Data Deletion Request Policy

Short description: This policy explains how verified individuals (or authorized agents) can request deletion of personal data or account closure with Tanqory. It covers scope, legal grounds, verification, security controls, timelines, exclusions, cross-border considerations, backups, and appeal rights, aligned with GDPR/UK GDPR (Right to Erasure), Singapore PDPA, and applicable U.S. state laws (e.g., CPRA).

1) Purpose and scope (Purpose & Scope)

This policy sets out how Tanqory handles requests to delete personal data or close accounts across all regions where we operate. It covers three categories of personal data: (1) data you directly provide (e.g., profile, store settings, messages, uploads); (2) data observed from your use of our services (e.g., activity logs, device/browser signals, API calls tied to your keys); and (3) derived data where disclosure and deletion are legally permissible (e.g., risk scores or segmentation that identify you). We align with GDPR/UK GDPR Art. 17 (Right to Erasure), Singapore PDPA erasure provisions, and U.S. state laws with deletion rights (e.g., CPRA/CCPA). Requests may be made by verified users or duly authorized agents with valid authority.

What is in scope: personal data linked to your account that is not under a legal or contractual retention obligation, including marketing identifiers, account/workspace/store/domain configurations, user-generated content under your control, and usage telemetry tied to you. What is out of scope: data that must be retained for statutory compliance (tax, accounting, financial transactions, anti-money laundering), records needed to establish/exercise/defend legal claims, fraud-prevention and security signals where deletion would materially weaken protections, content that embeds other individuals’ data that cannot be separated without infringing their rights, and proprietary/confidential materials where full deletion is not legally required (we minimize/pseudonymize instead). Backups are excluded from immediate purge but are sequestered from production and age out on a fixed schedule; if a restore is legally required, we will re-apply deletion promptly afterward.

Cross-border and processor scope: where personal data is transferred internationally under safeguards (e.g., SCCs, UK IDTA/Addendum, BCRs), we extend deletion instructions to processors and relevant recipients consistent with contracts and legal feasibility, and we record any exceptions with reasons. If you request it, we can describe the applicable safeguards and categories of recipients notified. The English version controls; we will update this policy when laws, platform requirements, or retention obligations change and will communicate material updates. This section should be read together with the exclusions, timelines, and appeal rights below.

2) Rights and guiding principles (Rights & Principles)

• Right to request deletion: You may request deletion of personal data we hold about you, subject to legal/contractual exemptions. Grounds under GDPR/UK GDPR Art. 17 include: data no longer needed for stated purposes; withdrawal of consent where no other legal basis applies; successful objection to processing; unlawful processing; legal obligation to erase; and data collected from a child in relation to information society services.
• Legal exemptions: We may retain data required for legal obligations (tax, accounting, financial audits), regulatory inquiries, fraud prevention/security, exercise or defense of legal claims, or protection of others’ rights.
• Accuracy and minimization: We delete, redact, anonymize, or pseudonymize data to the fullest extent allowed, while preserving only what must be retained.
• Transparency: If we cannot delete some data, we explain why, the lawful basis, and applicable retention period or criteria.
• Impact awareness: Deletion may affect service access, features, or historical records. Some items in backup systems delete on a schedule; we will sequester and prevent reuse in production until expiry.
• Non-discrimination: We do not penalize you for exercising deletion rights, subject to lawful exceptions.

3) How to submit and how we verify (Channels & Verification)

• Where to submit: Email privacy@tanqory.com with the subject "Data Deletion Request" (primary channel). A self-service web portal is on Tanqory's data-rights roadmap; until it launches, all deletion requests are handled manually by the Privacy team with the statutory timelines below.
• Information to include: Sign-up email, scope (e.g., full account deletion, marketing data only), and whether you also want a data access/portability export before deletion.
• Identity verification: MFA plus checks against registered email/phone. Higher-risk cases may require additional proof (e.g., government ID, proof of domain control) to prevent misdelivery or malicious deletion.
• Authorized agents: Provide (a) valid power of attorney or signed authorization, (b) identification for the account holder, and (c) identification for the agent. Incomplete or inconsistent documents will pause or deny the request with reasons.
• Status communications: We communicate status and outcomes to verified channels only. We keep verification evidence and audit trails for each request.

4) What we delete and key exclusions (Deletion Scope & Exclusions)

We delete or de-identify (where legally allowed): account profile and preferences; account/workspace/store/domain settings; support interactions linked to you; usage and activity records tied to your account; identifiable marketing records; and other personal data linked to your account that is not subject to a legal retention mandate. We also target:

• User-generated content within your control: storefront copy or assets you own, product catalog data you uploaded, and custom templates you created—except where deletion would impair other users’ rights or shared workspaces; in such cases we redact or decouple your identifiers.
• Security/operational logs tied to you: abbreviated login records, device/browser fingerprints, API usage attributable to your keys, and configuration-change history, with redaction of third-party IP/device data where necessary.
• Billing artifacts: receipts and invoices linked to you that are not legally required beyond accounting retention windows; payment methods are tokenized by processors, and we delete our references to them where permitted.
• Marketing/communications: email/SMS/push consents, campaign participation, and attribution events that identify you; we also propagate unsubscribe/opt-out across systems before deletion to prevent reactivation.
• Integrations you connected: app connections, OAuth tokens, webhooks, and scopes tied to your account; we revoke tokens and purge related metadata where not legally required for fraud/audit retention.

