> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.omegatheme.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Data Subject Access Request (DSAR) Consentik Wix

# **Let visitors exercise their privacy rights from your site**

### Overview
Under **GDPR Articles 12–15** and similar laws such as the **CCPA**, anyone whose personal data you hold can ask you to give them a copy of it, delete it, correct it, restrict how it is used, or export it — and you must respond within **30 days**. Wix has no built-in way to collect and track these requests, so most stores receive them as ordinary emails: identities are never verified, deadlines slip, and there is no record to show a regulator.
The **Data Requests** feature by Consentik gives you a proper intake channel. It adds a link to your site that opens a popup where a visitor chooses what they want and submits the request. Every request gets its own **Request ID**, the requester must confirm by email before anything reaches you, and each confirmed request lands in your dashboard with a visible 30-day deadline, a step-by-step processing checklist, and a ready-made response email.
One important boundary: **Consentik transmits and tracks requests — it never accesses, stores, or processes the content of your customer data.** Finding, deleting, or exporting the data itself stays your responsibility; Consentik handles the workflow, the communication, and the audit trail around it.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/imgv30215vefd69d36-06a4-4a1c-b_f0hpud.jpg)

### How it works
Once the feature is enabled and the request link is showing on your site, a visitor goes through these steps:
* The visitor clicks your **"Submit a data subject request"** link — shown on the cookie banner, in the preferences popup, or both. The popup opens over the page; no login is required.
* They pick one of **five request types**: Access, Delete, Correct, Restrict, or Export.
* They fill in **Your name** and **Your email address** (both required), an optional **Additional details** field, and tick the confirmation checkbox — *"I confirm that the above information is correct."*
* After submitting, they see a success screen with their **Request ID** (for example `CST.ACC.A1F4B9.2510091345`) and a note that a verification email is on its way.
* The visitor receives a **verification email**. The confirm link inside is valid for **1 hour**.
* When they click it, a standalone **confirmation page** opens, the request becomes **Verified**, and the 30-day clock starts.
* Only then does **your notification email** arrive, with the request details and a button into your Consentik admin.
The popup works on desktop and mobile. It uses the colors you set in DSAR Setup and picks up your site's font.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_om423h.png)

### The five request types
| Type | What the visitor is asking for |
| ---- | ---- |
| **Access my data** | A copy of all personal data you have collected about them |
| **Delete My Data** | Permanent deletion of their personal data |
| **Correct My Data** | Correction of inaccurate data |
| **Restrict Processing** | A limit on how their data is used |
| **Export My Data** | A portable, machine-readable copy of their data (data portability) |
The title and description of every type can be rewritten in **DSAR Setup → Appearance & Content**, so you can match your own wording.

### Where to manage it
In your Consentik admin, open the **Data Requests** page. It has two tabs:
* **Request Management** — the default tab and your day-to-day workspace: every request, its status, and the tools to process it.
* **DSAR Setup** — everything you configure once, split into **Appearance & Content**, **Confirmation page**, and **Email templates**.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_nioe2f.png)

### Turning on the feature
Open **DSAR Setup → Appearance & Content → General settings**:
* **Enable the Data Subject Access Request popup** — the master switch. While it is off, the request link does not appear anywhere on your site and Request Management shows a warning that visitors can't submit new requests.
* **Popup position on page** — Center (default), Bottom-left, Bottom-right, Top-left, or Top-right. This only controls where the popup window appears once opened; the DSAR popup has no floating button of its own.
* **Trigger text** — the wording of the link that opens the popup. Default: **Submit a data subject request**.
* **Trigger link placement** — two independent checkboxes: show the link **on the cookie banner** (in the policy-links row) and/or **on the preferences popup** (above the action buttons). Both are on by default. If you untick both, the feature stays enabled but no visitor can reach the form — the app warns you when that happens.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_8jfk9d.png)

### Customizing the popup
The rest of the **Appearance & Content** tab controls how the popup looks and reads, with a live preview beside the settings that updates as you type. You can switch the preview between the **Request type**, **Form**, and **Submitted** screens.
* **Appearance settings** — background color, text color, and highlight color. The highlight color drives the request-type icons, the selected title, and the submit button.
* **Request types** — the title and one-line description of each of the five cards.
* **Form labels & messages** — every label and placeholder on the form, the confirmation checkbox text, and the submit button text.
* **Submitted screen** — the title and message shown right after submission. Keep the Request ID placeholder in the message: it is replaced by the visitor's real Request ID.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_wyt5pb.png)

