I am creating a company that offers a certain service to private individuals and professionals. I know that if someone wants to delete his/her account, we have the obligation to grant the user this request. My question is: which information must be deleted? Which one can be kept? Which one must be kept?
Let's say that our service allows someone to make an order. The order is then charged to the user. Wouldn't we (at the company) be obligated to know which person made which orders, and which person paid for the orders? I think that these information must be kept even if the user wants to delete his/her account.
My question is: how do I know which information am I obligated to delete if the user does such a request? The company is based in France.