> For the complete documentation index, see [llms.txt](https://docs.peakcommerce.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peakcommerce.com/guides/administration-guides/peakcommerce-gdpr-readiness.md).

# GDPR and PeakCommerce

This page explains how PeakCommerce features can support your data protection program under the EU General Data Protection Regulation (GDPR). PeakCommerce adheres to the GDPR requirements applicable to its services.

This page is not legal advice. PeakCommerce features alone do not make your business compliant with the GDPR or any other law. Work with your legal counsel to determine your obligations.

## Your responsibilities and how PeakCommerce supports them

When you use PeakCommerce to sell to your customers, your business decides why and how your customers' personal data is used. PeakCommerce processes that data on your behalf to run your journeys, portals and billing connections.

Your obligations stay with you, including:

* choosing a lawful basis for each use of personal data
* telling your customers how you use their data, in your own privacy policy
* responding to your customers' requests to access, correct or erase their data
* setting how long you keep data, here and in the other systems you connect

PeakCommerce provides controls and APIs that can support this work. The sections below explain what each one does and where responsibility remains with you.

## Collecting consent in a journey

Each journey has its own consent settings, under **Journey settings → Consent**:

| Setting                                             | What it does                                                                                       |
| --------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| **Consent required**                                | **Automatic** (required wherever a step shows consent), **Always required**, or **Not required**   |
| **Consent label**                                   | The wording the customer accepts, for example "I agree to the Terms of Service and Privacy Policy" |
| **Terms of Service URL** and **Privacy Policy URL** | Links to your own policies, shown with the label                                                   |
| **Terms version**                                   | The version of your terms the customer accepted, for example a date                                |

To show consent on a step, add the **Consent Gate** block to it.

When consent is required on a step that takes a payment, the customer cannot continue until they accept. PeakCommerce then records the acceptance with:

* the wording shown, and your terms and privacy links
* the terms version
* the time
* the customer's IP address and browser details

Whether consent is the right lawful basis for a given use of data is a decision for your business and your legal counsel.

## Responding to access and portability requests

To respond to a request to access or transfer a customer's data, use the [Agent API](https://gitlab.com/peakcommerce/peak-help-docs/-/tree/main/developers/api-reference/README.md) to retrieve the relevant records:

* find the customer's contact by email address
* retrieve their account
* list the account's subscriptions, invoices and payment methods

Combine these into a format you can give the customer. Records held in your connected billing system, such as invoices and payments, are also available in that system.

## Removing people from your team

**Settings → Users** lists the people on your team who can sign in to PeakCommerce. Deleting a user there removes their access to your PeakCommerce account. This applies to your team, not to your customers.

## Handling erasure requests for customer data

You can delete a contact in PeakCommerce. This removes the contact record, but related records—such as orders, subscriptions, conversations, quotes, and consent records—remain. If an erasure request includes those records, submit it to PeakCommerce for review. This does not promise that every record can be deleted or specify a completion time.

Records in your connected billing system, such as invoices retained for tax or accounting purposes, follow that system's retention and deletion rules. Handle those records in the connected system according to your retention policy and legal obligations.

## Regulator guidance

The [European Data Protection Board](https://www.edpb.europa.eu) (EDPB) publishes guidance on how the GDPR is interpreted and applied across the EU. These guidelines are most relevant to the features described on this page:

* [Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en)
* [Guidelines 01/2022 on data subject rights - Right of access](https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en)
* [Guidelines 07/2020 on the concepts of controller and processor in the GDPR](https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en)

If you sell to customers in the United Kingdom, the UK GDPR applies. The UK data protection regulator publishes its guidance at [ico.org.uk](https://ico.org.uk).

## Questions

For questions about how PeakCommerce handles your data, contact your PeakCommerce representative.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.peakcommerce.com/guides/administration-guides/peakcommerce-gdpr-readiness.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.