### The confirmation page
The link in the verification email opens a **standalone page on your domain**, not an overlay on your store. It handles four situations on its own, and the **Confirmation page** tab lets you write the title and message for each one:
* **Confirmed** — the happy path: a success message, the 30-day notice, the Request ID, and an optional request summary you can toggle on or off. Keep the Request ID placeholder in the message.
* **Expired link** — the link was older than 1 hour. Nothing was confirmed, and the visitor is offered a fresh submission.
* **Already confirmed** — the visitor clicked the link twice. The page reassures them it was verified earlier; you are not notified a second time.
* **Invalid link** — no request matched the link, and no action was taken.
Two more cards apply to all four states: **Shared page settings** (store name, button labels, where the back button goes) and **Page colors**.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1nunsvx.png)

### Email templates
Three emails make up the DSAR flow. The first two are sent automatically; the third you send yourself. All three are edited in **DSAR Setup → Email templates**.
* **1 · Verification Email** *(to the customer)* — sent the moment the form is submitted. It contains the request summary, the confirm button, the 1-hour expiry notice, and the Request ID.
* **2 · New Request Notification** *(to you)* — sent **only after the visitor verifies**, so unverified or spam submissions never reach your inbox. It carries the Request ID, type, requester email, verification time, and additional details, plus a reminder of the 30-day deadline and a button that opens the request in Request Management. Set the recipient address in this card.
* **3 · Final Response Email** *(to the customer)* — not automatic. You send it from the **Send Final Response Email** button in the request drawer once the work is done. The summary of what you did is filled in from the request type, and any file you attach in that popup rides along.
Each editor lists the details you can drop into the subject and body — the requester's name, the Request ID, the request type, and so on — with one-click copy, and every template has a rendered preview. The Verification and Notification templates also have a **Send test email** button.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1qmp6ih.png)

### Managing requests
**Request Management** is where you track and resolve everything. Requests appear here **only once the requester has confirmed their email** — unverified submissions never reach this list. Search by email or Request ID, filter by request type or status, and sort by newest or oldest; new requests appear without a manual refresh.
Each request moves through these statuses:
* **Verified** — confirmed by email and waiting for you. The 30-day clock starts here.
* **In Progress** — you have started working on it.
* **Completed** — the request has been fully handled.
* **Rejected** — refused, for example when identity can't be established or the request duplicates an earlier one. You can attach an internal note explaining why.
* **Expired** — not completed within 30 days of verification. Set automatically by the system and the only status you cannot change by hand.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_4frd28.png)

Opening a request slides out a drawer with everything for it:
* **Overview and submitter** — copyable Request ID and email, type, status, timestamps, and a **"Respond by {date}"** callout for open requests.
* **Processing checklist** — a tickable, type-specific list of the actual work (locate the data, check retention obligations, clean third-party tools, prepare the export file, and so on), with an *X of Y done* progress bar.
* **Internal notes** — only visible to you, never sent to the requester.
* **Send Final Response Email** — opens a popup with the attachments and a preview of the message built from your template and this request's own data. For **Access** and **Export** requests the prepared data file (JSON, CSV, or PDF) is mandatory: sending is blocked until one is attached. For the other types attachments are optional.
* **Activity** — submission, verification, notification, every status change, and the response you sent.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_ndrqem.png)

### Important notes
* **Plan availability.** Data Requests is available on the **Advanced** plan.
* **Requests reach you only after verification.** The email confirmation step is what keeps spam and impersonation out of your queue, so a visitor who never clicks the link never becomes a task for you.
* **Confirm links last exactly 1 hour.** If a visitor waits too long, they simply submit again — the expired page tells them how.
* **The Request ID contains no readable personal data.** It is built from the request type, a one-way hash fragment of the email, and the creation time, and the same ID is used in the popup, all emails, the confirmation page, and your dashboard.
* **The 30-day deadline runs from verification, not from submission**, and requests that pass it are marked Expired automatically. Expired requests stay visible for your records.
* **Fulfilling the request is your job, not Consentik's.** The app never touches your customer data — it gives you the workflow, the checklist, and the audit trail.
* **Languages.** The popup, the emails, and the confirmation page are shown in the single language set in your configuration.
* **Not legal advice.** Response deadlines and obligations vary by country and by law. Confirm your setup with your own legal counsel.