GDPR and customer data deletion requests

Under UK GDPR, customers have the right to request access to their personal data and the right to erasure (the "right to be forgotten"). Basecomp provides tools to handle both.

Data access requests

When a customer requests a copy of their data, go to Customers → [Customer] → Export Data. This generates a JSON file containing all data held about that customer including orders, ticket purchases, and account details. Send this to the customer within 30 days.

Deletion requests

Go to Customers → [Customer] → Delete Account. Basecomp will:

• Anonymise the customer's personal details (name, email, address)
• Retain order records in anonymised form for financial/legal obligations
• Remove the customer's login access
• Send the customer a deletion confirmation email

Note: Order records must be retained for a minimum of 6 years under UK financial regulations, even if the customer's personal details are erased. Basecomp handles this automatically by anonymising rather than deleting orders.

Your privacy policy

You are responsible for maintaining a privacy policy on your storefront that explains how you use customer data. Basecomp provides a template in Settings → Legal that you can customise.