Erase a client
A client may ask you to forget them. Erase client answers that request: it removes the client's personal data from go flow in one step. It rests on the right to erasure, which the data protection law of the client's organisation grants.
The client is anonymised, not deleted. The record keeps its identifier but no longer says who the person was, so that what the law obliges you to keep, such as your accounting records, and the audit log stay linked to a record that holds no personal data.
Erasing cannot be undone. If the client also asked for a copy of their data, make the data subject export first: after the erasure an export no longer holds the client's name, contact details, answers or notes.
Which law the dialog cites
The confirmation dialog names the legal basis by the Country of the client's organisation (set in the organisation settings):
| Country of the organisation | The dialog says |
|---|---|
| A member state of the EU or the EEA (Iceland, Liechtenstein, Norway) | Legal basis: GDPR Art. 17. |
| Switzerland | Legal basis: Swiss FADP Art. 32. (the Federal Act on Data Protection) |
| Any other country | No legal basis is named. |
The erasure itself is the same in every country; only the citation changes. The data subject export follows the same rule.
Delete or erase?
A client record can leave your lists in two ways, and they are not the same:
| Delete the client record | Erase the personal data | |
|---|---|---|
| What it is for | A client you no longer need in your lists. | A client's request to be forgotten. |
| What happens | The client leaves the lists. The record and its data stay in go flow. | The personal data are removed, as described below. |
| Undo | Possible while the organisation keeps record history: restore a version from before the deletion. | Never. |
| Field answers | A field with a Retention (months) clears its answers that many months after the deletion (see field privacy settings). | Cleared at once. |
When you delete a client in the client dialog (Mark for deletion, then save) and you hold the rights to erase, a dialog Delete this client? asks which one you mean. Delete the client record is selected each time it opens; choose Erase the personal data to go on to the erase confirmation instead, then the confirm button (tooltip Continue) at the top right. Erase the personal data cannot be chosen while you are offline: it reads "Erasing needs a connection to the server." Closing the question leaves the client dialog open with the deletion still marked. A user without the rights to erase is not asked: saving deletes the record.
Who may erase
You need both of these rights on the client's organisation, each at Manage:
- Configuration & settings, and
- Clients.
Without both, the client dialog does not offer Erase client. Set the rights in the user's rights. Erase client is also disabled while you are offline.
Erasing a client
- Open the client: on the Clients page choose the eye icon at the end of the client's row, or double-click the row. The client dialog opened from anywhere else, for example from a session's participants, works the same way.
- In the client dialog's toolbar, choose More actions (the three dots), then Erase client. You can also get here by deleting the client, see Delete or erase?.
- The dialog Erase this client? names the client, says which law it answers to (see above) and lists what is erased and what is kept. Read it.
- Confirm that you mean it:
- If the client has an email address, type that address into the Email field. Capital letters and spaces at the start or end do not matter. The confirm button stays disabled until the two match.
- If the client has no email address, tick I understand that this cannot be undone.
- Choose the confirm button at the top right of the dialog, named Erase. It shows progress while the request runs, and the dialog cannot be closed until the answer arrives. One click sends one request.
When it succeeds you read The client has been erased., both dialogs close, and the client leaves the list within a moment.
What is erased
- The client's name, contact details and answers, including the answers given when booking and on journal entries.
- Staff notes and tags, on the client and on the client's bookings, orders, payments, wallet entries and vouchers.
- Files stored for the client.
- Messages: the emails and SMS sent to the client, and those still waiting to be sent.
- Feedback links and written feedback: a feedback response no longer names the client, and its written answers are cleared. Scores and choices stay, with no link to the person.
- The record history of the client, of its bookings and of its journal entries. This also means an earlier version cannot be restored from the history.
What stays
- Orders, payments, refunds, wallet entries, vouchers and receipts. Accounting law requires you to keep them: Swiss law (Code of Obligations, Article 958f) for ten years, Swedish law (Bokföringslagen) for seven. They stay without staff notes or tags, also in their record history.
- Booked places. A place stays as it was, with its status, number of places, payment markers and order, so session figures and money remain correct, but without personal details: the answers, notes, cancellation reason and device details are gone.
- The audit log. It keeps that an erasure happened, as the entry Client data erased (
client.erase) in the Data category. The entry carries only counts of what was cleared, never personal data, and is kept for 13 months like every Data entry.
The client record itself stays only as an anonymous placeholder: its email address is replaced by one ending in @erased.invalid, and its status is deleted. Nothing brings the data back: a device that still holds the old client offline cannot write it back.
Not erased: check by hand
go flow does not touch an appointment's own notes, which may still carry the client's name. After erasing, look through the notes of the client's sessions by hand and remove the name where it appears.
When erasing is refused
Erasing is refused while business with the client is still open, and nothing is changed or recorded. The dialog stays open, reads This client cannot be erased yet:, lists each reason with a count and ends with "Cancel the bookings and settle the payments first, or wait until processing has finished." Settle them, then choose Erase again.
| The dialog says | What it means | What to do |
|---|---|---|
| current or future booking(s) | The client holds a place in a session that has not ended yet: booked, reserved or on the waiting list. | Cancel the bookings, see Cancel and refund a booking and Session participants. |
| cancellation(s) still being processed | A cancellation's refund and notice are still being handled. | Wait until processing has finished, then try again. |
| booking(s) marked unpaid | A place was marked as unpaid at the desk, also for a session that is already over. | Settle the place in the session's participants with Take payment or Waive, see Session participants, or cancel the booking. |
| payment(s) still open | A payment of the client has not finished. | Wait until the payment provider completes or cancels it. See Payments. |
| refund(s) not yet completed | A refund to the client has not gone through yet. | Wait until the refund is completed. |
| paid order(s) still waiting for a receipt | An order is paid but its receipt has not been issued. | Wait until the receipt is issued. See Orders. |
An order that was never paid and has no open payment, for example an abandoned cart, does not block.
Two other answers are possible:
- This client has already been erased. Someone erased the client before. Both dialogs close and the list updates.
- The client could not be erased. Please try again. The request did not go through, for example because the connection dropped or your rights changed. Nothing was erased; try again, and if it keeps failing check your rights.
What is recorded
An erasure that goes through is recorded in the audit log as Client data erased (client.erase), with the date, the user who erased and the client's identifier. A refused erasure is not recorded.