From f3e55456ba3c477cdf29950a8a3777f5779838b0 Mon Sep 17 00:00:00 2001
From: Tudor Amariei <tudor.amariei@commitglobal.org>
Date: Tue, 13 Jan 2026 17:14:49 +0200
Subject: [PATCH 1/5] feature: create a feature to allow easy anonymization of
 donors

- create a feature to allow the anonymization of all the "old" donations (>1/2 years old)
- allow anonymization of a donation in different contexts in the admin

# Conflicts:
#	backend/locale/en/LC_MESSAGES/django.po
#	backend/locale/hy/LC_MESSAGES/django.po
#	backend/locale/ro/LC_MESSAGES/django.po
---
 .idea/runConfigurations/compilemessages.xml   |   3 +-
 .../generate_donations_PDF_only.xml           |  28 ++
 ...tions.xml => generate_donations_noPDF.xml} |   7 +-
 .idea/runConfigurations/makemessages.xml      |   3 +-
 backend/donations/admin/donors.py             | 245 +++++++++++++++---
 .../management/commands/generate_donations.py |  69 ++++-
 backend/donations/models/donors.py            |  34 ++-
 .../redirectioneaza/settings/app_configs.py   |   7 +-
 .../redirectioneaza/settings/environment.py   |   8 +-
 backend/utils/common/crypto_helper.py         |   9 +
 backend/utils/constants/time.py               |   3 +
 11 files changed, 363 insertions(+), 53 deletions(-)
 create mode 100644 .idea/runConfigurations/generate_donations_PDF_only.xml
 rename .idea/runConfigurations/{generate_donations.xml => generate_donations_noPDF.xml} (76%)
 create mode 100644 backend/utils/common/crypto_helper.py

diff --git a/.idea/runConfigurations/compilemessages.xml b/.idea/runConfigurations/compilemessages.xml
index 11b216b1e..eb0a8c96e 100644
--- a/.idea/runConfigurations/compilemessages.xml
+++ b/.idea/runConfigurations/compilemessages.xml
@@ -9,11 +9,12 @@
       <env name="DJANGO_SETTINGS_MODULE" value="redirectioneaza.settings" />
     </envs>
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.12 (redirectioneaza)" />
+    <option name="SDK_NAME" value="uv (redirectioneaza)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/backend" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="RUN_TOOL" value="true" />
     <option name="launchJavascriptDebuger" value="false" />
     <option name="host" value="" />
     <option name="additionalOptions" value="" />
diff --git a/.idea/runConfigurations/generate_donations_PDF_only.xml b/.idea/runConfigurations/generate_donations_PDF_only.xml
new file mode 100644
index 000000000..bc6851303
--- /dev/null
+++ b/.idea/runConfigurations/generate_donations_PDF_only.xml
@@ -0,0 +1,28 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="generate_donations PDF only" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
+    <module name="redirectioneaza" />
+    <option name="ENV_FILES" value="$PROJECT_DIR$/.env.local" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="PARENT_ENVS" value="true" />
+    <envs>
+      <env name="PYTHONUNBUFFERED" value="1" />
+      <env name="DJANGO_SETTINGS_MODULE" value="redirectioneaza.settings" />
+    </envs>
+    <option name="SDK_HOME" value="" />
+    <option name="SDK_NAME" value="uv (redirectioneaza)" />
+    <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/backend" />
+    <option name="IS_MODULE_SDK" value="false" />
+    <option name="ADD_CONTENT_ROOTS" value="true" />
+    <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="RUN_TOOL" value="true" />
+    <option name="launchJavascriptDebuger" value="false" />
+    <option name="host" value="" />
+    <option name="additionalOptions" value="20000 --pdf-only" />
+    <option name="browserUrl" value="" />
+    <option name="runTestServer" value="false" />
+    <option name="runNoReload" value="false" />
+    <option name="useCustomRunCommand" value="true" />
+    <option name="customRunCommand" value="generate_donations" />
+    <method v="2" />
+  </configuration>
+</component>
\ No newline at end of file
diff --git a/.idea/runConfigurations/generate_donations.xml b/.idea/runConfigurations/generate_donations_noPDF.xml
similarity index 76%
rename from .idea/runConfigurations/generate_donations.xml
rename to .idea/runConfigurations/generate_donations_noPDF.xml
index 84339d01e..09f554eec 100644
--- a/.idea/runConfigurations/generate_donations.xml
+++ b/.idea/runConfigurations/generate_donations_noPDF.xml
@@ -1,5 +1,5 @@
 <component name="ProjectRunConfigurationManager">
-  <configuration default="false" name="generate_donations" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
+  <configuration default="false" name="generate_donations noPDF" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
     <module name="redirectioneaza" />
     <option name="ENV_FILES" value="$PROJECT_DIR$/.env.local" />
     <option name="INTERPRETER_OPTIONS" value="" />
@@ -9,14 +9,15 @@
       <env name="DJANGO_SETTINGS_MODULE" value="redirectioneaza.settings" />
     </envs>
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.12 (redirectioneaza)" />
+    <option name="SDK_NAME" value="uv (redirectioneaza)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/backend" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="RUN_TOOL" value="true" />
     <option name="launchJavascriptDebuger" value="false" />
     <option name="host" value="" />
-    <option name="additionalOptions" value="20" />
+    <option name="additionalOptions" value="20000 --no-pdf" />
     <option name="browserUrl" value="" />
     <option name="runTestServer" value="false" />
     <option name="runNoReload" value="false" />
diff --git a/.idea/runConfigurations/makemessages.xml b/.idea/runConfigurations/makemessages.xml
index 6ff22e2ee..b1dd050b9 100644
--- a/.idea/runConfigurations/makemessages.xml
+++ b/.idea/runConfigurations/makemessages.xml
@@ -9,11 +9,12 @@
       <env name="DJANGO_SETTINGS_MODULE" value="redirectioneaza.settings" />
     </envs>
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.12 (redirectioneaza)" />
+    <option name="SDK_NAME" value="uv (redirectioneaza)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/backend" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="RUN_TOOL" value="true" />
     <option name="launchJavascriptDebuger" value="false" />
     <option name="host" value="" />
     <option name="additionalOptions" value="-a" />
diff --git a/backend/donations/admin/donors.py b/backend/donations/admin/donors.py
index 4e563cdc3..daf4325f1 100644
--- a/backend/donations/admin/donors.py
+++ b/backend/donations/admin/donors.py
@@ -1,12 +1,17 @@
 import logging
+from datetime import timedelta
 
+from django import forms
+from django.conf import settings
 from django.contrib import admin, messages
-from django.core.management import call_command
+from django.contrib.messages import DEFAULT_LEVELS
+from django.core.management import CommandError, call_command
 from django.core.validators import EMPTY_VALUES
 from django.db.models import QuerySet
 from django.http import HttpRequest
-from django.shortcuts import redirect
-from django.urls import reverse
+from django.shortcuts import redirect, render
+from django.urls import reverse, reverse_lazy
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import ngettext_lazy
 from unfold.admin import ModelAdmin
@@ -15,13 +20,78 @@
 
 from donations.models.donors import Donor
 from redirectioneaza.common.app_url import build_uri
+from redirectioneaza.common.async_wrapper import async_wrapper
 from redirectioneaza.common.messaging import extend_email_context, send_email
 from utils.common.admin import HasNgoFilter
+from utils.constants.time import YEAR
 
 logger = logging.getLogger(__name__)
 
-REMOVE_DONATIONS_SUCCESS_FLAG = "success"
-REMOVE_DONATIONS_FAILURE_FLAG = "failure"
+TASK_SUCCESS_FLAG = "SUCCESS"
+TASK_FAILURE_FLAG = "ERROR"
+TASK_SCHEDULED_FLAG = "SCHEDULED"
+
+
+class AnonymizeDonorForm(forms.Form):
+    confirmation = forms.MultipleChoiceField(
+        label=_("Please confirm"),
+        help_text=_(
+            "This action will PERMANENTLY anonymize the selected donor's personal data, "
+            "removing any personally identifiable information and the form itself. "
+            "THIS ACTION CANNOT BE UNDONE."
+        ),
+        choices=[("yes", _("Yes, I want to anonymize this donor"))],
+        widget=forms.CheckboxSelectMultiple,
+        required=True,
+    )
+
+
+def _print_task_result(process: str, task_results: dict[str, int], queryset_size: int) -> str:
+    message_parts: list[str] = [
+        ngettext_lazy(
+            singular="Out of %(queryset_size)d donor, the %(process)s results were:",
+            plural="Out of %(queryset_size)d donors, the %(process)s results were:",
+            number=queryset_size,
+        )
+        % {
+            "queryset_size": queryset_size,
+            "process": process.upper(),
+        }
+    ]
+
+    if task_results.get(TASK_SUCCESS_FLAG):
+        message_parts.append(
+            ngettext_lazy(
+                singular="%(success)d was processed",
+                plural="%(success)d were processed",
+                number=task_results[TASK_SUCCESS_FLAG],
+            )
+            % {"success": task_results[TASK_SUCCESS_FLAG]}
+        )
+
+    if task_results.get(TASK_FAILURE_FLAG):
+        message_parts.append(
+            ngettext_lazy(
+                singular="%(failure)d was not processed",
+                plural="%(failure)d were not processed",
+                number=task_results[TASK_FAILURE_FLAG],
+            )
+            % {"failure": task_results[TASK_FAILURE_FLAG]}
+        )
+
+    if task_results.get(TASK_SCHEDULED_FLAG):
+        message_parts.append(
+            ngettext_lazy(
+                singular="%(scheduled)d was scheduled for processing",
+                plural="%(scheduled)d were scheduled for processing",
+                number=task_results[TASK_SCHEDULED_FLAG],
+            )
+            % {"scheduled": task_results[TASK_SCHEDULED_FLAG]}
+        )
+
+    message_parts[-1] += "."
+
+    return ", ".join(message_parts)
 
