Databonds data protection breach warning

EnglishWelshie

I entered a Databonds competion last year and won a £25 giftcard. I had an email to sign up for their shopping app where it says that they will ask for my data on my behalf. I ticked the places I shop with but never filled in any information for any of the stores to authorise them as I couldn't be certain I could trust them with this information all are showing on my account as needing information and are not verified.

I have just received an email this morning from John Lewis to say that Databonds have requested a copy of my shopping history. Luckily they have informed me and wanted proof of my ID to be able to pass on my data so I could stop them from receiving it but who knows who else they have contacted.

John Lewis have emailed me the link to complain for data breach which I am going to do but for anyone who has signed up it may be worth keeping an eye on things if you haven't given them that authorisation.

topaz13

I signed up to it, input my password to log in and it says password not recognised. Reset the password, go to log in and it still says password not recognised, so I just gave up with it. If they can't be trusted to get their log in working, then I don't trust them with anything else!

EnglishWelshie

I received an email back from them saying that when I ticked the boxes of who I shop with I gave them the authority to search and do a sars on my behalf. I have responded and pointed out that it states that by opening a databonds account and ticking their box I authorize them to make data portability and subject access requests on my behalf to each of the retailers, brands, and other organizations where I provide loyalty card or online account details and to repeat the requests at regular intervals to ensure that I always have access to the most up-to-date information about my shopping habits yet there have been no account details or loyalty card details provided to them to give them the authority to contact anyone on my behalf. I also sent them screenshots of their t&c's stating this and of my account showing that no accounts had been verified and all needed extra information that I hadn't given

They have responded to me to say appreciate the feedback and will revisit the language within the authorisation and make sure it more clearly represents our terms and conditions. That they have not received any data and only hold the data I signed up with. That other retailers may contact me on their behalf to verify as they have sent requests to everyone that I ticked. To let them know how I wish to proceed if I want them to delete my personal information or I can delete my account myself. 

They have not even offered an apology when contacting me. I have now deleted my account with them and just hope that they have deleted all information as they said they would and that none of the companies I ticked give them any information that they requested.