Finding everything on one person Link to this section
Under the GDPR, people can ask which data you hold about them and ask you to erase it. You have one month to answer. The Personal data page does the searching for you: open the workspace menu at the top and choose Personal data. Owners and admins of the workspace can use it, on every plan, Free included.
Enter the email address of the person. TinyForms looks through every form of the workspace and finds the address in every email question, the questions of the waiting list included, without regard to upper or lower case. It also finds the personal links sent to that address, and the submissions that came in through them. Cancelled submissions, submissions in the bin and forms in the bin are searched too.
Each result shows the form, the date, its status (active, cancelled, in the bin or on the waiting list) and how it was found, such as the email question that holds the address.
Forms without an email question
A submission to a form that asks no email address cannot be found by address. For those, also fill in a name or other text. That search reads the answers themselves, so it is slower and less exact: it reads the newest 1,000 submissions of each form, shows at most 200 results, and leaves its results unticked, because a name can belong to someone else. Check each one before you tick it.
Sending a copy for an access request Link to this section
Tick what belongs to the person
Everything found by the address is ticked already. Untick what is not theirs and tick the text results that are.
Choose Export for access request
A small export is ready at once. A large one is prepared in the background and appears under Your exports as soon as it is ready.
Download the ZIP and forward it
Only you can download it, and it is deleted 24 hours after you made it.
The ZIP holds a readable summary (summary.html) in the language you work in, the same data for computers (data.json) and the files the person uploaded, in a folder per submission. The summary lists, per submission, the form, the date, every question with the answer as TinyForms shows it, payments with their amount and status, and the personal links sent to the person.
Read it before you forward it
Internal notes and tags your team added to a submission, and the IP address and browser while those are still kept, are personal data too, so they are in the export. Read the summary before you send it.
Erasing everything for an erasure request Link to this section
Choose Erase everything selected. A confirmation states exactly how many submissions, uploaded files and personal links will go. Once confirmed, the submissions are erased for good, in the bin or not, with their answers, notes and uploaded files, and the storage they took is freed. The personal links sent to the person are deleted. This cannot be undone, so export first if the person also asked for a copy.
Some things are out of reach of the erasure, and the page says so:
- Answers already synced to Google Sheets or Excel stay in that spreadsheet. Remove those rows there by hand. Forms that sync are marked in the results.
- Emails that were already sent, such as confirmations and notifications, cannot be called back.
- Payment records (amount, date and payment reference) stay, without the answers, as your record of money received. Accounting rules usually require you to keep them.
- Downloads and copies you made yourself are yours to delete.
Proof that a request was handled Link to this section
Every export and every erasure is written down under Handled requests on the same page: the date, who handled it, and how many submissions, files, personal links and forms it covered. The address and the answers are never written down, so the log does not keep what was erased. Entries are kept for a year.