Data Protection
Data protection built into the platform, so a data request is a routine job rather than a scramble.
No per-user pricing for up to 50 users.
The Data Protection hub connects to every module that holds personal data, so you can answer a request without hunting through the system. It follows UK GDPR and the Data Protection Act 2018, and has an EU mode that changes the regulator, the wording and the contact details.
Requests are worked by a Data Protection Officer role alongside your administrators.
Requests with deadlines
Log access, erasure, rectification, restriction, portability and objection requests. Identity is checked first, the one-month clock is tracked, and anything overdue is shown first.
Find the right person
Search across your records by name, email, phone and address. Free-text matches go to a reviewer, who confirms which really belong to the person.
Review, redact, approve
Records that mention other people are flagged and redacted, with a reason logged. A second person has to approve, so whoever prepared the request cannot approve it.
Erase and keep the books straight
Personal details are replaced while invoice totals, VAT, dates and numbers stay, so your accounts still add up. A retention schedule decides what must be kept.
A proper data download
A ZIP file with a readable summary plus JSON and CSV data, delivered by a secure link that expires.
Breach register
Log a breach, assess the risk and decide whether to report it, with a 72-hour countdown from the moment you became aware.
Consent, retention and processors
Keep a consent history for each customer, set retention periods, and record the processors and transfers you rely on.
Evidence when you need it
A dashboard shows open requests, a compliance score and a to-do list. Produce an evidence pack in one click, with assessment templates and a policy library alongside.
Careful by design
- Erasure can be run in preview mode first, and always needs a typed confirmation and a second approver.
- The audit log holds customer numbers, never names.
- If a backup is ever restored, erasures are applied again automatically.
- Identity documents are stored encrypted, every view is logged, and they are deleted 30 days after the request closes.
- Your customers can make a request through a public page that carries your own branding. Nothing is created until they confirm their email address.