Several improvements have been brought to SecuTix during Whymper V2 regarding the new General Data Protection Regulation. These improvements aim at:

• Improving the flexibility of the bulk contact anonymisation batch
• Improving the information provided to the operator and internet user with regard to the data privacy policy

Although some of these improvements have already been delivered as patches in the last months, we take the opportunity of the Whymper V2 release notes to provide you a global overview of all the new features provided since the last major delivery.

Improved batch facility for anonymisation/deletion of inactive contacts

Calculating the period of inactivity for a contact

The batch process calculates the period of inactivity by checking the date of the last transaction by a contact. This data is held in a special indicator (calculated directly by the batch process) called the GDPR recency. This recency covers:

• Option acquisition
• Option confirmation
• Reservations and sales made, either as a purchase contact or a cultural contact. Completing payment does not, therefore, modify the contact recency.
• Being added to the waiting list
• (as of Whymper 1.7) explicit click on a SAM link
• (as of Whymper 1.7) modification of contact criterion
• (as of Whymper 1.7) modification of contact authorizations IF at least one authorization is still "yes, I authorize"
• If the contact has not carried out any of the above actions, the contact creation date is used.
• All those information are taken into account at the institution level (through all its organizations). Therefore, a contact will not be anonymized if there was an activity with another organization as the one running the batch.

The indicator then refers to the validity date of dated products and the order date of undated products.

Comment:

• In order to maintain performance levels, the indicator is only recalculated if a contact is eligible for deletion or anonymisation, given the current value of the indicator and the chosen period of inactivity. It does not necessarily provide the complete contact recency.
• For example: A contact has purchased a ticket for a performance taking place on 15 June 2018. The initial batch process runs and sets the indicator to 15 June. A few weeks later, the contact purchases a ticket for a performance on 1 September 2018. Suppose the batch was executed on 1 August after the purchase of the second ticket. The second batch process will not update the contact recency as it is too recent to be anonymised.
• The batch anonymisation process only deals with individual contacts and relays and not the structures themselves nor contacts with another role (eg, supplier, guide, exhibitor, producer, partner, contractor)

Removing a prospect / anonymising a contact

When a contact is anonymised (either through the batch or manually by the operator), the country, town and post code of the address are kept. By this way, the reports on the geographical origin of the customers can still provide accurate information. The other address information are still deleted so that the identity of the anonymised contact cannot be recovered. When a prospect is removed, all address information are deleted.

If the ticket end validity is older than current date minus duration (duration specified in batch parameters)

• Remove all beneficiary information except country
• Remove order ip_address
• Remove all answers to questions of type Address or Email (if a questionnaire is linked to the movement).

Important reminder

You can select the minimum period of inactivity. The batch process has a default setting of 36 months, which corresponds to the normally recommended 3-year period in France. The batch process also offers a simulation mode, which displays the list of contacts about to be anonymised/deleted. Since this batch process will have a considerable and irreversible impact on your contact database, we strongly recommend you run in simulation mode first in order to identify all affected contacts. No contact who is a debtor or creditor to your institution may be anonymised. These contacts will be included in the run-time log. They will be anonymised when the batch process runs and their transaction has been settled.

How to use this new batch process

• If it does not yet exist, create a batch type "Deletion/anonymisation of inactive contacts"
• Schedule the following program "Deletion/anonymisation of inactive contacts". By default, the period of inactivity is initially set to 36 months and simulation mode is chosen.