Right to Be Forgotten

Process GDPR deletion requests

Right to Be Forgotten

Under GDPR Article 17, individuals have the right to request the erasure of their personal data. When a contact in the EU (or any jurisdiction with similar rights) asks you to delete their data, you must comply without undue delay. Mailnaptic provides a comprehensive hard delete feature that makes this process straightforward and thorough.

What Gets Deleted

When you execute a hard delete for a contact, Mailnaptic permanently removes the following data:

• Contact record: Name, email address, phone number, and all custom field values.
• Tag associations: All entries in the contact-tag mapping table.
• List memberships: All list member records linking the contact to your lists.
• Site events: All web tracking events associated with the contact (page views, custom events, purchases).
• Frequency cap records: Send frequency tracking data.
• Email activity: Open, click, bounce, and complaint events linked to the contact.
• Consent records: Consent log entries for the contact.

This deletion is irreversible. Once executed, the data cannot be recovered. Mailnaptic does not maintain backups of individually deleted records.

How to Process a Deletion Request

1. Navigate to Contacts and search for the contact by email address.
2. Open the contact's detail page.
3. Click the Actions menu and select Hard Delete (GDPR).
4. A confirmation dialog will appear warning you that this action is permanent. Review the information carefully.
5. Type the contact's email address to confirm, then click Delete permanently.
6. Mailnaptic processes the deletion across all related tables and confirms completion.

Processing via API

For organizations that receive deletion requests through automated channels, you can process hard deletes programmatically using the API:

DELETE /api/contacts/:id/hard-delete

This endpoint requires authentication and triggers the same comprehensive deletion as the UI action. A successful response confirms all associated data has been purged.

Record Keeping

While the personal data is erased, Mailnaptic preserves an anonymized audit log entry recording that a deletion was performed, when it occurred, and which admin initiated it. This record contains no personally identifiable information but serves as evidence that you fulfilled the erasure request — useful for demonstrating compliance to supervisory authorities.

Response Timeline

GDPR requires you to respond to erasure requests within one month. In Mailnaptic, the technical deletion happens instantly. However, you should acknowledge the request to the individual promptly and confirm completion within the required timeframe.

Suppression After Deletion

After hard-deleting a contact, consider adding their email address to a global suppression list to prevent accidentally re-importing or re-subscribing them. Mailnaptic's global suppression feature ensures that even if the email appears in a future CSV import, it will be blocked from re-entering your contact database.