Effective Date: 01.06.2025
Version: 1.0

1. Introduction

EraseMe Ltd (“EraseMe”, “we”, “us”, “our”) is committed to full compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and the Data Protection Act 2018. As a company providing GDPR data erasure facilitation services under Article 17 (Right to Erasure), we operate with privacy, transparency, and data minimisation at the core of our operations.

This policy outlines our responsibilities, procedures, and client rights in connection with the collection, use, retention, and protection of personal data in the context of our business activities.

2. Scope

This policy applies to all personal data collected, processed, or retained by EraseMe Ltd in the course of delivering services, including but not limited to:

• Data Subject Erasure Requests under Article 17
• Data Subject Access Requests (DSARs)
• Online reputation monitoring
• Customer communications
• Client verification
• Payments and subscription services

3. Lawful Basis for Processing

EraseMe Ltd ensures all personal data is processed lawfully, fairly, and transparently under one or more of the following legal bases as per Article 6 of the GDPR:

• Consent – where the data subject has given clear and explicit permission.
• Contractual Obligation – where processing is necessary to fulfil our contract with the data subject.
• Legal Obligation – where required by legal or regulatory responsibilities.
• Legitimate Interest – where processing is necessary for EraseMe’s legitimate business interests, provided such interests are not overridden by the data subject’s rights and freedoms.

We always document the applicable lawful basis for each category of data processing.

4. Data Collection and Categories

We collect and process personal data strictly on a need-to-know basis, limited to the minimum necessary to achieve the purpose of the service.

Data categories may include:

• Identity Data: Name, date of birth, ID documents, national insurance number (if required)
• Contact Data: Email, phone number, physical address
• Service Data: URLs or sources containing personal information to be erased, search results, screenshots
• Verification Data: Power of attorney, written authorisations, or proof of identity
• Payment Data: Limited billing details where required (processed securely by a third-party provider)
• Technical Data: IP address, browser type, operating system, usage patterns via cookies (see Cookie Policy)

We do not collect sensitive special category data (e.g., medical, political, religious) unless explicitly required for a specific erasure case and provided voluntarily by the data subject.

5. Purpose Limitation and Use of Data

We process data only for the specific, explicit, and legitimate purposes defined at the time of collection, including:

• Facilitating Article 17 erasure or DSAR requests on behalf of clients
• Communicating with clients about their ongoing or completed cases
• Monitoring and reporting on digital presence if subscribed
• Verifying client identity or authority to act on another person’s behalf
• Meeting contractual and legal obligations

We do not use data for profiling, marketing, automated decision-making, or any unrelated third-party advertising.

6. Data Sharing and Transfers

We do not sell or rent personal data under any circumstances.

We may share data with the following entities, strictly on a need-to-know and case-by-case basis:

• Third-party data controllers (e.g., websites, companies, or platforms holding client data) as required to fulfil erasure requests.
• Professional service providers, such as payment processors, identity verification platforms, or IT/cloud storage vendors, operating under data processing agreements.
• Governmental or legal authorities, only when legally required (e.g., for fraud prevention, law enforcement, or legal proceedings).

International Transfers:

Where it is necessary to transfer personal data outside of the UK or EEA (for example, when contacting non-UK data controllers), we ensure adequate safeguards are in place in accordance with Chapter V of the GDPR. These include:

• Standard Contractual Clauses (SCCs)
• Transfers to countries with an EU/UK adequacy decision
• Contractual safeguards and binding corporate rules where applicable

7. Data Retention and Deletion

EraseMe Ltd operates a strict data minimisation and retention policy in accordance with Article 5(1)(e) of the GDPR.

• We retain personal data only for the minimum period necessary to complete the service and handle related communications.
• Once the data erasure request is concluded and a final confirmation is issued to the client, all personal data is securely and irreversibly deleted from our systems unless a longer retention period is legally required.
• Anonymised or non-identifiable data may be retained for statistical, internal, or audit purposes, but cannot be linked to any individual.

If deletion is delayed due to technical, operational, or legal reasons, we ensure continued secure storage and limited access.

8. Data Security

We implement appropriate technical and organisational measures to ensure data integrity, availability, and confidentiality, including:

• Encrypted storage and secure HTTPS communications
• Password-protected platforms and multi-factor authentication (MFA)
• Role-based access control for staff and contractors
• Regular vulnerability scans and audits
• Secure deletion tools with verifiable logs
• Staff training and strict confidentiality contracts

Despite our best efforts, no online system can be 100% secure. Clients acknowledge and accept this inherent risk when sharing data.

9. Client Rights under GDPR

EraseMe Ltd fully respects and facilitates the rights of data subjects under Chapter III of the GDPR. These include:

• Right to Access (Art. 15): Obtain a copy of personal data we hold.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of data, which is the core service we provide.
• Right to Restrict Processing (Art. 18): Temporarily limit use of your data under certain conditions.
• Right to Data Portability (Art. 20): Request data in a structured, commonly used format.
• Right to Object (Art. 21): Object to certain types of processing.
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time without affecting prior processing.

Clients may exercise any of these rights by contacting us at privacy@eraseme.co.uk. We will respond within the statutory period of one month, with the right to extend by two additional months in complex cases.

10. Children’s Data

Our services are not designed for or directed at individuals under 18 years old. We do not knowingly collect or process data relating to minors. If such data is inadvertently collected, it will be deleted promptly.

11. Accountability and Documentation

EraseMe maintains detailed internal records of:

• Lawful basis for all processing activities
• All erasure requests submitted on behalf of clients
• Client consent and authorisation documentation
• Data breaches or incidents (if any), with documentation and reporting in line with Articles 33 and 34

12. Data Breaches

In the event of a personal data breach, EraseMe Ltd will:

• Assess the risk to individuals’ rights and freedoms
• Notify the ICO within 72 hours if the breach is notifiable
• Notify affected individuals without undue delay, where required
• Document the nature, scope, and outcome of the breach internally

13. Complaints and Supervisory Authority

If you are dissatisfied with how we handle your data or a rights request, you may lodge a complaint with:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113

You may also contact us directly to resolve the matter:

EraseMe Ltd
Email: privacy@eraseme.co.uk

14. Changes to This Policy

We reserve the right to amend this policy at any time to reflect changes in law, regulation, or business practices. Updated versions will be published on our website, and significant changes will be communicated via email or pop-up notification.

Clients are encouraged to review this policy periodically to stay informed of their rights and our obligations.

15. Contact Us

For all data protection-related enquiries, including exercising your rights or requesting information, please contact:

Data Protection Lead – EraseMe Ltd
Email: privacy@eraseme.co.uk

By using our services or providing personal information, you acknowledge that you have read, understood, and agreed to the terms of this GDPR Compliance Policy.

Suggested text: Our website address is: https://eraseme.co.uk.