Brightpearl offers several features to assist with General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Both laws give consumers the right to request that you provide a copy of their personal information and/or that you pseudonymize their data (remove or replace all personal information). To assist with that, Brightpearl offers the following features:
- Downloading a contact
- Forgetting a contact
Downloading a contact
Downloading a contact from Brightpearl exports a shareable CSV file containing the chosen contact's data. This includes:
- Contact data, which includes the contact's name and address details as well as other contact details like email addresses and phone numbers.
- Order information, which includes:
- a list of orders the customer has raised
- a list of the rows that appears on those orders
- any public notes added to the orders
Use the Order ID value to link orders to order rows and order notes.
How to download a contact
- Search for and open the contact record
- In the Contact Data Protection information box on the right-hand side, click Download contact information
- In the pop-up window select the appropriate hyperlinks to download the data
Note: The CSV file doesn't include:
- any files (invoices, etc.) linked to the contact. View the contact's "Files" tab to view and/or download these attachments if necessary.
- any private order notes. Only public notes (those that have been emailed to the customer, or created by the customer in the web portal) are included in the Order information download.
Forgetting a contact
Forgetting a contact will erase or obscure the contact data throughout Brightpearl.
Data will be erased when possible, but obscured within required fields. For example, the contact's name will be replaced with the text "FORGOTTEN CONTACT" followed by the date and time the contact was forgotten.
When forgetting a contact any emails associated with them will be deleted. If those emails are associated with other contacts it will also be deleted from their record.
The following resources can be erased or anonymized:
- Name and contact information
- Contact custom field data
- File attachments
- Helpdesk tickets, activities and other events
- MailStore emails and email attachments
- Order contact information (including incomplete orders)
- Timeline notes
Warning: Forgetting a contact in Brightpearl may not update external systems. Make sure your processes include any external systems.
How to forget a contact
- Search for and open the contact record
- In the Contact Data Protection information box on the right-hand side, click Forget this contact
- In the pop-up window select the data sources to forget
- Click Proceed, you will be able to review the selection before finishing
- Review the data sources which will be removed and click Submit. The contact data will then be removed from Brightpearl
Opt out of sale
If you sell the personal information of consumers, California residents now have the right to the following:
- Request a list of the categories of their personal information that you sold
- Request a list of the buyers of that personal information by category of personal information over the previous 12 months
- Opt out of the sale of their personal information going forward
The latter can be tracked in Brightpearl via a custom field.
How to track opt-outs
- Navigate to Settings > Custom fields > Customers
- Select Add a field
- Name the field "Opt out of sale" and set the custom field type to "Yes/No"
- Add a second custom field for the opt-out date, this time choosing "Date" as the custom field type
- Click Save
These fields can then be edited against a customer record.
Transfer of personal data to Brightpearl
The transfer of personal information to us, by using Brightpearl to manage your business, is not a sale under CCPA.
Brightpearl is a service provider and we only use the information you transfer to us for the purposes of providing our service.
Brightpearl may share information with other service providers, such as cloud storage services. We do not believe this is considered a sale under CCPA as these providers are obliged not to use the information for their own purposes.