This article explains the data subject rights of your customers with regard to personal data. The GDPR opens up various rights for customers:
- A right to erasure according to Art. 17 DSGVO
- A right to information according to Art. 15 DSGVO
- A right to object to the processing of personal data pursuant to Art. 21 GDPR
Right to erasure
After the customer submits a deletion request to you, you should first make sure that they have secured their order with the Trusted Shops buyer protection.
You can see whether your customer has taken out buyer protection for their order in the guarantee system for the past 12 months, see the screenshot below:
If buyer protection has been concluded and the customer requests termination of the buyer protection account, the customer must contact Trusted Shops themselves. You can then refer the customer to email@example.com.
In the event of data deletion due to unlawful data transfer, deletion based on your request is only possible if you send us a copy of your customer's request.
If you have provided us with your customer's email address as part of AutoCollection, via the Review Collector or the API, so that we can send review invitations on your instructions, please note that 180 days after the review invitation has been sent, the data will be automatically deleted unless a review has been submitted.
Therefore, please avoid forwarding corresponding deletion requests to us after more than 180 days after the order has been placed and instead confirm to the customer that the data has already been deleted from Trusted Shops. In this way, you avoid the data entering our system again. You can see whether a review invite has been sent for your customer in the Control Centre.
Before the 180 days have expired, you can of course forward corresponding deletion requests to firstname.lastname@example.org.
Right to information
Please note that customers have a comprehensive right to information pursuant to Art. 15 GDPR. This request for information can be addressed directly to you or to us.
We provide our data copy as a PDF file, which also contains information on data categories, processing purposes, origin of the data, data recipients, transfers to third countries, retention and deletion periods and their rights regarding personal data.
Right to object to the processing of personal data
The customer also has the right to object to the processing of his personal data at any time in accordance with Art. 21 GDPR. If the processing is for direct marketing purposes, the customer does not have to justify his objection.