 
 def soft_delete_donor(donor_pk: int):
@@ -43,10 +113,26 @@ def soft_delete_donor(donor_pk: int):
             html_template="emails/donor/removed-redirection/main.html",
             context=mail_context,
         )
-        return REMOVE_DONATIONS_SUCCESS_FLAG
+        return TASK_SUCCESS_FLAG
     except Exception as e:
         logger.error(f"Failed to delete donor {donor_pk}: {e}")
-        return REMOVE_DONATIONS_FAILURE_FLAG
+        return TASK_FAILURE_FLAG
+
+
+def anonymize_donor(donor: Donor):
+    logger.info(f"Anonymizing donor {donor.pk}")
+
+    try:
+        if settings.USER_ANONIMIZATION_METHOD == "async":
+            async_wrapper(donor.anonymize)
+            return TASK_SCHEDULED_FLAG
+
+        donor.anonymize()
+    except Exception as e:
+        logger.error(f"Failed to anonymize donor {donor.pk}: {e}")
+        return TASK_FAILURE_FLAG
+
+    return TASK_SUCCESS_FLAG
 
 
 class CommonNumericFilter(TextFilter):
@@ -140,8 +226,13 @@ class DonorAdmin(ModelAdmin):
         ),
     )
 
-    actions = ("remove_donations",)
-    actions_list = ("run_redirections_stats_generator", "run_redirections_stats_generator_force")
+    actions = ("remove_donations", "anonymize_donations")
+    actions_list = (
+        "run_redirections_stats_generator",
+        "run_redirections_stats_generator_force",
+        "anonymize_old_donations",
+    )
+    actions_detail = ("anonymize_donation",)
 
     def has_change_permission(self, request, obj=None):
         return False
@@ -155,37 +246,131 @@ def get_form_url(self, obj: Donor):
 
     @action(description=_("Remove donations and notify donors"), url_path="remove-donations")
     def remove_donations(self, request, queryset: QuerySet[Donor]):
-        task_results = {REMOVE_DONATIONS_SUCCESS_FLAG: 0, REMOVE_DONATIONS_FAILURE_FLAG: 0}
+        task_results = {TASK_SUCCESS_FLAG: 0, TASK_FAILURE_FLAG: 0}
 
         queryset_size = queryset.count()
         for donor in queryset:
             task_result = soft_delete_donor(donor.pk)
             task_results[task_result] += 1
 
-        part_1 = ngettext_lazy(
-            singular="Out of %(queryset_size)d donor",
-            plural="Out of %(queryset_size)d donors",
-            number=queryset_size,
-        ) % {"queryset_size": queryset_size}
+        message: str = _print_task_result(
+            process="removal",
+            task_results=task_results,
+            queryset_size=queryset_size,
+        )
+
+        self.message_user(request, message)
 
-        part_2 = ngettext_lazy(
-            singular="%(success)d was deleted",
-            plural="%(success)d were deleted",
-            number=task_results[REMOVE_DONATIONS_SUCCESS_FLAG],
-        ) % {"success": task_results[REMOVE_DONATIONS_SUCCESS_FLAG]}
+    @action(description=_("Anonymize public data of donations"), url_path="anonymize-donations")
+    def anonymize_donations(self, request, queryset: QuerySet[Donor]):
+        task_results = {TASK_SUCCESS_FLAG: 0, TASK_FAILURE_FLAG: 0, TASK_SCHEDULED_FLAG: 0}
 
-        part_3 = ngettext_lazy(
-            singular="%(failure)d was not deleted",
-            plural="%(failure)d were not deleted",
-            number=task_results[REMOVE_DONATIONS_FAILURE_FLAG],
-        ) % {"failure": task_results[REMOVE_DONATIONS_FAILURE_FLAG]}
+        queryset_size = queryset.count()
+        for donor in queryset:
+            task_result = anonymize_donor(donor)
+            task_results[task_result] += 1
 
-        self.message_user(request, ", ".join([part_1, part_2, part_3 + "."]))
+        message: str = _print_task_result(
+            process="anonymization",
+            task_results=task_results,
+            queryset_size=queryset_size,
+        )
+
+        self.message_user(request, message)
+
+    def _anonymize_donation(self, donor: Donor) -> dict[str, str]:
+        task_result = anonymize_donor(donor)
+
+        if task_result == TASK_SUCCESS_FLAG:
+            message = _("The donor was successfully anonymized.")
+        elif task_result == TASK_SCHEDULED_FLAG:
+            message = _("The donor anonymization was scheduled for processing.")
+        else:
+            message = _("Failed to anonymize the donor. Check the logs for more details.")
+
+        return {"status": task_result, "message": message}
+
+    @action(description=_("Anonymize public data of the donation"), url_path="anonymize-donation")
+    def anonymize_donation(self, request: HttpRequest, object_id: int):
+        donor = Donor.objects.get(pk=object_id)
+
+        if request.method == "POST":
+            form = AnonymizeDonorForm(request.POST)
+            if form.is_valid():
+                result: dict = self._anonymize_donation(donor)
+
+                self.message_user(request, result["message"], level=DEFAULT_LEVELS.get(result["status"], messages.INFO))
+
+                return redirect(reverse_lazy("admin:donations_donor_change", args=[donor.pk]))
+            else:
+                messages.error(request, _("Please confirm the anonymization by checking the box."))
+        else:
+            form = AnonymizeDonorForm()
+
+        return render(
+            request,
+            "admin/forms/action.html",
+            context={
+                "form": form,
+                "object": donor,
+                "title": _("Anonymize donor"),
+                **self.admin_site.each_context(request),
+            },
+        )
+
+        return redirect(reverse_lazy("admin:donations_donor_change", args=[donor.pk]))
 
     @action(description=_("Schedule redirections stats"), url_path="schedule-redirections-stats-generator")
-    def run_redirections_stats_generator(self, request, queryset: QuerySet[Donor]):
-        call_command("generate_redirections_stats")
+    def run_redirections_stats_generator(self, request):
+        try:
+            call_command("generate_redirections_stats")
+        except CommandError:
+            self.message_user(request, _("Error calling the command"))
+
+        self.message_user(request, _("Succesfully scheduled"))
 
     @action(description=_("Schedule redirections stats [FORCE]"), url_path="schedule-redirections-stats-generator-f")
-    def run_redirections_stats_generator_force(self, request, queryset: QuerySet[Donor]):
-        call_command("generate_redirections_stats", "--force")
+    def run_redirections_stats_generator_force(self, request):
+        try:
+            call_command("generate_redirections_stats", "--force")
+        except CommandError:
+            self.message_user(request, _("Error calling the command"))
+
+        self.message_user(request, _("Succesfully scheduled"))
+
+    def _anonymize_old_donations(self):
+        try:
+            now = timezone.now()
+            one_year_ago_date = now - timedelta(days=YEAR)
+            two_years_ago_date = now - timedelta(days=2 * YEAR)
+
+            base_donor_qs = Donor.objects.exclude(
+                l_name="",
+                f_name="",
+            )
+
+            one_year_donations_qs: QuerySet[Donor] = base_donor_qs.filter(
+                two_years=False,
+                date_created__lte=one_year_ago_date,
+            )
+            two_year_donations_qs: QuerySet[Donor] = base_donor_qs.filter(
+                date_created__lte=two_years_ago_date,
+            )
+
+            for donor in two_year_donations_qs:
+                anonymize_donor(donor)
+            for donor in one_year_donations_qs:
+                anonymize_donor(donor)
+
+        except CommandError:
+            logger.error("Error calling the anonymize_old_donations command")
+            raise
+
+    @action(description=_("Anonymize old donations"), url_path="anonymize-old-donations")
+    def anonymize_old_donations(self, request):
+        try:
+            self._anonymize_old_donations()
+        except CommandError:
+            self.message_user(request, _("Error calling the command"))
+
+        self.message_user(request, _("Succesfully scheduled"))
diff --git a/backend/donations/management/commands/generate_donations.py b/backend/donations/management/commands/generate_donations.py
index ae5b58beb..f675c598f 100644
--- a/backend/donations/management/commands/generate_donations.py
+++ b/backend/donations/management/commands/generate_donations.py
@@ -3,6 +3,8 @@
 
 from django.core.files import File
 from django.core.management import BaseCommand
+from django.db.models import QuerySet
+from django_q.tasks import async_task
 from faker import Faker
 
 import redirectioneaza.settings.locations
@@ -14,6 +16,12 @@
 fake = Faker("ro_RO")
 
 
+def _generate_pdf_for_donor(donor_pk: int):
+    selected_donor: Donor = Donor.objects.get(pk=donor_pk)
+    selected_donor.pdf_file = File(create_full_pdf(selected_donor))
+    selected_donor.save()
+
+
 class Command(BaseCommand):
     help = "Generate fake donation forms"
 
