# Privacy requests from founders and others

> Log and answer requests for a copy, a correction or deletion of personal data your fund holds, within 30 days, in Settings, Privacy requests.

Source: https://delsivo.com/help/privacy-and-security/data-requests · Updated 2026-11-06

## Key takeaways

- Your fund is the controller of founder data in Delsivo, so your fund answers privacy requests. Delsivo helps.
- Log each request in Settings, Privacy requests. It's due 30 days after you received it.
- Close a request as Done or Rejected with a note. The note is your record of what was done.
- Overdue requests are marked in red, and the Settings menu shows how many are open or overdue.
- Only Admins log and close requests. Everyone on the team can see the list.

People whose data your fund holds in Delsivo can ask you for a copy of it, a correction, or its deletion. That includes founders, their teammates and, later, data room guests. Under data protection law (GDPR, the UK GDPR, India's DPDP Act and California's CCPA), your fund is the **controller** of that data and Delsivo is your **processor**. So the request is yours to answer, and Delsivo helps you carry it out.

Delsivo gives you one register to keep track: what was asked, by whom, when it's due and how you answered.

## Open the register

Click **Settings** in the sidebar, then **Privacy requests** under **Data**. When requests are open, the menu item shows how many, for example **2 open**, or **1 overdue** in red.

The list has three views: **Open** (the default, oldest due date first), **Closed** and **All**. If anything is overdue, the Open tab says so, for example **Open, 1 overdue**.

| Column | What it shows |
|---|---|
| **Request** | **Copy of data**, **Correction** or **Deletion** |
| **Status** | **Open**, **In progress**, **Done**, **Rejected** or **Overdue** |
| **About** | The person or company the request concerns |
| **From** | Where it came from: **Your team**, **Email**, **Delsivo staff** or, later, **Fund portal** |
| **Received** | The date it arrived |
| **Due** | The due date and days left, or **Was due [date]** in red when it's late |
| **Note** | In Closed and All: what you recorded when you closed it |

## Log a request

When someone asks your team directly, by email, on a call or in a meeting:

1. Click **Log a request**.
2. In **Log a data request**, choose the **Request**: **Copy of data**, **Correction** or **Deletion**.
3. Fill in **Who it is about** (a name or company) and **Their email**.
4. Optionally add a **Note**, for example how and when they asked.
5. Click **Log request**. You see **Request logged. It's due in 30 days.**

If the same person already has an open request of that kind, Delsivo doesn't create a second one and tells you so.

The requester's email is kept with the request so you can reply. It never appears in the activity log or in any other log.

## Answer and close a request

1. Do what was asked. For a copy, send the person their data. For a correction, fix the details. For a deletion, write to hello@delsivo.com and Delsivo removes the data with you (see below).
2. In the request's row, click the close button.
3. In **Close this request**, choose the **Outcome**: **Done** or **Rejected**.
4. Write a **Note** of what you did, for example "copy of their records sent by email on 12 Nov", or why you rejected it.
5. Click **Save**. You see **Request marked done.** or **Request rejected.**

The note stays with the request in the **Closed** view as your record. Opening and closing requests are also written to the [activity log](/help/team-and-settings/exports-and-activity-log), without the requester's details.

## The 30-day deadline

Each request is due **30 days** after you received it. That meets the GDPR and UK GDPR "one month", and sits inside the longer windows of the CCPA and India's DPDP Rules. If a request is complex, the law can allow more time, but you need to tell the person within the first month. Close requests early when you can.

Late requests show **Overdue** and a red mark at the start of the row.

## What Delsivo does for you

- **Deletion:** Delsivo staff remove the person's data on your instruction and keep only what the law requires as proof (for example that consent was given), with names and contact details removed. Self-service export and erase buttons in this register are planned.
- **Requests sent to Delsivo:** if someone writes to Delsivo about data your fund holds, we log it in your register with **From: Delsivo staff** and point them to you.
- **From your portal:** once portals and founder workspaces arrive, founders will be able to send requests from there and they will land in this register as **Fund portal**.

## Frequently asked questions

### Who can see and act on privacy requests?
Everyone on the team can see the register. Only Admins can log and close requests. Delsivo support, viewing your fund with your permission, can see the list but can't change it.

### Can we refuse a request?
Sometimes, for example when you must keep records for legal reasons or can't confirm who is asking. Choose **Rejected** and write the reason in the note. Take legal advice if you're unsure: this article isn't legal advice.

### A founder asked Delsivo directly. Why are we handling it?
Because your fund decided to collect and use their data, so your fund is the controller. Delsivo acts on your instructions as processor.