 response. The dedicated privacy.export permission belongs only to administrators by default and can be assigned to a specific role. Compliance export or audit access does not grant it.
Workflow
- Record receipt. VIA calculates the normal deadline as one calendar month, including month-end adjustment. Review exceptional cases and any justified extension separately. VIA does not send deadline notices.
- Link one to five identities belonging to the same person: producer, team member, customer contact or portal user. Similar names are not proof; additional identities are not inferred automatically from shared email addresses.
- Verify identity through an appropriate known channel and record the method. Do not enter identity-document numbers or scans in the note. An additional ID copy is not routinely required.
- Load the preview and review every record. Redact fields affecting other persons with a reason. Do not withhold the requester's own data without a valid basis.
- Open and review originals individually. No original is selected by default. Selected originals remain unchanged. Field redactions do not edit PDF or image contents. Provide reviewed redacted documents separately through a secure channel where required.
- Complete accurate controller information: purposes, categories, recipients, retention, sources, rights, complaint route, international transfers and automated decisions. VIA supplies no invented organisation-specific answers.
- Review additional systems and historical material. Include necessary information in the supplement or a separate secure delivery. Confirm both reviews and download the ZIP.
- Deliver the complete response securely to the verified person. Record delivery only after it actually occurred. Downloading a copy sends no response.
The ZIP contains data.json, offline-readable auskunft.html, checksums and only selected originals. It is returned directly without a public download object. Source changes require a fresh preview and review. Originals are limited to 20 MiB per package; arrange reviewed separate deliveries for larger responses. Missing or corrupted originals fail the package instead of disappearing silently.
If no matching identity is found, review identification and other systems separately. Never substitute another person. Any required confirmation that no data is processed needs a separate response.
Automatic scope and necessary complements
| Identity | Automatic scope |
|---|---|
| Producer | Master data, currently associated plots and all versions, harvests and entries, own lot contributions, plot screening and human reviews; linked documents available for selection |
| Team member | VIA profile, membership, matching invitations and own activity references; no other people's audit payloads |
| Customer contact | Own contact details and explicitly linked portal invitations |
| Portal user | VIA profile, own portal memberships and access references |
This automatic scope is not a completeness statement for Article 15. Separately review historical plot ownership, changes and corrections, mentions as an author or contact, mixed lots and chains, shipment and EUDR snapshots, free text and historical documents. These can contain other people's data and are not released indiscriminately. Auth0 account and security data, Cloudflare logs, support, email and other systems may require separate requests. Add all relevant information before closing the response.
VIA logs identity links, verification, package digests and delivery within the organisation. It does not retain the generated ZIP. Set a proportionate retention policy for access requests and evidence of handling; requests are not automatically erased.
Legal distinctions and backups
Article 15 covers access, a personal-data copy and specified information. Article 20 portability has separate conditions, particularly consent or contract and automated processing. JSON helps structured delivery but does not decide the legal scope or the need for technically feasible direct transfer. Legal bases, transparency, processor agreements, retention and erasure, rectification, restrictions, objections and appropriate security remain necessary. Export alone does not establish full GDPR compliance.
New daily production-only backups contain the database and actual document bytes, client-encrypted before upload: 35 days in a separate private EU backup bucket and 30 days in GitHub. Historical deployment and older backup artifacts may have different retention and safeguards. See the internal docs/production-backup-restore.md for recovery instructions and testing. Backup retention is not statutory evidence retention. Reapply subsequent erasures, corrections and restrictions before making a restored snapshot live. Check legal evidence-retention duties before deleting EUDR originals.
Source: GDPR Articles 12, 15, 20 and 32.