Data Deletion Requests (GDPR Article 17)
Audience: This article is for church administrators.
TimelyChurch supports the Right to Erasure under GDPR Article 17 (also called "Right to be Forgotten"). When a member asks for their data to be deleted, TimelyChurch records the request, applies a 30-day grace period, and then anonymizes the person's record. This guide explains how the workflow operates and what to do as an administrator.
How a Deletion Request Works
- The request is made. A member requests deletion (see below) and confirms it from an email.
- Pending review. The request waits to be approved. The member sees Pending admin review on their Privacy & My Data page.
- Approved — 30-day grace period. Once approved, a 30-day grace period starts. The member sees Approved — 30-day grace period in progress and the date the anonymization is scheduled for.
- Completed. When the grace period ends, the person's record is anonymized.
A request can also be rejected (for example because of a legal hold -- nothing is changed) or cancelled during the grace period.
Where requests can be made
| Source | Available? | Notes |
|---|---|---|
| Member self-service (Privacy & My Data → Request account deletion in the Member Portal) | Yes | The member clicks Send confirmation email and must open the link in that email within 24 hours to submit the request; see Managing Your Profile |
| Church admin (on behalf of a member) | No page in the admin panel | Contact TimelyChurch support, who files the request for you |
In practice: A member who can sign in to the Member Portal can request deletion themselves from Privacy & My Data (the Privacy tab of their account). If a member asks you instead (or can't sign in), email TimelyChurch support with the person's name, their record, and the reason, and support will create the request on your behalf.
Cancelling a request: The member's page tells them to contact their church admin to cancel. There is no cancel button for admins in the admin panel -- contact TimelyChurch support with the person's name and the request, and support will cancel it during the grace period.
Anonymization (What Happens After the Grace Period)
When the grace period ends, the person's record is anonymized rather than hard-deleted. This preserves:
- Class enrollments, attendance, schedule history (so reports stay accurate)
- Donation totals (for church accounting)
The following personal information is removed or replaced:
- Name → "Deleted User"
- Email, phone numbers and address → removed
- Photo and custom field values → removed
- Family link → removed
- Group memberships, prayer requests and messages → anonymized
Status Reference
| Status | Meaning |
|---|---|
| Pending | Request received and confirmed, awaiting approval |
| Approved | The 30-day grace period is counting down |
| Rejected | Denied (e.g., legal hold, active investigation) — no data is changed |
| Completed | Grace period ended and the record has been anonymized |
| Cancelled | Request was withdrawn during the grace period |
Each change of status records who made the change and when.
Child Check-In History Requests
Separately from full account deletion, a guardian can ask for a child's check-in history to be deleted from their Privacy & My Data page (Request check-in history deletion). The child's person profile is kept.
When that happens, the child's profile in the admin panel shows Guardian requested check-in history deletion -- "Respond within 45 days. Purging history keeps the person record." -- in the Check-Ins section:
- Open the child's profile (People, then click the child).
- In Check-Ins, click Fulfill deletion request and confirm.
You can also clear a person's check-in history at any time with Purge check-in history in the same section. Both keep the person record and cannot be undone.
Best Practices for Admins
- Verify the request is genuine. Before forwarding to support, confirm by phone or in person that the member really wants their data deleted. Email requests can be spoofed.
- Document the reason. Note why the member is requesting deletion. TimelyChurch stores this with the request.
- Inform the member of the 30-day grace period. They can withdraw the request during that window.
- Don't delete people manually. Use the data deletion request workflow instead so the record of the request and the grace period are honored.
- For team members (staff), revoke access first. Use the Team Management page to remove their team access before submitting the deletion request.
- Staff can delete their own sign-in account. Staff and administrators can delete their own account from My Profile > Delete my account (email confirmation, then a 30-day grace period). The only administrator of a church has to make someone else an administrator first. See Your Account -- Deleting Your Own Account.