Skip to main content

Compliance

Davies CXsmart includes the GDPR and data-protection controls you need to handle personal data responsibly: subject erasure, data retention, suppression and opt-out, and a deletion audit trail.

Permission required​

All compliance actions require the gdpr.manage permission (suppression management may also use compliance.manage). Without it, the compliance surfaces are not available to a member. See Users & roles.

Subject erasure​

When a data subject asks to be forgotten, erase their response. Erasure removes the personal data from the response while leaving a record that the erasure happened.

To erase a response, supply its response id and run the erasure. The response's personal data is cleared, and a deletion record is created for the audit trail (see below).

Retention purge​

Retention automatically removes old data. Run a rolling retention purge to delete responses older than a number of days you specify. Use this to enforce your data-retention policy so personal data isn't kept longer than necessary.

ActionWhat it does
Erase a responseClears the personal data of one specific response.
Rolling retentionPurges all responses older than the chosen number of days.

Suppression and opt-out​

Compliance also covers suppression — the do-not-contact controls applied before every send:

  • Suppress a contact — add a single email or phone number to the suppression list, with a reason.
  • Bulk import — add many contacts at once (channel and address per line).
  • Opt-out / unsubscribe — record that a contact has unsubscribed on a channel.

Suppression lists store contacts as a one-way hash, so the list itself holds no readable personal data while still matching future sends correctly. The full sending-side picture, including the phone blacklist and contact-frequency cap, is in Suppression and opt-out.

Deletion audit trail​

Every erasure and retention purge writes a deletion record. Crucially, these records survive the purge — the personal data is gone, but proof of the deletion (its type, scope, and timestamp) remains, which is exactly what auditors expect.

Review the deletion audit to demonstrate compliance: it lists each deletion's request type, scope detail, and when it ran.

Anonymity threshold​

To protect individuals in aggregate reporting, your client account has an anonymity threshold — a minimum number of responses required before aggregated figures are shown. This prevents small samples from inadvertently identifying individuals, and it applies to public-facing figures such as the survey badge.

Next steps​