GDPR: personal-data export, erasure and what's retained

Clubs hold children's data, so data-protection requests deserve first-class treatment. Tempo plugs into WordPress's standard privacy tools, applies sensible retention rules, and leaves you with defensible answers. The usual reminder applies: this article describes what the software does; it isn't legal advice.

Exporting someone's data

WordPress's Tools → Export Personal Data works on Tempo data out of the box. A request for a member's email address produces the standard WordPress export including their bookings, credit history, attendance, email log entries, photo-permission answers (the answer, scopes, signer and date, deliberately not the signature image, which stays behind its access-checked route) and notification preferences.

Erasing someone's data

Tools → Erase Personal Data runs the flip side. Tempo erases what can be erased and is explicit about what it retains:

• Erased: notification preferences, first-login wizard records, undelivered notices, and email-log recipient addresses (anonymised).
• Retained, and reported as such: bookings, the credit ledger, transfers, audit entries and photo-permission records. The reasons are the classic lawful ones: financial records, the append-only audit trail, and signed consent records; a *withheld* photo consent especially must be kept, because the club needs it in order to keep honouring it.

The erasure report WordPress generates states these retentions, which is exactly the paper trail you want when responding to a request.

The everyday privacy posture

Most of Tempo's data protection isn't in this article; it's structural, and covered where it lives: sensitive profile fields encrypted at rest with audited, gated access (protected profiles); signed, append-only consent records (photo consent); exports that exclude sensitive fields by construction (CSV export); an audit log that names who viewed what (the audit log); and staff notes that are never member-visible. When a parent asks "how is my child's data handled?", those five links are the honest, complete answer.

Whole-site removal

Individual requests are the above; taking the whole plugin's data off a site is different machinery, deliberately: the danger zone erase and the uninstall opt-in. A member request never needs those.