@@ -30,9 +38,45 @@ def add_arguments(self, parser):
             help="The ID of the organization to generate donations for",
             default=None,
         )
+        parser.add_argument(
+            "--no-pdf",
+            action="store_true",
+            help="Do not generate PDFs for the donations",
+            default=False,
+        )
+        parser.add_argument(
+            "--pdf-only",
+            action="store_true",
+            help="Only generate PDFs for donations without PDFs",
+            default=False,
+        )
 
     def handle(self, *args, **options):
+        def _generate_pdfs_for_donations(new_donors: QuerySet[Donor]):
+            generated_pdfs: int = 0
+            self.stdout.write(f"Queuing PDF generation for {new_donors.count()} new donors...")
+            for new_donor in new_donors:
+                generated_pdfs += 1
+                async_task(
+                    _generate_pdf_for_donor,
+                    new_donor.pk,
+                )
+
+                if generated_pdfs % 50 == 0:
+                    self.stdout.write(f"Queued {generated_pdfs} / {new_donors.count()} PDFs...")
+
+        batch_size = 200
+
+        pdf_only = options["pdf_only"]
+        if pdf_only:
+            donors_without_pdfs: QuerySet[Donor] = Donor.objects.filter(pdf_file="")
+            self.stdout.write(f"Generating PDFs for {donors_without_pdfs.count()} donations without PDFs...")
+            _generate_pdfs_for_donations(donors_without_pdfs)
+            self.stdout.write(self.style.SUCCESS("Done!"))
+            return
+
         total_donations = options["total_donations"]
+        create_pdf = not options["no_pdf"]
         target_org = options.get("org", None)
 
         if target_org:
@@ -52,7 +96,8 @@ def handle(self, *args, **options):
             return
 
         generated_donations: list[Donor] = []
-        while len(generated_donations) < total_donations:
+        total_generated = 0
+        while total_generated < total_donations:
             # pick a random NGO
             ngo: Ngo = random.choice(ngos)
             if not ngo.causes.exists():
@@ -89,14 +134,28 @@ def handle(self, *args, **options):
             donor.set_cnp(cnp)
             donor.set_address_helper(**address)
 
-            donor.pdf_file = File(create_full_pdf(donor))
-
             generated_donations.append(donor)
+            total_generated += 1
+
+            if len(generated_donations) % 50 == 0:
+                self.stdout.write(f"Generated {total_generated} / {total_donations} donations...")
 
-        self.stdout.write(self.style.SUCCESS("Writing to the database..."))
+            if len(generated_donations) > batch_size:
+                self.stdout.write(f"Writing {len(generated_donations)} donations to the database...")
+                Donor.objects.bulk_create(
+                    generated_donations,
+                    ignore_conflicts=True,
+                )
+                generated_donations = []
+
+                if create_pdf:
+                    _generate_pdfs_for_donations(Donor.objects.filter(pdf_file=""))
+
+        self.stdout.write(
+            self.style.SUCCESS(f"Writing the last {len(generated_donations)} donations to the database...")
+        )
         Donor.objects.bulk_create(
             generated_donations,
-            batch_size=500,
             ignore_conflicts=True,
         )
 
diff --git a/backend/donations/models/donors.py b/backend/donations/models/donors.py
index 88bd04a02..87fa92423 100644
--- a/backend/donations/models/donors.py
+++ b/backend/donations/models/donors.py
@@ -2,13 +2,13 @@
 from datetime import datetime
 from functools import partial
 
-from django.conf import settings
 from django.db import models
 from django.urls import reverse
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 
 from donations.common.models_hashing import hash_id_secret
+from utils.common.crypto_helper import decrypt_data, encrypt_data
 
 
 def year_ngo_donor_directory_path(subdir: str, instance: "Donor", filename: str) -> str:
@@ -174,10 +174,30 @@ class Meta:
     def __str__(self):
         return f"{self.cause} {self.date_created} {self.email}"
 
-    def remove(self):
+    def remove(self, commit: bool = True):
         self.is_available = False
 
-        self.save()
+        if commit:
+            self.save()
+
+    def anonymize(self, commit: bool = True):
+        self.l_name = ""
+        self.f_name = ""
+        self.initial = ""
+        self.set_cnp("")
+
+        self._set_address({})
+
+        self.phone = ""
+        self.email = ""
+
+        self.geoip = {}
+
+        self.pdf_file.delete(save=commit)
+        self.filename = ""
+
+        if commit:
+            self.save()
 
     def set_cnp(self, cnp: str):
         self.encrypted_cnp = self.encrypt_cnp(cnp)
@@ -281,22 +301,22 @@ def form_url(self):
 
     @staticmethod
     def encrypt_cnp(cnp: str) -> str:
-        return settings.FERNET_OBJECT.encrypt(cnp.encode()).decode()
+        return encrypt_data(cnp.encode())
 
     @staticmethod
     def decrypt_cnp(cnp: str) -> str:
         if not cnp:
             return cnp
 
-        return settings.FERNET_OBJECT.decrypt(cnp.encode()).decode()
+        return decrypt_data(cnp.encode())
 
     @staticmethod
     def encrypt_address(address: dict) -> str:
-        return settings.FERNET_OBJECT.encrypt(json.dumps(address).encode()).decode()
+        return encrypt_data(json.dumps(address).encode())
 
     @staticmethod
     def decrypt_address(address: str) -> dict:
         if not address:
             return {}
 
-        return json.loads(settings.FERNET_OBJECT.decrypt(address.encode()).decode())
+        return json.loads(decrypt_data(address.encode()))
diff --git a/backend/redirectioneaza/settings/app_configs.py b/backend/redirectioneaza/settings/app_configs.py
index 55ab81918..ae38aeae1 100644
--- a/backend/redirectioneaza/settings/app_configs.py
+++ b/backend/redirectioneaza/settings/app_configs.py
@@ -16,11 +16,12 @@
 REDIRECTIONS_DEADLINE_MONTH = env.int("REDIRECTIONS_LIMIT_MONTH")
 REDIRECTIONS_DEADLINE_DAY = env.int("REDIRECTIONS_LIMIT_DAY")
 
-DONATIONS_XML_LIMIT_PER_FILE = env.int("DONATIONS_XML_LIMIT_PER_FILE")
 DEFAULT_RUN_METHOD = env.str("DEFAULT_RUN_METHOD")
-FORMS_DOWNLOAD_METHOD = env.str("FORMS_DOWNLOAD_METHOD")
-DONATIONS_CSV_DOWNLOAD_METHOD = env.str("DONATIONS_CSV_DOWNLOAD_METHOD")
+FORMS_DOWNLOAD_METHOD = env.str("FORMS_DOWNLOAD_METHOD", DEFAULT_RUN_METHOD)
+DONATIONS_CSV_DOWNLOAD_METHOD = env.str("DONATIONS_CSV_DOWNLOAD_METHOD", DEFAULT_RUN_METHOD)
+USER_ANONIMIZATION_METHOD = env.str("USER_ANONIMIZATION_METHOD", DEFAULT_RUN_METHOD)
 
+DONATIONS_XML_LIMIT_PER_FILE = env.int("DONATIONS_XML_LIMIT_PER_FILE")
 DONATIONS_CSV_LIMIT_PER_FILE = env.int("DONATIONS_CSV_LIMIT_PER_FILE")
 
 REDIRECTIONS_LIMIT_MONTH_NAME = MONTHS[REDIRECTIONS_DEADLINE_MONTH - 1]["month"]
diff --git a/backend/redirectioneaza/settings/environment.py b/backend/redirectioneaza/settings/environment.py
index 962a65660..6b333da1e 100644
--- a/backend/redirectioneaza/settings/environment.py
+++ b/backend/redirectioneaza/settings/environment.py
@@ -21,10 +21,12 @@
     IS_CONTAINERIZED=(bool, False),
     RECAPTCHA_ENABLED=(bool, True),
     FORCE_PARTNER=(bool, False),
-    # Forms Download
+    # Running methods
     DEFAULT_RUN_METHOD=(str, "async"),
-    FORMS_DOWNLOAD_METHOD=(str, "async"),
-    DONATIONS_CSV_DOWNLOAD_METHOD=(str, "async"),
+    FORMS_DOWNLOAD_METHOD=(str, ""),
+    DONATIONS_CSV_DOWNLOAD_METHOD=(str, ""),
+    USER_ANONIMIZATION_METHOD=(str, ""),
+    # Forms Download
     ENABLE_FORMS_DOWNLOAD=(bool, True),
     TIMEDELTA_FORMS_DOWNLOAD_MINUTES=(int, 6 * HOUR),
     TIMEDELTA_REDIRECTIONS_LIMIT_DOWNLOAD_DAYS=(int, 31),
diff --git a/backend/utils/common/crypto_helper.py b/backend/utils/common/crypto_helper.py
new file mode 100644
index 000000000..8118c5c86
--- /dev/null
+++ b/backend/utils/common/crypto_helper.py
@@ -0,0 +1,9 @@
+from django.conf import settings
+
+
+def encrypt_data(data: bytes) -> str:
+    return settings.FERNET_OBJECT.encrypt(data).decode()
+
+
+def decrypt_data(token: bytes) -> str:
+    return settings.FERNET_OBJECT.decrypt(token).decode()
diff --git a/backend/utils/constants/time.py b/backend/utils/constants/time.py
index a211b724a..915e06ea0 100644
--- a/backend/utils/constants/time.py
+++ b/backend/utils/constants/time.py
@@ -6,6 +6,9 @@
 HOUR = 60 * MINUTE
 DAY = 24 * HOUR
 WEEK = 7 * DAY
+MONTH = 28 * DAY
+YEAR = 365 * DAY
+
 MONTHS = [
     {
         "month": _("January"),

