Data subject requests
How GDPR access and erasure requests are handled, including Shopify's mandatory flow.
Peleka acts as a data processor on your behalf; you (the merchant) are the data controller. That means when someone asks what personal data you hold on them, or asks you to delete it, fulfilling that request is ultimately your responsibility. Peleka gives you the tools to do it in a couple of clicks.
Handling a request for any contact
Open any contact's profile and use the ⋯ menu:
- Export Data: downloads a JSON bundle covering their profile, custom fields, tags, segments, consent record, activity history, and engagement metrics. This satisfies a GDPR Article 15 access request.
- Erase All Data: a GDPR Article 17 ("right to be forgotten") action. It's permanent, requires a confirmation checkbox, and additionally scrubs logs and consent records and permanently suppresses the address from ever being re-added to your workspace.
Shopify's data request flow
If you're connected to Shopify, Settings → Data Requests shows a dedicated queue. This exists because Shopify requires every app on its platform to support customer data requests as part of its mandatory GDPR webhooks.
Requests are grouped into Needs attention (pending) and Fulfilled, each showing the customer's email, source, and how long ago it came in. Open a request to see:
- The compiled data as JSON (or a clear note if no matching contact record exists, so there's nothing to export)
- A Download JSON button
- A Mark as fulfilled button once you've delivered it to the customer per Shopify's process
Shopify also sends two other mandatory webhooks that Peleka handles automatically, with no action needed from you:
customers/redact: auto-redacts that customer's personal data from Peleka.shop/redact: triggered when your Shopify app is uninstalled; disconnects the integration and redacts all Shopify-sourced contact data within 48 hours.
What Peleka processes on your behalf
- Contact/subscriber data: email, name, phone, custom fields, consent status, and engagement history.
- E-commerce data (if Shopify/WooCommerce is connected): customer email/name/phone and marketing consent, order IDs/totals/line-item titles, and abandoned-cart contents. Peleka never receives full payment card data; that stays with Shopify/WooCommerce and their payment processors.
- Your team's own account data: for workspace members.
Looking for the DPA?
A Data Processing Agreement is available for workspaces that need one for their own compliance documentation. Email [email protected] to request it, along with the current list of sub-processors.