Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

README.md

@@ -318,6 +318,21 @@ retention cleaning up old visits can never delete a live profile photo.
 
 Leave the photo blank and they are asked at the kiosk as before.
 
+### Removing someone
+
+**Remove** on the recurring visitors list deletes the saved record for good — the PIN stops
+working, the stored photo is deleted, and their mobile number, email and PIN become available
+for someone else.
+
+Their **visit history is kept**. Visits store the name, contact details and host as their own
+columns, so the log remains a complete record of who was in the building regardless of whether
+the person is still on file. Removing someone who is currently signed in does not sign them out;
+the confirmation says so, and their visit can still be closed with their last name and mobile
+number at the kiosk.
+
+If they might come back, untick **Active** in Edit instead. That keeps the record, the PIN and
+the history, but stops the PIN working at the kiosk.
+
 ### PINs
 
 The mobile number is the username, and the PIN is four digits. PINs are stored encrypted with