Statements contain the names and IBANs of payers. That is personal data and you are the controller. The module keeps it only as long as you set.
What the module stores
- Only credits. Debits are discarded after reading.
- The payer’s IBAN is encrypted; it is searched through a keyed hash. You can choose not to store it at all (Do not store payer IBAN).
- The module’s log (
var/log/magelan_bankrec.logand the history of a payment) contains no names.
Retention
Stores › Configuration › Magelan › Bank reconciliation › Privacy
Delete source files after (days): default 14, 0 means right after a successful import. Anonymise payers after (months): default 24; name, IBAN and remittance are removed, the amount, date and order link stay. The module is not an archive: keep the original statements in your bookkeeping as required by law (generally 10 years in Slovenia); invoices stay in Magento. 24 months covers the right of withdrawal, the two-year guarantee and refunds to the same IBAN; confirm the period with your accountant.
Permissions
System › Permissions › User Roles › Sales › Operations › Bank reconciliation
| Permission | What it allows |
|---|---|
| View transactions and imports | Read only; the payer is hidden (“M**** N****”) |
| Upload and import statements | Upload, preview, import, re-match |
| Confirm, link and invoice | Confirm, link to an order, ignore, unrelated, issue invoices |
| View payer data (name, IBAN) | Shows name, IBAN and remittance; every look at an IBAN is logged |
| Delete personal data | Manual removal of the payer data of selected payments |