GDPR

theonlywayisup

Apologies as not sure where to place this.

I ordered a widget from a company.  The widget arrived damaged.  The company were advised and whilst admitted the damage they disputed it could be damaged.  The item was returned.  

The company had the item for 15 days and had not refunded or acknowledged the [tracked] return.  I sent an email enquiring and 4 days later I have had a reply showing a refund and giving instructions to log into my account to confirm the refund.  

The online account I had set up to order has been disabled, so I have no access to the invoice, order or the refund now given. 

I am not worried about the refund, it will come, either via S75 or the pledge from the company.  My issue is with any info they have on me that I don't have access to since they disabled the account. 

I would rather the matter end here - I have no reason to ask this company why their practices are so, but I would definitely want my details redacted.  What is the best course of action, presuming a simple request won't suffice.  Is there a GDPR format I can follow to ensure this happens.

Sandtree

If you google GDPR "right of erasure" template letter you will find several different options out there. The GDPR legislation isn't prescriptive of how it needs to be done.


Remember that there are grounds on which the request can be refused and if you have an on going dispute it may well be considered reasonable for them to refuse so that they can retain the appropriate evidence to defend any future claim you make in relation to the sale. 

theonlywayisup

Sandtree said:

If you google GDPR "right of erasure" template letter you will find several different options out there. The GDPR legislation isn't prescriptive of how it needs to be done.


Remember that there are grounds on which the request can be refused and if you have an on going dispute it may well be considered reasonable for them to refuse so that they can retain the appropriate evidence to defend any future claim you make in relation to the sale. 

My intention is not to invoke a GDPR request until the matter is closed, but I wanted to be forewarned.  There is no dispute as such, Just a bizarre reaction from a company that I had researched as reasonable. 

Sandtree

theonlywayisup said:
There is no dispute as such, Just a bizarre reaction from a company that I had researched as reasonable. 

Obviously you've not mentioned the company so no idea if its a one man band or a multi-national corporation but either way even with the best will in the world organisations are staffed with people and people always have the occasional off day or there is the occasional rogue employee.

I've always been a strong believer that you don't judge a company by if they make an error or not (all do occasionally) but how well they recover from it. Hopefully you'll get your issue sorted.

theonlywayisup

Sandtree said:

theonlywayisup said:
There is no dispute as such, Just a bizarre reaction from a company that I had researched as reasonable. 

Obviously you've not mentioned the company so no idea if its a one man band or a multi-national corporation but either way even with the best will in the world organisations are staffed with people and people always have the occasional off day or there is the occasional rogue employee.

I've always been a strong believer that you don't judge a company by if they make an error or not (all do occasionally) but how well they recover from it. Hopefully you'll get your issue sorted.

Although a Ltd company it's a one person band.  As the owner/MD you really should not be having off days but if you do you certainly don't let your customers see it.   I suspect the order/telephone call/sale/refund/whatever before mine wasn't good and I got the brunt.  

Manxman_in_exile

As you are (or have been) a customer, are you sure they don't have a valid justification for keeping your info for up to six years?

Let's say in five years time they discover they have over-refunded you.  They have six years in which they are legally entitled to claim the money back, so they'd need to keep your details (including perhaps information relating to the refund) for up to six years to be able to claim.

Or is it just certain information that would not be relevant to a claim you are concerned about?

Ectophile

Bear in mind that if they think they have a legitimate reason for keeping information about you, then they can.  Your request to be deleted may be rejected.

In particular, if you are claiming that they owe you money, then they cannot delete any information on your account until it's clear that any claim is completely settled.  Since the Limitations Act gives you up to 6 years to make a claim, it could be a long time before they delete your account.

Undervalued

And in the real world how are you going to police this!
Unless they somehow make use of information they shouldn't have retained you have absolutely no means of knowing whether it has been deleted or not.
As others have pointed out, there are valid reason they may be able to rely on to retain some or all of the information in any case.

theonlywayisup

Policing GDPR isn't something for me to do.  

I am a customer, I am still owed the refund, what I disagree with is the account being deleted as there is now no record of my purchase.  As I said, there is no dispute, the company are being purposely tardy for whatever reason as either I have been mistaken for someone else or this is their normal business practice.   Amex have accepted the S75. 

Manxman_in_exile

Ah well.  I think I agree with you about deleting(?) your account if it means there's no longer a record of the purchase.  I thought you were complaining about them retaining your data after they've refunded you.  As above, I think they can keep that for six years.

theonlywayisup

No not complaining about data, that's quite necessary, but if they delete your account that seems a rather peculiar one-sided event.  I shall see what a GDPR request gives, if anything.