From 0e3ef3e119c4960b8e9b8505b75c200fae876e8e Mon Sep 17 00:00:00 2001
From: Tudor Amariei <tudor.amariei@commitglobal.org>
Date: Tue, 20 Jan 2026 18:45:05 +0200
Subject: [PATCH 2/5] finishing touches

---
 ...orgs_valid.xml => 01_01_generate_orgs.xml} |   7 +-
 ...orgs.xml => 01_02_generate_orgs_valid.xml} |   7 +-
 ...e_causes.xml => 02_01_generate_causes.xml} |   5 +-
 ...xml => 03_01_generate_donations_noPDF.xml} |   2 +-
 ... => 03_02_generate_donations_PDF_only.xml} |   2 +-
 backend/donations/admin/donors.py             | 159 ++++++++++--------
 ...rsonal_data_removal_started_at_and_more.py |  23 +++
 backend/donations/models/donors.py            |  27 ++-
 .../redirectioneaza/common/async_wrapper.py   |  16 +-
 .../redirectioneaza/settings/environment.py   |   1 +
 .../redirectioneaza/settings/feature_flags.py |   1 +
 backend/utils/common/admin.py                 |   1 +
 backend/utils/constants/time.py               |   9 +-
 13 files changed, 174 insertions(+), 86 deletions(-)
 rename .idea/runConfigurations/{generate_orgs_valid.xml => 01_01_generate_orgs.xml} (84%)
 rename .idea/runConfigurations/{generate_orgs.xml => 01_02_generate_orgs_valid.xml} (76%)
 rename .idea/runConfigurations/{generate_causes.xml => 02_01_generate_causes.xml} (81%)
 rename .idea/runConfigurations/{generate_donations_noPDF.xml => 03_01_generate_donations_noPDF.xml} (88%)
 rename .idea/runConfigurations/{generate_donations_PDF_only.xml => 03_02_generate_donations_PDF_only.xml} (87%)
 create mode 100644 backend/donations/migrations/0041_donor_personal_data_removal_started_at_and_more.py

diff --git a/.idea/runConfigurations/generate_orgs_valid.xml b/.idea/runConfigurations/01_01_generate_orgs.xml
similarity index 84%
rename from .idea/runConfigurations/generate_orgs_valid.xml
rename to .idea/runConfigurations/01_01_generate_orgs.xml
index ce35bcc32..05e652426 100644
--- a/.idea/runConfigurations/generate_orgs_valid.xml
+++ b/.idea/runConfigurations/01_01_generate_orgs.xml
@@ -1,5 +1,5 @@
 <component name="ProjectRunConfigurationManager">
-  <configuration default="false" name="generate_orgs valid" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
+  <configuration default="false" name="01.01 generate_orgs" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
     <module name="redirectioneaza" />
     <option name="ENV_FILES" value="$PROJECT_DIR$/.env.local" />
     <option name="INTERPRETER_OPTIONS" value="" />
@@ -9,14 +9,15 @@
       <env name="DJANGO_SETTINGS_MODULE" value="redirectioneaza.settings" />
     </envs>
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.12 (redirectioneaza)" />
+    <option name="SDK_NAME" value="uv (redirectioneaza)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/backend" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="RUN_TOOL" value="true" />
     <option name="launchJavascriptDebuger" value="false" />
     <option name="host" value="" />
-    <option name="additionalOptions" value="10 --valid" />
+    <option name="additionalOptions" value="10" />
     <option name="browserUrl" value="" />
     <option name="runTestServer" value="false" />
     <option name="runNoReload" value="false" />
diff --git a/.idea/runConfigurations/generate_orgs.xml b/.idea/runConfigurations/01_02_generate_orgs_valid.xml
similarity index 76%
rename from .idea/runConfigurations/generate_orgs.xml
rename to .idea/runConfigurations/01_02_generate_orgs_valid.xml
index 7609fc991..ee1bc6eb7 100644
--- a/.idea/runConfigurations/generate_orgs.xml
+++ b/.idea/runConfigurations/01_02_generate_orgs_valid.xml
@@ -1,5 +1,5 @@
 <component name="ProjectRunConfigurationManager">
-  <configuration default="false" name="generate_orgs" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
+  <configuration default="false" name="01.02 generate_orgs valid" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
     <module name="redirectioneaza" />
     <option name="ENV_FILES" value="$PROJECT_DIR$/.env.local" />
     <option name="INTERPRETER_OPTIONS" value="" />
@@ -9,14 +9,15 @@
       <env name="DJANGO_SETTINGS_MODULE" value="redirectioneaza.settings" />
     </envs>
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.12 (redirectioneaza)" />
+    <option name="SDK_NAME" value="uv (redirectioneaza)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/backend" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="RUN_TOOL" value="true" />
     <option name="launchJavascriptDebuger" value="false" />
     <option name="host" value="" />
-    <option name="additionalOptions" value="10" />
+    <option name="additionalOptions" value="10 --valid" />
     <option name="browserUrl" value="" />
     <option name="runTestServer" value="false" />
     <option name="runNoReload" value="false" />
diff --git a/.idea/runConfigurations/generate_causes.xml b/.idea/runConfigurations/02_01_generate_causes.xml
similarity index 81%
rename from .idea/runConfigurations/generate_causes.xml
rename to .idea/runConfigurations/02_01_generate_causes.xml
index 9cdca4396..04fb76d51 100644
--- a/.idea/runConfigurations/generate_causes.xml
+++ b/.idea/runConfigurations/02_01_generate_causes.xml
@@ -1,5 +1,5 @@
 <component name="ProjectRunConfigurationManager">
-  <configuration default="false" name="generate_causes" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
+  <configuration default="false" name="02.01 generate_causes" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
     <module name="redirectioneaza" />
     <option name="ENV_FILES" value="$PROJECT_DIR$/.env.local" />
     <option name="INTERPRETER_OPTIONS" value="" />
@@ -9,11 +9,12 @@
       <env name="DJANGO_SETTINGS_MODULE" value="redirectioneaza.settings" />
     </envs>
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.12 (redirectioneaza)" />
+    <option name="SDK_NAME" value="uv (redirectioneaza)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/backend" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="RUN_TOOL" value="true" />
     <option name="launchJavascriptDebuger" value="false" />
     <option name="host" value="" />
     <option name="additionalOptions" value="10" />
diff --git a/.idea/runConfigurations/generate_donations_noPDF.xml b/.idea/runConfigurations/03_01_generate_donations_noPDF.xml
similarity index 88%
rename from .idea/runConfigurations/generate_donations_noPDF.xml
rename to .idea/runConfigurations/03_01_generate_donations_noPDF.xml
index 09f554eec..1a0f6a004 100644
--- a/.idea/runConfigurations/generate_donations_noPDF.xml
+++ b/.idea/runConfigurations/03_01_generate_donations_noPDF.xml
@@ -1,5 +1,5 @@
 <component name="ProjectRunConfigurationManager">
-  <configuration default="false" name="generate_donations noPDF" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
+  <configuration default="false" name="03.01 generate_donations noPDF" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
     <module name="redirectioneaza" />
     <option name="ENV_FILES" value="$PROJECT_DIR$/.env.local" />
     <option name="INTERPRETER_OPTIONS" value="" />
diff --git a/.idea/runConfigurations/generate_donations_PDF_only.xml b/.idea/runConfigurations/03_02_generate_donations_PDF_only.xml
similarity index 87%
rename from .idea/runConfigurations/generate_donations_PDF_only.xml
rename to .idea/runConfigurations/03_02_generate_donations_PDF_only.xml
index bc6851303..4aadca7ca 100644
--- a/.idea/runConfigurations/generate_donations_PDF_only.xml
+++ b/.idea/runConfigurations/03_02_generate_donations_PDF_only.xml
@@ -1,5 +1,5 @@
 <component name="ProjectRunConfigurationManager">
-  <configuration default="false" name="generate_donations PDF only" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
+  <configuration default="false" name="03.02 generate_donations PDF only" type="Python.DjangoServer" factoryName="Django server" folderName="mock-data" singleton="false">
     <module name="redirectioneaza" />
     <option name="ENV_FILES" value="$PROJECT_DIR$/.env.local" />
     <option name="INTERPRETER_OPTIONS" value="" />
diff --git a/backend/donations/admin/donors.py b/backend/donations/admin/donors.py
index daf4325f1..3f398c7bf 100644
--- a/backend/donations/admin/donors.py
+++ b/backend/donations/admin/donors.py
@@ -1,5 +1,5 @@
 import logging
-from datetime import timedelta
+from datetime import datetime, timedelta
 
 from django import forms
 from django.conf import settings
@@ -15,7 +15,8 @@
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import ngettext_lazy
 from unfold.admin import ModelAdmin
-from unfold.contrib.filters.admin import TextFilter
+from unfold.contrib.filters.admin import RangeDateFilter, TextFilter
+from unfold.dataclasses import UnfoldAction
 from unfold.decorators import action
 
 from donations.models.donors import Donor
@@ -23,7 +24,7 @@
 from redirectioneaza.common.async_wrapper import async_wrapper
 from redirectioneaza.common.messaging import extend_email_context, send_email
 from utils.common.admin import HasNgoFilter
-from utils.constants.time import YEAR
+from utils.constants.time import YEAR_IN_DAYS
 
 logger = logging.getLogger(__name__)
 
