Team roles and assigning cases
Control who can see and do what, and who works on each request.
Account roles
| Account role | Can |
|---|---|
| Super admin | Platform staff: every organisation and module |
| Admin | Create admins and members of their own organisation (Settings, Team), every module, and settings |
| Member | What their team role allows |
Team roles
Settings, then Team, then Roles. Every organisation has two built-in roles: Full access and Read only. Admins add their own, choosing No access, Read or Read and write for each of the 11 modules: Consent Management, Cookie Governance, Policy Library, Record of Processing, Retention & Deletion, Data Principal Rights, Grievance Redressal, DPIA, Breach Management, Vendor & DPA, and Parental Consent.
- Each member has one role, set in the team list or when invited. A member without one has Full access.
- Access is enforced on every call, not only in the screens. Reading needs Read. Anything else needs Read and write. Members can read Settings, and only admins change it.
- Modules a member cannot open are hidden and show "No access" by address. Read-only modules show a notice.
- A role in use cannot be deleted.
Assigning rights requests and grievances
An admin assigns a rights request or grievance to someone who can work on it: an admin, or a member whose role has Read and write on that module. Or takes it off them.
- Members see, open and act on only the cases assigned to them. Others read as not found. Admins see all.
- The list has an "Assigned to" column and, for admins, an Anyone, Assigned to me, or Not assigned filter.
- The assignee is emailed a link with no requester details. The case timeline shows who it was assigned to.
Conversations
- Team side. On a case, write an internal note only your team sees, or a reply to the requester, emailed to them with a link to their thread. Members write only on their own cases.
- Requester side. In My requests on your Trust Center, after an emailed code, people see their own requests and grievances, read your replies and answer, for 30 minutes. They never see internal notes or who on your team wrote.
Audit log
Settings, then Security log, filters by event: roles created, changed or deleted, a member's role changed, cases assigned, lists and cases viewed, the consent ledger viewed or exported, and parental consents viewed. Views are recorded only for signed-in users, and the same view by the same person within 10 minutes is one entry.