Well that’s fresh. But if the user data is anonymized, it’s OK, right? I’m assuming there isn’t any other PII.
Well depends on how you define PII
> name, address, credit card, etc.
PSA: HelloFresh doesn't delete data when asked, only changes the email address
31–40 of 54 posts
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#32I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.
If it really keeps credit card details, that’s way more than just a tombstone.
(Asking out of ignorance, I don’t know how this works)
Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#33Earlier quoted context omitted.
If it really keeps credit card details, that’s way more than just a tombstone.
(Asking out of ignorance, I don’t know how this works) Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
They could mail a check.. oops now they need your mailing address
Or they could call you and ask.. oops now they need your phone number
etc
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#34Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the…
You could probably add something like #23 to the end of your street address and still get it.
For gmail and fastmail, you can use jim+xyz@gmail.com and change the xyz for every new email signup.
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#35That is not news. That is how most of the industry works.
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#36Earlier quoted context omitted.
If it really keeps credit card details, that’s way more than just a tombstone.
(Asking out of ignorance, I don’t know how this works) Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#37I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.
You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it.
No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they're just moving it to be inaccessible to the user.
They keep the data. And that's a) scummy and b) illegal in several jurisdictions.
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#38Also worth noting that if you're using them to hit your 5:2 fast day calories, the nutritional information on their recipe cards is junk. They might have been accurate once upon a time, but I suspect they sub ingredients and suppliers out as the prices change. The "splash of oil" is hilarious. 100kcal a go.
Convenient and interesting as they are, you have to do your own maths and adjust portion sizes accordingly. By the time you've done that, it's easier to just cook something you're used to cooking @500kcal.
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#39Sadly many companies do the same thing, violating the GDPR, even EU-based companies who know better. I wonder if engineers who built and have knowledge of these systems could anonymously disclose/leak details of violations to a site pairing them with other engineers. The other engineers could submit a GDPR forget-me request, which the company wouldn't be able to fulfil, and then people could complain to the national…
The lawyers we consulted said the biggest risk for a company without many individual customers was their own employees.
A disgruntled former employee makes a GDPR request, etc.
Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address
#40Earlier quoted context omitted.
Article 17 of the GDPR would disagree. """ “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month. """
Does that include data contained in their x years of backups?
Yes, so it's important to distinguish between backups and archives.
If you're keeping data for years, it's an archive and not a backup.