> ## Documentation Index > Fetch the complete documentation index at: https://docs.orriven.com/llms.txt > Use this file to discover all available pages before exploring further. # Data & privacy > Handle a data-subject request from one page: find everything the organization holds about an email address, export it as JSON, or erase the person while headcount and financial records stay intact. When someone asks what data is held about them, or asks for deletion, use **Data & privacy** in the organization section of the console. The page works on one email address at a time and reaches **every Business Unit in the organization**. A person is a contact of the organization, whichever units they registered with. The page has three actions: **Search**, **Export JSON**, and **Erase this person**. All three need an organization **Owner** or **Admin** (the **Data & privacy** permissions *Export* and *Erase* on the [Roles](/en/organization/roles) page). Exporting packages a person's entire footprint into a file. Erasing is irreversible. Neither belongs to content editing. Requests are handled by the organizer, on the requester's behalf. Verify that the request comes from the owner of the address **before** acting. That check happens outside the platform. There is no self-service for attendees. ## Find a person Enter the address the person registered or ordered with and choose **Search**. Looking changes nothing. * **Nothing found** — the address appears nowhere in the organization. That is a statement, not an error. * **Found** — the page shows **what a request would touch**, as counts: **Contact records**, **Attendee identities**, **Registrations**, **Orders**, **Check-ins**, and **Answers and observations**. Counts only. Confirm the right person from the scope of the request, not by comparing personal details on this page. ## Export Choose **Export JSON**. The browser downloads one machine-readable file — the portability format — assembled from the response. Nothing is stored on the platform. The export contains everything the organization holds about the address: the contact record, the attendee identity in each Business Unit, every registration (event, status, ticket type, time, the organizer's private notes, form answers, submission metadata, check-ins, survey answers, hotel stays, and which exhibitors captured the person's badge), and every order. Export first if the record may be needed later. Once the person is erased there is nothing left to export. ## Erase Choose **Erase this person**. The dialog states what will happen — identity is removed everywhere; registrations, orders, payments, and check-ins stay, with no name on them — and asks to **type the address again** to confirm. Then **Erase permanently**. When it completes, the page shows **What was done**: an itemised receipt of how many rows were anonymised and how many documents deleted, by kind. Send it back to the person who asked. ### What erasure does | Treatment | What | | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Anonymised** — the row stays, the identity goes | The contact's and attendee's name and email; the buyer's name and email on orders; email recipient records; a speaker profile's name, title, and bio; the names of stay guests; the organizer's notes and rejection reasons on registrations; lead-capture notes | | **Deleted** — the whole record goes | Registration form answers; submission metadata (IP address, browser); survey responses | | **Voided** | The person's hosted pass and order links — a link already sent out stops opening | | **Kept as it is** | The registration itself (status, ticket type, time); check-ins; order numbers and amounts; payments, ledger, and refunds; the audit log | The line is: **erasure that keeps the headcount is anonymisation, not deletion**. Last year's conference had 300 attendees. One of them exercising their rights does not make it 299. Reports, capacity, and finance are untouched. ### What erasure does not do * **It does not reach a connected CRM.** A record already synced to Salesforce stays there — that CRM has its own retention policy and obligations. * **It does not rewrite the audit log.** Audit entries are the proof that the organization acted on the request. They are kept for the legal retention period. Earlier entries from ordinary operations — the day the person was added, for example — may still carry the address. The entries this page writes for a search, an export, or an erasure carry only a hash of it. Tell the requester so: operational data has been anonymised; operation logs are retained for the statutory period and cleared with the log as a whole. * **It does not delete financial facts.** Amounts, payments, ledger, and refunds stay, under their own retention rules. The identity is gone; the money is not. * **It does not erase console accounts** — that is offboarding, done on Members — or exhibitor contacts. * **If the person registers again**, it is a new contact and attendee. Nothing links back to the erased record. ## Rules to know * **Organization level, every unit.** One request covers every Business Unit. There is no per-unit erasure. * **Owner or Admin only.** Search, export, and erase alike. * **Irreversible, so confirmed twice.** The address must be retyped exactly before erasure runs. * **No match is not an error.** Whether an address belongs to a customer is not something the page reveals through a failure. * **Every search, export, and erasure is recorded** in the [audit log](/en/organization/audit-logs) — actor and time in full, the address only as a hash. ## Related Where a person's registrations live before a request arrives. The trail that proves the request was acted on. Contacts and attendees — the two records one person leaves.