Data Deletion

Timely deletion of applicant data is a GDPR obligation (Art. 17, Art. 5(1)(e)). Locari carries out deletions either automatically after configured retention periods or immediately after withdrawal/decline — always with a complete deletion sequence and audit trail.

Common Tasks

• Configure retention periods
• Manually delete an individual applicant
• Handle an applicant's deletion request
• What is actually removed in a deletion
• View the deletion log
• Understand statutory retention obligations

How To

Configure retention periods

1. Go to Settings > Data Protection > Deletion Periods.
2. Set the desired period after process end for each data type.
3. Activate automatic deletion.
4. Example: contact data and communication 6 months, documents 30 days, notes 6 months.

Handle a deletion request

1. Applicant requests deletion (withdrawal link or in writing).
2. Locari automatically checks: active process? Retention obligation?
3. During active process: Locari informs the applicant, request is noted.
4. After process end: click Applicant profile > Data Protection > Approve deletion.
5. Deletion sequence runs automatically — confirmation email to applicant, then complete data deletion.

Automatic Deletion

Default Periods After Process End

Automatic Deletion on Consent Expiry

If an applicant does not respond within 10 days of the consent email, the consent is marked as expired and the deletion sequence starts immediately — without any further action on your part.

Manual Deletion

Delete an Individual Applicant

1. Open the applicant profile.
2. Open the dropdown menu > click Delete applicant.
3. Confirm.

Delete Multiple Applicants

1. Go to the Applicant List.
2. Select multiple applicants.
3. Click Delete and confirm.

Deletion on Request

When an Applicant Requests Deletion

Locari automatically checks before deletion:

• Is the applicant clearly identified?
• Is an active process still running?
• Are there statutory retention obligations?

During an active process, Locari informs the applicant:

"Your deletion request has been noted. As your application process is still active, your data will be deleted after its completion. You can withdraw your application at any time."

What Gets Deleted?

Complete Deletion Sequence (5 Steps)

Locari carries out deletion in a defined order:

1. Confirmation email to the applicant (for withdrawal/decline/expiry — not for administrator-initiated manual deletion)
2. Collect storage paths (document file paths and email attachments)
3. Delete database records in an atomic transaction:
   • Applicant profile and contact data
   • All uploaded documents
   • Communication history (emails and attachments)
   • Notes and evaluations
   • Clarification requests and appointment bookings
   • AI conversation logs
4. Remove files from storage (asynchronously via a secure deletion queue)
5. Anonymize consent record — email is replaced by an anonymized identifier; timestamps and status are retained for authority requests

What Remains Anonymized

After complete deletion, the following remain:

• Anonymized consent record (no personal data, timestamps retained — Art. 7(1) GDPR)
• Aggregate statistics without personal reference (number of applications, processing times)

Deletion Log

Documentation

Every deletion is documented:

• Time of deletion
• Reason (automatic after period, withdrawal, decline, expiry, manual)
• Executing user (for manual deletion)
• Affected data types and count

View Log

Under Settings > Data Protection > Deletion Log:

• All deletions performed chronologically
• Filter by period and deletion reason
• Export as CSV

Retention Obligations

Some data is subject to statutory retention obligations and cannot be deleted prematurely:

• Tax-relevant documents: 10 years
• Contract documents: 6 years after contract end

Locari marks such records automatically. After the statutory period expires, automatic deletion is carried out.

Permissions and Multi-select

• View deletion log: all team members.
• Configure retention periods: only administrators.
• Approve deletion requests and delete manually: only administrators — the action is irreversible.
• Multiple applicants at once: Applicant List — bulk reject, filter by phase and status, sort by score.

Related Pages

• Data Protection — Overview
• GDPR Compliance
• Manage Consent
• Applicant Details
• Settings — Team and Roles