@@ -97,8 +98,8 @@ def _print_task_result(process: str, task_results: dict[str, int], queryset_size
 def soft_delete_donor(donor_pk: int):
     logger.info(f"Deleting donor {donor_pk}")
     try:
-        donor = Donor.available.get(pk=donor_pk)
-        donor.remove()
+        donor: Donor = Donor.available.get(pk=donor_pk)
+        donor.disable()
 
         mail_context = {
             "cause_name": donor.cause.name,
@@ -119,20 +120,54 @@ def soft_delete_donor(donor_pk: int):
         return TASK_FAILURE_FLAG
 
 
-def anonymize_donor(donor: Donor):
+def remove_personal_data(donor: Donor) -> str:
     logger.info(f"Anonymizing donor {donor.pk}")
 
     try:
-        if settings.USER_ANONIMIZATION_METHOD == "async":
-            async_wrapper(donor.anonymize)
-            return TASK_SCHEDULED_FLAG
+        donor.personal_data_removal_started_at = timezone.now()
+        donor.save()
 
-        donor.anonymize()
+        result = async_wrapper(donor.remove_personal_data, settings.USER_ANONIMIZATION_METHOD)
+
+        return TASK_SUCCESS_FLAG if result is None else TASK_SCHEDULED_FLAG
     except Exception as e:
         logger.error(f"Failed to anonymize donor {donor.pk}: {e}")
         return TASK_FAILURE_FLAG
 
-    return TASK_SUCCESS_FLAG
+
+def anonymize_old_donations():
+    def remove_personal_data_in_bulk(selected_donors: QuerySet[Donor]):
+        # run the remove_personal_data async for each donor in the selected_donors queryset
+        for donor in selected_donors.iterator(chunk_size=500):
+            remove_personal_data(donor)
+
+    now: datetime = timezone.now()
+    one_year_ago_date: datetime = now - timedelta(days=1 * YEAR_IN_DAYS)
+    two_years_ago_date: datetime = now - timedelta(days=2 * YEAR_IN_DAYS)
+
+    base_donor_qs: QuerySet[Donor] = Donor.objects.filter(personal_data_removal_started_at__isnull=True)
+
+    # XXX: NO
+    remove_personal_data_in_bulk(Donor.objects.all())
+    remove_personal_data_in_bulk(base_donor_qs.filter(date_created__date__lte=two_years_ago_date))
+    remove_personal_data_in_bulk(base_donor_qs.filter(two_years=False, date_created__lte=one_year_ago_date))
+
+
+class HasPersonalDataFilter(admin.SimpleListFilter):
+    title = _("Has personal data")
+    parameter_name = "has_personal_data"
+    horizontal = True
+
+    def lookups(self, request, model_admin):
+        return ("yes", "Yes"), ("no", "No")
+
+    def queryset(self, request, queryset):
+        if self.value() == "yes":
+            return queryset.exclude(personal_data_removed__isnull=False)
+        if self.value() == "no":
+            return queryset.filter(personal_data_removed__isnull=False)
+
+        return queryset
 
 
 class CommonNumericFilter(TextFilter):
@@ -165,18 +200,27 @@ class CauseIdNumericListFilter(CommonNumericFilter):
 
 @admin.register(Donor)
 class DonorAdmin(ModelAdmin):
-    list_display = ("id", "email", "l_name", "f_name", "ngo", "is_available", "has_signed", "date_created")
+    list_display = (
+        "id",
+        "email",
+        "l_name",
+        "f_name",
+        "ngo",
+        "is_available",
+        "has_signed",
+        "date_created",
+    )
     list_display_links = ("id", "email", "l_name", "f_name")
 
     list_filter_submit = True
     list_filter = (
-        "date_created",
+        ("date_created", RangeDateFilter),
         HasNgoFilter,
+        HasPersonalDataFilter,
         "is_anonymous",
         "is_available",
         "has_signed",
         "two_years",
-        "income_type",
         NgoIdNumericListFilter,
         CauseIdNumericListFilter,
     )
@@ -226,13 +270,13 @@ class DonorAdmin(ModelAdmin):
         ),
     )
 
-    actions = ("remove_donations", "anonymize_donations")
+    actions = ("remove_bulk_donations", "anonymize_bulk_donations")
     actions_list = (
         "run_redirections_stats_generator",
         "run_redirections_stats_generator_force",
-        "anonymize_old_donations",
+        "run_anonymize_old_donations",
     )
-    actions_detail = ("anonymize_donation",)
+    actions_detail = ("anonymize_single_donation",)
 
     def has_change_permission(self, request, obj=None):
         return False
@@ -240,15 +284,23 @@ def has_change_permission(self, request, obj=None):
     def has_delete_permission(self, request, obj=...):
         return False
 
+    def get_actions_list(self, request: HttpRequest) -> list[UnfoldAction]:
+        if not settings.ENABLE_BULK_ANONIMIZATION:
+            self.actions_list = tuple(
+                action_item for action_item in self.actions_list if action_item != "run_anonymize_old_donations"
+            )
+
+        return super().get_actions_list(request)
+
     @admin.display(description=_("Form"))
     def get_form_url(self, obj: Donor):
         return obj.form_url
 
     @action(description=_("Remove donations and notify donors"), url_path="remove-donations")
-    def remove_donations(self, request, queryset: QuerySet[Donor]):
+    def remove_bulk_donations(self, request, queryset: QuerySet[Donor]):
         task_results = {TASK_SUCCESS_FLAG: 0, TASK_FAILURE_FLAG: 0}
 
-        queryset_size = queryset.count()
+        queryset_size: int = queryset.count()
         for donor in queryset:
             task_result = soft_delete_donor(donor.pk)
             task_results[task_result] += 1
@@ -261,13 +313,13 @@ def remove_donations(self, request, queryset: QuerySet[Donor]):
 
         self.message_user(request, message)
 
-    @action(description=_("Anonymize public data of donations"), url_path="anonymize-donations")
-    def anonymize_donations(self, request, queryset: QuerySet[Donor]):
+    @action(description=_("Anonymize personal data of donations"), url_path="anonymize-donations")
+    def anonymize_bulk_donations(self, request, queryset: QuerySet[Donor]):
         task_results = {TASK_SUCCESS_FLAG: 0, TASK_FAILURE_FLAG: 0, TASK_SCHEDULED_FLAG: 0}
 
-        queryset_size = queryset.count()
+        queryset_size: int = queryset.count()
         for donor in queryset:
-            task_result = anonymize_donor(donor)
+            task_result: str = remove_personal_data(donor)
             task_results[task_result] += 1
 
         message: str = _print_task_result(
@@ -278,26 +330,26 @@ def anonymize_donations(self, request, queryset: QuerySet[Donor]):
 
         self.message_user(request, message)
 
-    def _anonymize_donation(self, donor: Donor) -> dict[str, str]:
-        task_result = anonymize_donor(donor)
+    @action(description=_("Anonymize personal data of the donation"), url_path="anonymize-donation")
+    def anonymize_single_donation(self, request: HttpRequest, object_id: int):
+        def run_anonymize_donation_task(selected_donor: Donor) -> dict[str, str]:
+            task_result: str = remove_personal_data(selected_donor)
 
-        if task_result == TASK_SUCCESS_FLAG:
-            message = _("The donor was successfully anonymized.")
-        elif task_result == TASK_SCHEDULED_FLAG:
-            message = _("The donor anonymization was scheduled for processing.")
-        else:
-            message = _("Failed to anonymize the donor. Check the logs for more details.")
+            if task_result == TASK_SUCCESS_FLAG:
+                message = _("The donor was successfully anonymized.")
+            elif task_result == TASK_SCHEDULED_FLAG:
+                message = _("The donor anonymization was scheduled for processing.")
+            else:
+                message = _("Failed to anonymize the donor. Check the logs for more details.")
 
-        return {"status": task_result, "message": message}
+            return {"status": task_result, "message": message}
 
-    @action(description=_("Anonymize public data of the donation"), url_path="anonymize-donation")
-    def anonymize_donation(self, request: HttpRequest, object_id: int):
         donor = Donor.objects.get(pk=object_id)
 
         if request.method == "POST":
             form = AnonymizeDonorForm(request.POST)
             if form.is_valid():
-                result: dict = self._anonymize_donation(donor)
+                result: dict = run_anonymize_donation_task(donor)
 
                 self.message_user(request, result["message"], level=DEFAULT_LEVELS.get(result["status"], messages.INFO))
 
@@ -338,39 +390,10 @@ def run_redirections_stats_generator_force(self, request):
 
         self.message_user(request, _("Succesfully scheduled"))
 
