Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.florists.digital/llms.txt

Use this file to discover all available pages before exploring further.

Under UK GDPR a customer can ask you to delete their personal data — the right to erasure, sometimes called right to be forgotten. The customer-delete flow removes their personal information while keeping the order, transaction, and invoice records you’re legally required to retain.
This page covers features gated by Manager-tier permissions. Managers and Admins have these by default; your administrator can adjust who has them in Settings > Team.
Make sure you have proper consent before exporting or sharing customer data. Follow your shop’s data protection policy.

​
Before you delete

Take a moment to confirm:
  • Identity — make sure the request is genuine. Verify the requester is the person whose data you’re being asked to delete.
  • Outstanding business — if the customer has open orders, an unpaid balance, or an active event booking, resolve those first.
  • Marketing lists — the deletion doesn’t reach back into email services you’ve already exported the data to. Suppress them in Mailchimp, your newsletter tool, etc. as a separate step.

​
What gets removed

Running the customer delete flow removes:
  • The customer’s name, email, phone, address.
  • Any delivery addresses in their address book.
  • Marketing preferences and consent records (kept as anonymised aggregates only).
  • Their notes, attachments, and portal access.

​
What is kept

For accounting, tax, and audit compliance, the following are retained but anonymised:
  • Orders and transactions remain with a placeholder customer (“Deleted customer #1234”) so financial reports stay accurate.
  • Invoices and credit notes stay attached to the placeholder.
  • Audit log entries referencing the customer keep their original IDs but show no identifying information.
You can show this list to the requester if they ask why some records remain.

​
Running a delete

1

Open the customer

Find the customer record on the Customers page.
2

Click Delete (GDPR)

The button is under the actions menu. The system checks for blockers first — open orders, unpaid balances, active events.
3

Review the summary

You’ll see exactly what’s about to be removed and what will be retained as anonymised records.
4

Confirm

The delete runs. The audit log records the request — keep this in case you need to evidence compliance later.
Customer deletion is irreversible. The personal data is genuinely removed, not soft-deleted. If you have any doubt, pause and verify before confirming.

​
Common questions

Resolve the account relationship first — either close the account or reassign sub-customers — before deleting the contact.
Yes. Use Exports to produce a CSV of their orders, transactions, and contact information. Send this to them as their subject access request response.
Under UK GDPR you have one calendar month from the verified request. Extensions are possible for complex cases but you must tell the requester.
You can delete their personal contact details but keep the corporate account record intact (companies aren’t covered by GDPR the same way). Document this clearly in the audit log.

​
What’s next?

Customer merge

Consolidate duplicate records before considering deletion.

Exports

Produce a subject access request export.

Audit logs

Evidence of GDPR request handling.
Last modified on May 17, 2026