Data Export and Erasure at Offboarding
When your contract with LIKE MAGIC ends, you can receive a complete copy of your data and have it erased from the platform. This article covers what you receive, how it reaches you, what you prepare, and when the erasure is complete.
Your entitlement is set out in the Terms of Service, section 5.6, and the Data Processing Agreement, section 4.5. This article describes how LIKE MAGIC carries it out.
1. Who Can Request Offboarding
Offboarding is not self-service. LIKE MAGIC runs it for you, and it starts with two things from your side:
- Your termination notice, given as set out in the Terms of Service, section 5.2.
- Your election on the data: returned, erased, or both. The Terms of Service (section 5.6) require this election before the termination takes effect, so state it in the termination notice itself.
Three parties are involved:
| Party | Who | Responsibility |
|---|---|---|
| Authoriser | Your contract owner, in writing | Instructs the termination and states whether your data is returned, erased, or both. Must be on file before any work starts |
| Operator | LIKE MAGIC Data Protection Officer | Runs the procedure, confirms every deletion, holds the evidence record |
| Recipient | A named contact at your organisation | Receives the download link and, separately, the password. Named before the export is produced |
⚠️ Erasure cannot be undone. Once the deletion has run, your export archive is the only remaining copy of your data. Download and check it before you confirm the erasure.
2. What You Receive
Your export is a single archive holding your operational data and your stored files.
| Included | Deliberately excluded |
|---|---|
| Your operational data as CSV files, one file per data set | The platform configuration of your Account. It contains integration internals and the structure of stored credentials |
| Every stored file: guest identification documents, signatures, invoices | Credential material of any kind, including password hashes |
| The Staff User Accounts of your own team | Any other customer's data |
| A manifest listing every file with its size and checksum | None beyond the above |
ℹ️ The scope is not a hand-written list. It is derived from the live platform on every run, so a data set added by a recent platform update is included automatically.
3. How the Export Is Delivered
The archive is password-protected and stored privately. You receive two things through two separate channels:
- A download link, valid for at most 12 hours.
- The password, sent through a different channel from the link, never in the same message.
If the link expires before you download the archive, nothing is lost. A new link can be issued at any time while the archive still exists. Request it via a Support Ticket.
⚠️ Download within 30 days. The archive is deleted automatically 30 days after the run. After that the export cannot be reproduced, because the source data is gone.
4. The Order of Events
The sequence is fixed. Each step sits where it does for a reason.
a) Connected systems are disconnected first
Your PMS, messaging and content management connections write into the platform continuously. They are disconnected before anything else, because a connection still live during the deletion writes your data straight back in.
Where a connected account is shared with another customer, only your own subscription is disconnected. The shared account stays untouched.
b) The export is produced and verified
The archive is created, then its contents are counted against what was found in the platform. If those numbers disagree, the run stops and nothing has been deleted.
c) Stored files are deleted, then the records
Files go first, records second. The records are the only index of what the file storage holds. Deleting them first would leave files that can no longer be attributed to anyone: not to you, not to a guest request, not to an auditor.
d) The evidence record is written as the work happens
Every step is recorded at the moment it runs, naming what was affected and the verified outcome. The run cannot be marked complete without it.
5. Timelines
| What | How long |
|---|---|
| Download link validity | At most 12 hours, re-issuable while the archive exists |
| Export archive availability | 30 days after the run, then deleted automatically |
| Erasure in the live platform | Immediate |
| Erasure in backups | Roughly 8 days after the run |
| Evidence record retention | 7 years |
Why backups take longer. Erasure is immediate in the live platform, but backups cannot be edited selectively. Your deleted data stays in the automated backups until those roll over, roughly 8 days after the run. This follows from the backup mechanism, and it is stated in the confirmation you receive.
Why the evidence record is kept. It proves what was deleted, when, and that the result was verified. XXX [owner to confirm: does the evidence record hold any personal data, and is it the "one copy for archival and compliance purposes" that section 4.5 of the Data Processing Agreement reserves?]
6. What to Prepare
Work through this before the run starts.
- Make your election before the termination takes effect. Returned, erased, or both, in writing, as part of the termination notice.
- Name the recipient who will receive the export, and agree which channel carries the password.
- Download whatever you still need while you still have platform access: reports, documents, message history.
- Check the export before confirming the erasure. Open the archive, compare it against the manifest, confirm it is readable in your own systems.
💡 Store the archive somewhere durable. It is your only copy after the run, and it disappears from our side after 30 days.
7. Frequently Asked Questions
Can we export our data without terminating? XXX [owner to confirm: is a standalone export, nothing deleted and connections untouched, offered to customers, and on what terms?]
Can we offboard a single Property and keep the rest of the Account? Not as part of this process. Offboarding always covers your entire Account. The Terms of Service (section 5.3) allow a termination limited to one Hotel when it is sold, closed or re-branded. State that in your termination notice and it is handled individually.
We lost the password. Can it be resent? No. The password is shown once during the run and is not stored afterwards, so it cannot be looked up. XXX [owner to confirm what happens in this case: can the archive be re-issued with a new password while it still exists?]
Can we get our data back after the erasure? No. Once the deletion has run, the archive is the only copy, and after 30 days that is gone too. This is the point of the process.
Can we receive proof of the erasure for our own audit? You receive a written confirmation of the erasure, including the backup window described in section 5. XXX [owner to confirm: can the evidence record itself, or an extract of it, be shared with the customer on request?]
What if something fails during the run? Stopping is a designed outcome, not a failure. Each step is recorded only once it has finished, so the run resumes at the step that did not complete. No step deletes anything before the export has been verified as complete.
8. Compliance
The process is built to be provable months later by someone who was not present. It evidences the following:
| Requirement | How it is met |
|---|---|
| ISO 27001 A.8.10 Information deletion | Scope derived from the live platform, deletion verified by re-counting, result recorded |
| ISO 27001 A.5.33 Protection of records | Evidence stored separately under a fixed retention policy |
| ISO 27001 A.5.34 Privacy and protection of PII | Your archive excludes internal configuration; the export is retained 30 days, not indefinitely |
| ISO 27001 A.5.14 Information transfer | Private storage, time-limited download link, password sent out of band |
| ISO 27001 A.5.20 and A.5.22 Supplier relationships | Connected systems disconnected first, shared accounts identified before anything is removed |
| GDPR Art. 28(3)(g) Processor obligations on termination | Return and erase in one controlled sequence, in that order |
| GDPR Art. 17 Erasure and Art. 5(1)(e) Storage limitation | All operational data and stored files, with the backup window stated above |
| GDPR Art. 5(2) Accountability | Per-step evidence naming the operator and the verified outcome |
9. Conclusion
Offboarding returns your data and removes it from the platform in one controlled sequence: connections down, export verified, files and records deleted, evidence recorded. Your part is to name a recipient, check the archive, and store it somewhere durable. The 30-day window is the only one that cannot be reopened.
To start an offboarding, state your election in your termination notice before the termination takes effect.
Related articles
- Data Processing Agreement, the contractual basis for return and erasure
- Terms of Service, termination of the agreement
- Role and Access Management, managing Staff User Accounts while your Account is still active