-    def _anonymize_old_donations(self):
-        try:
-            now = timezone.now()
-            one_year_ago_date = now - timedelta(days=YEAR)
-            two_years_ago_date = now - timedelta(days=2 * YEAR)
-
-            base_donor_qs = Donor.objects.exclude(
-                l_name="",
-                f_name="",
-            )
-
-            one_year_donations_qs: QuerySet[Donor] = base_donor_qs.filter(
-                two_years=False,
-                date_created__lte=one_year_ago_date,
-            )
-            two_year_donations_qs: QuerySet[Donor] = base_donor_qs.filter(
-                date_created__lte=two_years_ago_date,
-            )
-
-            for donor in two_year_donations_qs:
-                anonymize_donor(donor)
-            for donor in one_year_donations_qs:
-                anonymize_donor(donor)
-
-        except CommandError:
-            logger.error("Error calling the anonymize_old_donations command")
-            raise
-
     @action(description=_("Anonymize old donations"), url_path="anonymize-old-donations")
-    def anonymize_old_donations(self, request):
-        try:
-            self._anonymize_old_donations()
-        except CommandError:
-            self.message_user(request, _("Error calling the command"))
+    def run_anonymize_old_donations(self, request):
+        async_wrapper(anonymize_old_donations, flag=settings.USER_ANONIMIZATION_METHOD)
 
         self.message_user(request, _("Succesfully scheduled"))
+
+        return redirect(reverse("admin:donations_donor_changelist"))
diff --git a/backend/donations/migrations/0041_donor_personal_data_removal_started_at_and_more.py b/backend/donations/migrations/0041_donor_personal_data_removal_started_at_and_more.py
new file mode 100644
index 000000000..f7383d6f9
--- /dev/null
+++ b/backend/donations/migrations/0041_donor_personal_data_removal_started_at_and_more.py
@@ -0,0 +1,23 @@
+# Generated by Django 5.2.10 on 2026-01-20 16:44
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("donations", "0040_auto_20251217_1005"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="donor",
+            name="personal_data_removal_started_at",
+            field=models.DateTimeField(blank=True, null=True, verbose_name="date personal data removal started"),
+        ),
+        migrations.AddField(
+            model_name="donor",
+            name="personal_data_removed_at",
+            field=models.DateTimeField(blank=True, null=True, verbose_name="date personal data removed"),
+        ),
+    ]
diff --git a/backend/donations/models/donors.py b/backend/donations/models/donors.py
index 87fa92423..bcce77ba9 100644
--- a/backend/donations/models/donors.py
+++ b/backend/donations/models/donors.py
@@ -44,12 +44,12 @@ def get_queryset(self):
         return super().get_queryset().filter(has_signed=True)
 
 
-class DonorCurrentYearSignedManager(DonorSignedManager):
+class DonorCurrentYearManager(DonorAvailableManager):
     def get_queryset(self):
         return super().get_queryset().filter(date_created__year=timezone.now().year)
 
 
-class DonorCurrentYearManager(DonorAvailableManager):
+class DonorCurrentYearSignedManager(DonorSignedManager):
     def get_queryset(self):
         return super().get_queryset().filter(date_created__year=timezone.now().year)
 
@@ -161,8 +161,22 @@ class Donor(models.Model):
         auto_now_add=True,
     )
 
+    # personal data removal information
+    personal_data_removal_started_at = models.DateTimeField(
+        verbose_name=_("date personal data removal started"),
+        blank=True,
+        null=True,
+    )
+    personal_data_removed_at = models.DateTimeField(
+        verbose_name=_("date personal data removed"),
+        blank=True,
+        null=True,
+    )
+
     objects = models.Manager()
+
     available = DonorAvailableManager()
+
     signed = DonorSignedManager()
     current_year = DonorCurrentYearManager()
     current_year_signed = DonorCurrentYearSignedManager()
@@ -174,13 +188,18 @@ class Meta:
     def __str__(self):
         return f"{self.cause} {self.date_created} {self.email}"
 
-    def remove(self, commit: bool = True):
+    def disable(self, commit: bool = True):
         self.is_available = False
 
         if commit:
             self.save()
 
-    def anonymize(self, commit: bool = True):
+    def remove_personal_data(self, commit: bool = True):
+        if not self.personal_data_removal_started_at:
+            self.personal_data_removal_started_at = timezone.now()
+
+        self.personal_data_removed_at = timezone.now()
+
         self.l_name = ""
         self.f_name = ""
         self.initial = ""
diff --git a/backend/redirectioneaza/common/async_wrapper.py b/backend/redirectioneaza/common/async_wrapper.py
index 094c3b74e..e09930bda 100644
--- a/backend/redirectioneaza/common/async_wrapper.py
+++ b/backend/redirectioneaza/common/async_wrapper.py
@@ -7,14 +7,28 @@
 
 def async_wrapper(
     func: Callable,
+    flag: str = None,
     *args: Any,
     **kwargs: Any,
 ) -> Callable:
     """
     A wrapper function to execute a function either synchronously or asynchronously
+    func: Callable
+        The function to be executed
+    flag: str, optional
+        A string to determine the execution method. If None, uses the default from settings.DEFAULT_RUN_METHOD
+    *args: Any
+        Positional arguments to pass to the function
+    **kwargs: Any
+        Keyword arguments to pass to the function
+
+    Returns:
+        The result of the function execution
     """
 
-    if settings.DEFAULT_RUN_METHOD == "async":
+    run_method: str = flag if flag else settings.DEFAULT_RUN_METHOD
+
+    if run_method == "async":
         return async_task(func, *args, **kwargs)
 
     return func(*args, **kwargs)
diff --git a/backend/redirectioneaza/settings/environment.py b/backend/redirectioneaza/settings/environment.py
index 6b333da1e..f7392b153 100644
--- a/backend/redirectioneaza/settings/environment.py
+++ b/backend/redirectioneaza/settings/environment.py
@@ -136,6 +136,7 @@
     ENABLE_FULL_VALIDATION_CNP=(bool, True),
     # Feature flags
     ENABLE_MULTIPLE_FORMS=(bool, False),
+    ENABLE_BULK_ANONIMIZATION=(bool, False),
     #
     AUDITLOG_EXPIRY_DAYS=(int, 1 * 365),  # 1 year
 )
diff --git a/backend/redirectioneaza/settings/feature_flags.py b/backend/redirectioneaza/settings/feature_flags.py
index 0b6131f55..47c0d27f3 100644
--- a/backend/redirectioneaza/settings/feature_flags.py
+++ b/backend/redirectioneaza/settings/feature_flags.py
@@ -6,6 +6,7 @@
 ENABLE_MULTIPLE_FORMS = env.bool("ENABLE_MULTIPLE_FORMS", True)
 ENABLE_BYOF = env.bool("ENABLE_BYOF", False)
 ENABLE_CSV_DOWNLOAD = env.bool("ENABLE_CSV_DOWNLOAD", False)
+ENABLE_BULK_ANONIMIZATION = env.bool("ENABLE_BULK_ANONIMIZATION")
 
 # Configurations for the NGO Hub integration
 UPDATE_ORGANIZATION_METHOD = env("UPDATE_ORGANIZATION_METHOD")
diff --git a/backend/utils/common/admin.py b/backend/utils/common/admin.py
index ff9ac36ef..85033137c 100644
--- a/backend/utils/common/admin.py
+++ b/backend/utils/common/admin.py
@@ -5,6 +5,7 @@
 class HasNgoFilter(admin.SimpleListFilter):
     title = _("Has NGO")
     parameter_name = "has_ngo"
+    horizontal = True
 
     def lookups(self, request, model_admin):
         return ("yes", "Yes"), ("no", "No")
diff --git a/backend/utils/constants/time.py b/backend/utils/constants/time.py
index 915e06ea0..a062071b8 100644
--- a/backend/utils/constants/time.py
+++ b/backend/utils/constants/time.py
@@ -5,9 +5,12 @@
 MINUTE = 60 * SECOND
 HOUR = 60 * MINUTE
 DAY = 24 * HOUR
-WEEK = 7 * DAY
-MONTH = 28 * DAY
-YEAR = 365 * DAY
+
+DAY_IN_DAYS = 1
+WEEK_IN_DAYS = 1 * DAY_IN_DAYS
+MONTH_IN_DAYS = 30 * DAY_IN_DAYS
+YEAR_IN_DAYS = 365 * DAY_IN_DAYS
+
 
 MONTHS = [
     {

From ad1d55fe6de8fd9b6886d6a3b8234bdf4647b085 Mon Sep 17 00:00:00 2001
From: Tudor Amariei <tudor.amariei@commitglobal.org>
Date: Wed, 21 Jan 2026 15:07:57 +0200
Subject: [PATCH 3/5] fix the async wrapper usages

---
 backend/donations/admin/donors.py                      |  5 +++--
 backend/donations/views/download_donations/byof.py     |  2 +-
 backend/donations/views/ngo_account/byof.py            |  2 +-
 backend/donations/views/ngo_account/causes.py          |  2 +-
 backend/donations/views/ngo_account/common.py          |  2 +-
 backend/donations/views/ngo_account/my_organization.py |  2 +-
 backend/redirectioneaza/common/async_wrapper.py        | 10 +++++-----
 7 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/backend/donations/admin/donors.py b/backend/donations/admin/donors.py
index 3f398c7bf..927cb76d3 100644
--- a/backend/donations/admin/donors.py
+++ b/backend/donations/admin/donors.py
@@ -14,6 +14,7 @@
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import ngettext_lazy
+from gevent.libev.watcher import async_
 from unfold.admin import ModelAdmin
 from unfold.contrib.filters.admin import RangeDateFilter, TextFilter
 from unfold.dataclasses import UnfoldAction
@@ -127,7 +128,7 @@ def remove_personal_data(donor: Donor) -> str:
         donor.personal_data_removal_started_at = timezone.now()
         donor.save()
 
-        result = async_wrapper(donor.remove_personal_data, settings.USER_ANONIMIZATION_METHOD)
+        result = async_wrapper(donor.remove_personal_data, async_flag=settings.USER_ANONIMIZATION_METHOD)
 
         return TASK_SUCCESS_FLAG if result is None else TASK_SCHEDULED_FLAG
     except Exception as e:
@@ -392,7 +393,7 @@ def run_redirections_stats_generator_force(self, request):
 
