PSA: HelloFresh doesn't delete data when asked, only changes the email address

Post by SpikeDad » Thu, May 26, 2022, 11:45 PM UTC

nerdjon wrote: post #13

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the…

Post by otterley » Fri, May 27, 2022, 1:13 AM UTC

oliwarner wrote: post #37

closeparen wrote: post #23

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it. No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they'…

Post by brokenmachine » Fri, May 27, 2022, 4:30 AM UTC

prirun wrote: post #34

nerdjon wrote: post #13

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the…

You could probably add something like #23 to the end of your street address and still get it. For gmail and fastmail, you can use jim+xyz@gmail.com and change the xyz for every new email signup.

Post by edmundsauto » Fri, May 27, 2022, 5:24 AM UTC

oliwarner wrote: post #37

closeparen wrote: post #23

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it. No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they'…

Post by oliwarner » Fri, May 27, 2022, 6:01 AM UTC

otterley wrote: post #43

oliwarner wrote: post #37

Earlier quoted context omitted.

You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it. No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they'…

If the records no longer contain PII, then they've arguably satisfied their duties under the law, haven't they? Has a court held otherwise?