Skip to main content
The Compliance group in the sidebar holds the privacy tools a data controller needs:
  • Subject Requests: find a person, export everything held about them, or erase them.
  • Processing Record: an Article 30 record of processing activities (RoPA), generated from how your workspace is actually configured.
  • Deliverability: see Deliverability and warm-up.
Both privacy tools are for Owners and Administrators only. Subject requests are a controller responsibility.
These tools help you meet your obligations. They aren’t legal advice. Each workspace is its own controller. If you run workspaces for clients, each client is the controller of its own list.

​
Subject Requests

When someone asks what you hold about them, or asks to be forgotten, the statutory clock starts right away. Under UK/EU GDPR you have one calendar month. If you manage several workspaces (for example, as an agency), the first problem is knowing which of them hold that person. The console searches every workspace you administer at once.
1

Find the subject

Go to Compliance → Subject Requests, enter the person’s email address under Find a subject, and click Search all workspaces. The results list each workspace with a match, how many workspaces had no record, and any workspace where the person was erased previously (only a suppression record remains).
2

Log the request

On a match, click Log access request or Log erasure request. Each workspace gets its own request with its own deadline, because each is a separate controller. Logged requests appear in Request queue — this workspace with the received and due dates. Overdue requests are flagged Overdue.
3

Fulfil it

  • Access: click Export record to download everything that workspace holds about the person as a JSON file, including engagement and event history.
  • Erasure: click Erase, type the email address to confirm, and click Erase permanently.
Use Open only or Include closed to filter the queue. Requests end as Fulfilled or Refused.

​
What erasure does

Erasure removes the contact and the records tied to their address that a plain contact delete would leave behind, such as send and engagement history, form submissions, journey runs, and event and store-order records that name them. It then keeps a suppression tombstone, a minimal marker, so the address can’t be silently re-imported and mailed again.
Erasure is permanent and can’t be undone. If you might need to answer an access request as well, export the record first.

​
Processing Record

Compliance → Processing Record is an Article 30 record for the current workspace, generated from its live configuration. Each entry cites the setting it came from (“Derived from: …”), so you can trace and defend every line. Sections:
  • Purposes of processing
  • Categories of data subject
  • Categories of personal data
  • Categories of recipient: the platform’s email, storage and AI processors, the email providers your workspace has connected under Settings → Integrations → Email sending (each one cites how many delivery routes point at it), connected integrations and ad platforms, webhook endpoints, and systems holding your API keys
  • Transfers outside the UK/EEA
  • Retention
  • Security measures
If nothing in the workspace produces an entry for a section, the page says so. Open questions lists the decisions only the controller can make, such as your lawful basis. These are left blank on purpose. A filled-in default is exactly what a regulator finds hardest to accept. Click Download for client to save the record as a Markdown document you can share or add to your own compliance file.
  • Settings → Double opt-in and Settings → Preference centre control consent capture and how subscribers manage their subscriptions.
  • The postal address under Settings → Sender Information is printed in the marketing email footer. See Sender identity and domain authentication.
  • Website tracking is cookieless and needs no consent banner. See Website analytics.