     @action(description=_("Anonymize old donations"), url_path="anonymize-old-donations")
     def run_anonymize_old_donations(self, request):
-        async_wrapper(anonymize_old_donations, flag=settings.USER_ANONIMIZATION_METHOD)
+        async_wrapper(anonymize_old_donations, async_flag=settings.USER_ANONIMIZATION_METHOD)
 
         self.message_user(request, _("Succesfully scheduled"))
 
diff --git a/backend/donations/views/download_donations/byof.py b/backend/donations/views/download_donations/byof.py
index 0fa8345ab..87f9d6647 100644
--- a/backend/donations/views/download_donations/byof.py
+++ b/backend/donations/views/download_donations/byof.py
@@ -52,7 +52,7 @@ class DonorModel(BaseModel):
     period: str | None = "1"
 
 
-def handle_external_data_processing(own_upload_id) -> dict | None:
+def handle_external_data_processing(own_upload_id: int) -> dict | None:
     try:
         own_upload = OwnFormsUpload.objects.select_related("ngo").get(pk=own_upload_id)
     except OwnFormsUpload.DoesNotExist:
diff --git a/backend/donations/views/ngo_account/byof.py b/backend/donations/views/ngo_account/byof.py
index 37b8dce12..402d7c302 100644
--- a/backend/donations/views/ngo_account/byof.py
+++ b/backend/donations/views/ngo_account/byof.py
@@ -70,7 +70,7 @@ def post(self, request: HttpRequest, *args, **kwargs):
         own_upload.ngo = ngo
         own_upload.save()
 
-        async_wrapper(handle_external_data_processing, own_upload.pk)
+        async_wrapper(handle_external_data_processing, own_upload_id=own_upload.pk)
 
         messages.success(request, _("The uploaded data file will be processed soon."))
 
diff --git a/backend/donations/views/ngo_account/causes.py b/backend/donations/views/ngo_account/causes.py
index cc4866ba8..4a9a340ec 100644
--- a/backend/donations/views/ngo_account/causes.py
+++ b/backend/donations/views/ngo_account/causes.py
@@ -115,7 +115,7 @@ def do_post(self, request, **kwargs):
         cause.save()
 
         if must_refresh_prefilled_form:
-            async_wrapper(delete_cause_prefilled_form, cause.pk)
+            async_wrapper(delete_cause_prefilled_form, cause_id=cause.pk)
 
         context["cause"] = cause
         context["ngo"] = ngo
diff --git a/backend/donations/views/ngo_account/common.py b/backend/donations/views/ngo_account/common.py
index 03d65ab77..fb5ac6396 100644
--- a/backend/donations/views/ngo_account/common.py
+++ b/backend/donations/views/ngo_account/common.py
@@ -142,7 +142,7 @@ def validate_registration_number(ngo, registration_number) -> str | None:
     return ""
 
 
-def delete_ngo_prefilled_forms(ngo_id):
+def delete_ngo_prefilled_forms(ngo_id: int):
     """
     Delete prefilled forms associated with the given NGO ID.
     :param ngo_id: The ID of the NGO whose prefilled forms are to be deleted.
diff --git a/backend/donations/views/ngo_account/my_organization.py b/backend/donations/views/ngo_account/my_organization.py
index 646a77988..0dcbead0b 100644
--- a/backend/donations/views/ngo_account/my_organization.py
+++ b/backend/donations/views/ngo_account/my_organization.py
@@ -145,7 +145,7 @@ def post(self, request, *args, **kwargs):
             user.ngo = ngo
             user.save()
         elif must_refresh_prefilled_form:
-            async_wrapper(delete_ngo_prefilled_forms, ngo.id)
+            async_wrapper(delete_ngo_prefilled_forms, ngo_id=ngo.id)
 
         context["ngo"] = ngo
 
diff --git a/backend/redirectioneaza/common/async_wrapper.py b/backend/redirectioneaza/common/async_wrapper.py
index e09930bda..9318468c1 100644
--- a/backend/redirectioneaza/common/async_wrapper.py
+++ b/backend/redirectioneaza/common/async_wrapper.py
@@ -7,8 +7,8 @@
 
 def async_wrapper(
     func: Callable,
-    flag: str = None,
-    *args: Any,
+    *,
+    async_flag: str = None,
     **kwargs: Any,
 ) -> Callable:
     """
@@ -26,9 +26,9 @@ def async_wrapper(
         The result of the function execution
     """
 
-    run_method: str = flag if flag else settings.DEFAULT_RUN_METHOD
+    run_method: str = async_flag if async_flag else settings.DEFAULT_RUN_METHOD
 
     if run_method == "async":
-        return async_task(func, *args, **kwargs)
+        return async_task(func, **kwargs)
 
-    return func(*args, **kwargs)
+    return func(**kwargs)

From df63fbeb8bd90347e93fce3308c0ab5ab9c1e739 Mon Sep 17 00:00:00 2001
From: Tudor Amariei <tudor.amariei@commitglobal.org>
Date: Wed, 21 Jan 2026 16:34:19 +0200
Subject: [PATCH 4/5] make a builder, write a test

---
 backend/donations/tests/builder.py            | 157 ++++++++++++++++++
 .../tests/test_donor_anonymization.py         |  40 +++++
 2 files changed, 197 insertions(+)
 create mode 100644 backend/donations/tests/builder.py
 create mode 100644 backend/donations/tests/test_donor_anonymization.py

diff --git a/backend/donations/tests/builder.py b/backend/donations/tests/builder.py
new file mode 100644
index 000000000..679d79d86
--- /dev/null
+++ b/backend/donations/tests/builder.py
@@ -0,0 +1,157 @@
+import random
+from typing import Any
+
+from django.core.files import File
+from faker import Faker
+
+from donations.models import Cause, Donor
+from donations.pdf import create_full_pdf
+
+faker = Faker("ro_RO")
+
+
+class DonorTestBuilder:
+    def __init__(self, *, cause: Cause, is_available: bool = True) -> None:
+        self.donor_data: dict[str, Any] = {
+            "cause": cause,
+            "ngo": cause.ngo,
+            "is_available": is_available,
+        }
+
+    def build(self) -> Donor:
+        donor_data: dict = self.donor_data.copy()
+
+        address: dict | None = donor_data.pop("address", None)
+        cnp: str | None = donor_data.pop("cnp", None)
+
+        donor: Donor = Donor(**donor_data)
+
+        if address is not None:
+            donor.set_address_helper(**address)
+        if cnp is not None:
+            donor.set_cnp(cnp)
+
+        donor.save()
+
+        donor.pdf_file = File(create_full_pdf(donor))
+
+        return donor
+
+    def with_all_fields(self) -> "DonorTestBuilder":
+        return (
+            self.with_first_name()
+            .with_last_name()
+            .with_initial()
+            .with_cnp()
+            .with_city()
+            .with_county()
+            .with_address()
+            .with_phone()
+            .with_email()
+            .with_geoip()
+            .with_misc()
+        )
+
+    def with_first_name(self, first_name: str = None) -> "DonorTestBuilder":
+        self.donor_data["f_name"] = first_name if first_name else faker.first_name()
+
+        return self
+
+    def with_last_name(self, last_name: str = None) -> "DonorTestBuilder":
+        self.donor_data["l_name"] = last_name if last_name else faker.last_name()
+
+        return self
+
+    def with_initial(self, initial: str = None) -> "DonorTestBuilder":
+        self.donor_data["initial"] = initial if initial else faker.random_uppercase_letter()
+
+        return self
+
+    def with_cnp(self, cnp: str = None) -> "DonorTestBuilder":
+        self.donor_data["cnp"] = cnp if cnp else faker.ssn()
+
+        return self
+
+    def with_city(self, city: str = None) -> "DonorTestBuilder":
+        self.donor_data["city"] = city if city else faker.city()
+
+        return self
+
+    def with_county(self, county: str = None) -> "DonorTestBuilder":
+        self.donor_data["county"] = county if county else faker.state()
+
+        return self
+
+    def with_address(self, address: dict[str, str] = None) -> "DonorTestBuilder":
+        if address is None:
+            address = {
+                "street_name": faker.street_name(),
+                "street_number": faker.building_number(),
+            }
+            if faker.boolean(chance_of_getting_true=40):
+                address["street_bl"] = faker.building_number()
+            if faker.boolean(chance_of_getting_true=40):
+                address["street_sc"] = faker.building_number()
+            if faker.boolean(chance_of_getting_true=40):
+                address["street_et"] = faker.building_number()
+            if faker.boolean(chance_of_getting_true=40):
+                address["street_ap"] = faker.building_number()
+
+        self.donor_data["address"] = address
+
+        return self
+
+    def with_phone(self, phone: str = None) -> "DonorTestBuilder":
+        self.donor_data["phone"] = phone if phone else faker.phone_number()
+
+        return self
+
+    def with_email(self, email: str = None) -> "DonorTestBuilder":
+        self.donor_data["email"] = email if email else faker.email()
+
+        return self
+
+    def with_geoip(self, geoip: dict[str, Any] = None) -> "DonorTestBuilder":
+        if geoip is None:
+            geoip = {
+                "ip": faker.ipv4(),
+                "country": faker.country(),
+                "city": faker.city(),
+                "latitude": float(faker.latitude()),
+                "longitude": float(faker.longitude()),
+            }
+
+        self.donor_data["geoip"] = geoip
+
+        return self
+
+    def with_misc(
+        self,
+        *,
+        is_anonymous: bool = None,
+        anaf_gdpr: bool = None,
+        two_years: bool = None,
+        has_signed: bool = None,
+        income_type: str = None,
+    ):
+        if is_anonymous is None:
+            is_anonymous = random.choice([True, False])
+        if anaf_gdpr is None:
+            anaf_gdpr = random.choice([True, False])
+        if two_years is None:
+            two_years = random.choice([True, False])
+        if has_signed is None:
+            has_signed = random.choice([True, False])
+        if income_type is None:
+            income_type = random.choice(["wage", "pension"])
+
+        misc_data: dict[str, bool | str] = {
+            "is_anonymous": is_anonymous,
+            "anaf_gdpr": anaf_gdpr,
+            "two_years": two_years,
+            "has_signed": has_signed,
+            "income_type": income_type,
+        }
+        self.donor_data.update(misc_data)
+
+        return self
diff --git a/backend/donations/tests/test_donor_anonymization.py b/backend/donations/tests/test_donor_anonymization.py
new file mode 100644
index 000000000..1595df275
--- /dev/null
+++ b/backend/donations/tests/test_donor_anonymization.py
@@ -0,0 +1,40 @@
+from django.test import TestCase
+from faker import Faker
+
+from donations.models import Cause, Donor, Ngo
+from donations.tests.builder import DonorTestBuilder
+
+faker = Faker("ro_RO")
+
+
+class DonorAnonymizationTestCase(TestCase):
+    def setUp(self):
+        self.ngo = Ngo.objects.create(
+            name="Test NGO",
+            registration_number=faker.vat_id(),
+            address="123 Test St, Test City",
+        )
+        self.cause = Cause.objects.create(
+            ngo=self.ngo,
+            name="Test Cause",
+            description="A cause for testing purposes.",
+        )
+
+    def test_full_donor_anonymization(self):
+        donor: Donor = DonorTestBuilder(cause=self.cause).with_all_fields().build()
+
+        self.assertNotEqual(donor.email, "")
+        self.assertNotEqual(donor.f_name, "")
+        self.assertNotEqual(donor.l_name, "")
+        self.assertNotEqual(donor.initial, "")
+        self.assertNotEqual(donor.get_cnp(), "")
+
+        donor.remove_personal_data(commit=True)
+
+        donor.refresh_from_db()
+
+        self.assertEqual(donor.email, "")
+        self.assertEqual(donor.f_name, "")
+        self.assertEqual(donor.l_name, "")
+        self.assertEqual(donor.initial, "")
+        self.assertEqual(donor.get_cnp(), "")

