GDPR consent history on contacts

Every contact now carries a full, append-only consent history: marketing/newsletter and profiling consents are recorded as immutable events with timestamp and source, with the current status always visible on the contact card.

This gives compliance teams verifiable proof of consent (GDPR art. 7) without changing how sales people work.