A subject access request is when someone asks to see the personal information you hold about them. Compliance > Subject Access Request gathers it in one place.
Handle a request
Check who is asking
Make sure the request really comes from the customer, for example by replying to the email address on their account.
Search by email address
Enter the customer’s email address and choose Search. If there is no such customer, the page says so.
Review what's held
The page lists everything, described below.
Export to PDF
Choose Export to PDF. The file includes your organisation name and the name of the team member who prepared it. Send it to the customer.
What the report contains
| Section | What’s in it |
|---|---|
| Contact details and preferences | Name, email, phone, date of birth, when they became a customer, waiver status, emergency contact, marketing choice, when a verification code was last emailed, and any children saved on their account. |
| Bookings | Every booking they made or rode on. For bookings they made: places, total, when booked and paid, check-in, and the other riders. For bookings made by someone else, only the session is shown, protecting the booker’s details. |
| Season passes | Each pass with price, purchase date, validity and status. |
| Shop orders | Each order with what was bought and where it was delivered. |
| Vouchers used | The codes, when and on which booking. |
| Who else holds this data | Other organisations that receive the customer’s data, why, and what. Stripe appears if they’ve paid for anything (name, email and amount paid). Each marketing tool you’ve connected appears too, with whether they’ve opted out. |
Afterwards
If the customer also asks for their data to be erased, see Scrub data. Export their data first.