Home
Security
GDPR tooling

GDPR tooling

Consent logs, data export, erasure with a fiscal-retention hold, anonymisation and an incident register — built in.

At a glance

Plan: All plans
Last updated: September 2, 2026

What this covers

The machinery behind the promises in your privacy notice: a record of what each visitor consented to, a way to answer an access or erasure request the same day, and retention rules that actually run instead of sitting in a policy document.

How it works in ELVPro

Consent, logged as proof

The cookie banner is granular — analytics, marketing and functional choices are separate — and every decision is stored along with what was shown at the time. Google Consent Mode v2 signals follow the same choice, and tags stay silent until the visitor agrees.

Access and portability

A customer can download everything held about them from their own account. One shared exporter assembles it, so the customer-side and the yard-side answers to the same request are identical and nothing is quietly left out — orders, carts, reservations, messages, chat, alerts and consent history included.

Erasure

Deleting a customer runs a single job that walks that same map, including records tied only to a browsing token rather than to an account.

Erasure that respects fiscal law

An issued invoice cannot simply vanish — the law requires keeping it. Rather than refusing the request or breaking the books, ELVPro stamps the record with the date its legal hold expires (five years from 1 July following the fiscal year) and anonymises the personal data automatically when that date arrives.

Retention that runs

Scheduled jobs erase customers whose retention window has closed, prune expired visitor-access logs, strip personal data from retained records, and null stored integration payloads while keeping the metadata needed for troubleshooting.

Encryption at rest

Credentials for every third-party integration, and the most sensitive personal-data columns, are encrypted in the database.

Incident register

A personal-data breach is recorded with its timeline, and the 72-hour notification clock is watched — the incident contact is warned as the deadline approaches, not after it has passed.

When it happens

When this runs, and what it does
When	What happens
At first visit	the consent choice, and a fresh log entry each time it changes.
On request	export and erasure start immediately, running in the background.
Nightly	the retention, anonymisation and log-pruning sweeps.
While an incident is open	the notification-deadline check.

Why it matters

GDPR gives every customer the rights of access, portability, rectification, erasure, restriction and objection, and gives you the duty to prove your lawful basis, to keep data no longer than necessary, and to report a breach within 72 hours. Those obligations are only real if the tooling exists on the day someone asks.

What we don't claim

ELVPro is the processor for the data your yard holds; you remain the controller, and the decisions — lawful basis, retention periods, what your privacy notice says — remain yours. A Data Processing Agreement, a cookie policy and a processing-record template come with the platform: a starting point for your counsel, not legal advice.

Questions about security or compliance?

We will gladly walk you through how ELVPro handles your data — or fill in your compliance questionnaire.

Start free All security topics