GDPR & CCPA Support Process for Clients

To know more about GDPR and CCPA, please refer to our Security Overview page.

Glossary

  • Client: Merchant or Retailer
  • Consumer: Merchant or Retailer's Consumer

Consumer Request to Access Data

Including Request to Export Data

Consumer requests may be submitted by Clients to Ordergroove by submitting a non-critical ticket. To submit a ticket, use the Ordergroove Support Portal. 

Please include the following in the ticket: 

  • Subject: "(Client Name) GDPR (or CCPA) Consumer Data Export Request"
  • Body: "Please export consumer data for Consumer ID <merchant_user_id>"
  • Body: “Client represents that it has properly verified the identity of the requesting Consumer in compliance with applicable data protection law.”

Once a support ticket is created or an email request is received, the Ordergroove Support team will review the request and respond within thirty (30) days, by either exporting the data across our systems or — if needed — by contacting the client with a request for additional information to verify the consumer’s identity or better determine the type of data requested.    

In the consumer data export, Ordergroove will provide the following data (so long as Ordergroove stores for your account): 

  • Consumer profile information (first name, last name, email address, phone number)
  • Consumer address data (first name, last name, address 1, address 2, city, state/province code, zip/postal code, country, phone number)

Ordergroove will provide the export via the Ordergroove SFTP server, where it will be available for the Client to download. The ticket will be closed to confirm the completion of this action.


Consumer Request to Delete Data

Including Request to Restrict Processing

Create a ticket in the Ordergroove Support Portal

Once a support ticket is created or an email request is received, the Ordergroove Support team will have the consumer data deleted or processing restricted across our systems within thirty (30) days.  

Please include the following in the ticket: 

  • Subject: "(Client Name) GDPR (or CCPA) Consumer Account Deletion Request” or "(Client Name) GDPR (or CCPA) Consumer Account Restrict Processing Request”
  • Body: "Please run the script to anonymize data for consumer ID <merchant_user_id>"
  • Body: “Client represents that it has properly verified the identity of the requesting consumer in compliance with applicable data protection law.”

The requested consumer data will be deleted or its processing restricted across all Ordergroove systems and sub-processors within thirty (30) days, except to the extent that Ordergroove is required by law to retain some or all of the personal data, and to the extent, the personal data is archived on backup systems. In either case, Ordergroove will securely protect and anonymize said personal data from any further processing and eventually delete it in accordance with Ordergroove’s deletion policies. Once the request is fulfilled, Ordergroove will respond back to the ticket to confirm.  

Clients must provide a minimum seven-day (7) lead time on requests to delete or restrict the processing of data. Upon receiving a request, Ordergroove Support will ensure that any active subscriptions are canceled or the processing is suspended within two (2) business days, to ensure no further subscription-related communications are sent to the consumer. 


Consumer Request to Correct/Rectify Data   

Consumer requests may be submitted by clients to Ordergroove by creating a ticket directly in the Ordergroove Support Portal.

Please include the following in the email or ticket: 

  • Subject: "(Client Name) GDPR (or CCPA) Consumer Data Correction/Rectification Request"
  • Body: "Please correct Consumer data for Consumer ID <merchant_user_id>.”
  • Body: “Client represents that it has properly verified the identity of the requesting consumer in compliance with applicable data protection law.”
  • Attach: Corrected information. 

Once a support ticket is created or an email request is received, the Ordergroove Support team will review the request and respond within thirty (30) days by either correcting the data across our systems, or — if needed — by contacting the client with a request for additional information to verify the consumer’s identity, determine which data has been requested for correction, or in what manner the requested data is to be corrected. The ticket will be updated once completed.