From 93508ad6fe71d5cf06b8a119a4e4a67d35c6d82d Mon Sep 17 00:00:00 2001
From: Tudor Amariei <tudor.amariei@commitglobal.org>
Date: Wed, 21 Jan 2026 17:14:03 +0200
Subject: [PATCH 5/5] fin

---
 backend/donations/admin/donors.py             | 14 ++++++++---
 .../management/commands/generate_donations.py |  3 +--
 backend/donations/models/donors.py            | 11 ++++-----
 backend/donations/tests/builder.py            |  3 ++-
 .../tests/test_donor_anonymization.py         | 23 +++++++++++++++++--
 5 files changed, 40 insertions(+), 14 deletions(-)

diff --git a/backend/donations/admin/donors.py b/backend/donations/admin/donors.py
index 927cb76d3..7e9a98182 100644
--- a/backend/donations/admin/donors.py
+++ b/backend/donations/admin/donors.py
@@ -14,7 +14,6 @@
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import ngettext_lazy
-from gevent.libev.watcher import async_
 from unfold.admin import ModelAdmin
 from unfold.contrib.filters.admin import RangeDateFilter, TextFilter
 from unfold.dataclasses import UnfoldAction
@@ -148,8 +147,6 @@ def remove_personal_data_in_bulk(selected_donors: QuerySet[Donor]):
 
     base_donor_qs: QuerySet[Donor] = Donor.objects.filter(personal_data_removal_started_at__isnull=True)
 
-    # XXX: NO
-    remove_personal_data_in_bulk(Donor.objects.all())
     remove_personal_data_in_bulk(base_donor_qs.filter(date_created__date__lte=two_years_ago_date))
     remove_personal_data_in_bulk(base_donor_qs.filter(two_years=False, date_created__lte=one_year_ago_date))
 
@@ -319,6 +316,17 @@ def anonymize_bulk_donations(self, request, queryset: QuerySet[Donor]):
         task_results = {TASK_SUCCESS_FLAG: 0, TASK_FAILURE_FLAG: 0, TASK_SCHEDULED_FLAG: 0}
 
         queryset_size: int = queryset.count()
+        if queryset_size > 100:
+            self.message_user(
+                request,
+                message=_(
+                    "Anonymizing a large number of redirections is not allowed via bulk action. "
+                    "This action should be done through a scheduled task or specific actions."
+                ),
+                level=messages.ERROR,
+            )
+            return
+
         for donor in queryset:
             task_result: str = remove_personal_data(donor)
             task_results[task_result] += 1
diff --git a/backend/donations/management/commands/generate_donations.py b/backend/donations/management/commands/generate_donations.py
index f675c598f..6263c4488 100644
--- a/backend/donations/management/commands/generate_donations.py
+++ b/backend/donations/management/commands/generate_donations.py
@@ -1,7 +1,6 @@
 import random
 import string
 
-from django.core.files import File
 from django.core.management import BaseCommand
 from django.db.models import QuerySet
 from django_q.tasks import async_task
@@ -18,7 +17,7 @@
 
 def _generate_pdf_for_donor(donor_pk: int):
     selected_donor: Donor = Donor.objects.get(pk=donor_pk)
-    selected_donor.pdf_file = File(create_full_pdf(selected_donor))
+    selected_donor.pdf_file = create_full_pdf(selected_donor)
     selected_donor.save()
 
 
diff --git a/backend/donations/models/donors.py b/backend/donations/models/donors.py
index bcce77ba9..164ab108d 100644
--- a/backend/donations/models/donors.py
+++ b/backend/donations/models/donors.py
@@ -194,12 +194,10 @@ def disable(self, commit: bool = True):
         if commit:
             self.save()
 
-    def remove_personal_data(self, commit: bool = True):
+    def remove_personal_data(self):
         if not self.personal_data_removal_started_at:
             self.personal_data_removal_started_at = timezone.now()
 
-        self.personal_data_removed_at = timezone.now()
-
         self.l_name = ""
         self.f_name = ""
         self.initial = ""
@@ -212,11 +210,12 @@ def remove_personal_data(self, commit: bool = True):
 
         self.geoip = {}
 
-        self.pdf_file.delete(save=commit)
+        self.pdf_file.delete()
         self.filename = ""
 
-        if commit:
-            self.save()
+        self.personal_data_removed_at = timezone.now()
+
+        self.save()
 
     def set_cnp(self, cnp: str):
         self.encrypted_cnp = self.encrypt_cnp(cnp)
diff --git a/backend/donations/tests/builder.py b/backend/donations/tests/builder.py
index 679d79d86..cb29ab5b1 100644
--- a/backend/donations/tests/builder.py
+++ b/backend/donations/tests/builder.py
@@ -33,7 +33,8 @@ def build(self) -> Donor:
 
         donor.save()
 
-        donor.pdf_file = File(create_full_pdf(donor))
+        pdf = create_full_pdf(donor)
+        donor.pdf_file.save(f"donor_{donor.pk}.pdf", File(pdf))
 
         return donor
 
diff --git a/backend/donations/tests/test_donor_anonymization.py b/backend/donations/tests/test_donor_anonymization.py
index 1595df275..7d97625d3 100644
--- a/backend/donations/tests/test_donor_anonymization.py
+++ b/backend/donations/tests/test_donor_anonymization.py
@@ -23,13 +23,22 @@ def setUp(self):
     def test_full_donor_anonymization(self):
         donor: Donor = DonorTestBuilder(cause=self.cause).with_all_fields().build()
 
-        self.assertNotEqual(donor.email, "")
         self.assertNotEqual(donor.f_name, "")
         self.assertNotEqual(donor.l_name, "")
         self.assertNotEqual(donor.initial, "")
         self.assertNotEqual(donor.get_cnp(), "")
 
-        donor.remove_personal_data(commit=True)
+        self.assertNotEqual(donor.city, "")
+        self.assertNotEqual(donor.county, "")
+
+        self.assertNotEqual(donor.phone, "")
+        self.assertNotEqual(donor.email, "")
+
+        self.assertNotEqual(donor.geoip, {})
+
+        self.assertNotEqual(donor.pdf_file.name, "")
+
+        donor.remove_personal_data()
 
         donor.refresh_from_db()
 
@@ -38,3 +47,13 @@ def test_full_donor_anonymization(self):
         self.assertEqual(donor.l_name, "")
         self.assertEqual(donor.initial, "")
         self.assertEqual(donor.get_cnp(), "")
+
+        self.assertNotEqual(donor.city, "")
+        self.assertNotEqual(donor.county, "")
+
+        self.assertEqual(donor.phone, "")
+        self.assertEqual(donor.email, "")
+
+        self.assertEqual(donor.geoip, {})
+
+        self.assertEqual(donor.pdf_file.name, "")