Data subject rights procedure (GDPR Arts. 12–22)

Status: Template — to be reviewed by the controller's DPO / counsel. Draft of 2026-10-13; not reviewed yet.

This procedure is for the controller (the customer) and, in the hosted edition, for Quavon UG (haftungsbeschränkt) as processor assisting the controller (Art. 28(3)(e), DPA clause 7).

1. Intake

1. Requests reach the controller through its usual privacy channel. In the hosted edition, a request that reaches Quavon UG (haftungsbeschränkt) directly is forwarded to the controller without delay and is not answered by the processor.
2. Record the date of receipt. The answer is due without undue delay and within one month; it can be extended by two further months for complex or numerous requests, with notice to the person within the first month (Art. 12(3)).
3. Verify the person's identity (Art. 12(6)). For CodeLotse, identify the person by Git host or identity provider, host or issuer URL and external id (the stable account id). A login alone is enough for an export but not for a deletion, because logins can change and be reused.

2. Find the person's data

The person-linked tables are listed in the data inventory and, in code, in the personal-data registry (packages/db/src/personal-data.ts). The command below covers all of them; options, output and the retained audit entries are described in dsar.md.

3. Right of access and portability (Arts. 15, 20)

quavon dsar export --provider github --base-url https://github.com --external-id <id> [--tenant <tenant id>] [--dry-run]

• Without --tenant, all tenants of the instance are searched. The export is JSON; when written with --out the file is created with mode 0600.
• Send the export through a secure channel. Add the Art. 15(1) information: purposes, categories, recipients (including the model provider routes), retention, rights, source of the data (the Git host) and whether automated decision-making takes place (assignment in apply mode).

4. Right to erasure (Art. 17)

quavon dsar delete --provider github --base-url https://github.com --external-id <id> [--tenant <tenant id>] [--dry-run]

• Run with --dry-run first and review the report.
• Deletion runs in one transaction per tenant plus one for system tables and can be repeated safely.
• Retained: audit log entries are kept, because they serve the controller's legal obligations and the establishment and defence of legal claims (Art. 17(3)(b) and (e)). The report lists them as retained with the reason. Their pseudonymisation is an open decision for counsel.
• The command writes an audit entry with a hash of the subject, not the subject in clear.
• Content that exists at the Git host (comments, pull requests) is not deleted by CodeLotse; the person is referred to the Git host and the repository owner.

5. Other rights

Right	How
Rectification (Art. 16)	Identity data comes from the Git host or identity provider and is refreshed at sign-in; correct it there. Other records are derived and not editable
Restriction (Art. 18)	Disable the feature for the repository, or set the person's assignment opt-out while the request is assessed
Objection (Art. 21)	Assignment: the individual opt-out in the user settings (no reason needed). Analytics: people are only in aggregates of at least k people; the self view is opt-in
Automated decisions (Art. 22)	Assignment in apply mode allocates work automatically; the person can ask for human review, and every assignment can be changed by a human. See the assignment DPIA

6. Records

Keep a record of each request: date received, identity check, action, date answered, extension and reasons. Keep the DSAR report, not the exported data.

Open points for the DPO / counsel

1. Audit-log pseudonymisation on erasure requests.
2. Identity verification standard for people who never signed in (they appear only as authors in events).