Retention and exclusion highlights:

• Legal/contractual retention: accounting/tax/financial records, lawful audit trails, legal holds, regulatory inquiries, chargeback/fraud evidence, and logs needed to establish, exercise, or defend claims. These are retained only as long as required, then purged.
• Third-party personal data: content that would reveal other individuals (buyers, staff, collaborators) where separation is infeasible; we redact/summarize rather than delete if deletion would infringe their rights.
• Security and fraud controls: signals, models, and event data used to prevent abuse may be retained in minimal form where deletion would materially weaken protections or violate legal obligations.
• Intellectual property/confidential information: proprietary algorithms, internal security controls, and confidential business data are not deleted unless legally required; we minimize/pseudonymize user-linked elements instead.
• Backups and disaster recovery: data in backups is not used in production and will age out on scheduled retention (e.g., 30–90 days). If a restore is legally necessary, we will re-apply deletion promptly after restoration.

Cross-entity and processor coordination: When deletion applies, we instruct processors and relevant recipients to delete or restrict processing, consistent with contracts and GDPR/UK GDPR Art. 19. This includes international locations under SCCs/IDTA/BCRs; we extend deletion requests to those environments subject to legal and technical feasibility and report exceptions with reasons.

We retain or limit deletion when:

• Law or contract requires retention (e.g., tax, accounting, financial transaction, anti-fraud/audit logs, legal holds, regulatory inquiries).
• Data contains third-party personal data that cannot be separated without infringing their rights (we will redact/summarize where possible).
• Data is necessary to establish, exercise, or defend legal claims, or to protect security and fraud controls.
• Data is part of proprietary intellectual property or confidential business information where full disclosure or deletion is not legally required; we minimize or pseudonymize instead.
• Data resides in backups; it will age out on the retention schedule and is not used in production absent security/legal necessity.

5) Outcomes, confirmations, and pre-deletion exports (Outcome & Confirmation)

• Confirmation: We send a completion notice to your verified email summarizing what was deleted, what was retained, and the legal bases/retention periods for any retained items.
• Pre-deletion exports: If you want copies before deletion, submit access/portability requests together with clear sequencing (export first, then delete).
• Service impact: Deletion may disable access to services, features, or historical dashboards. Account closure follows the Terms of Service/Terms of Sale.
• Backups: We note backup retention windows and commit that backup data is sequestered and not reintroduced to production except for lawful security/continuity needs.

6) Timelines and service levels (Timelines & SLA)

• Acknowledgment: We aim to acknowledge within 7 calendar days.
• Fulfillment: Target completion within 30 calendar days after verification, unless a shorter legal deadline applies. Under GDPR/UK GDPR we may extend by up to 2 months for complex requests, with reasons provided.
• U.S. states (e.g., CPRA/CCPA): We target completion within 45 days and may extend once by an additional 45 days where reasonably necessary, with notice explaining the reason.
• Enterprise contracts: Order-form SLAs supersede this baseline for covered services.
• Status updates: Provided for complex cases (e.g., legal holds, large data volumes, multi-region backups).
• Fees/denials: Manifestly unfounded, excessive, or repetitive requests may incur lawful fees or be denied; we provide written rationale.

SLA summary

7) Security and third-party protection (Security & Third-Party Protection)

• MFA-based verification and role-based approvals precede any deletion.
• Audit trails cover request intake, verification, approvals/denials, and deletion actions.
• Data in transit and at rest is encrypted (e.g., TLS, AES-256).
• We redact/summarize to avoid disclosing third-party data.
• Suspicious requests (phishing, impersonation, anomalous patterns) may be paused or denied with reasons.
• Least-privilege access applies to teams handling deletion and backups.
• Backup environments remain isolated from production except for lawful restoration/security purposes.

8) Service impact, cross-border data, and backups (Service Impact, Cross-Border, Backups)

• Service impact: Deletion may end access to services/features and remove historical data from dashboards. Account termination follows the Terms of Service/Terms of Sale.
• Cross-border data: Where personal data is transferred across borders, we apply applicable safeguards (e.g., SCCs, UK IDTA/Addendum, BCRs). On deletion, we extend the deletion/redaction to relevant processors and international locations consistent with contracts and law. We can describe the safeguards upon request.
• Backups: Backup data is not processed for production purposes and will be purged automatically per the retention schedule. If a restore is legally required, we will re-apply deletion as soon as practicable after restoration.

9) Appeals and limitations (Appeals & Limitations)

• Appeals: Email privacy@tanqory.com within 30 days with your request ID and reasons. We target review within 15 business days and will notify if more time is needed.
• Escalation to regulators: If unresolved, you may contact the relevant supervisory authority (e.g., EU/UK/SG DPA or applicable U.S. state regulator). We provide contact details on request.
• Options when limited: If law/contract prevents full deletion, we explain the basis and, where possible, offer alternatives (redaction, summary, delayed deletion when retention expires). We will also notify relevant processors/recipients to delete or restrict processing consistent with Art. 19 GDPR/UK GDPR and can share recipient categories on request.

10) Recordkeeping and audit (Recordkeeping & Audit)

• We log requests, verification steps, approvals/denials, deletion actions, retained items with legal bases, status updates, notifications sent to processors/recipients, and backup handling (including re-applying deletions after any restoration).
• Records are retained for at least 3–5 years or longer if required by law, contract, or litigation hold, with encrypted, role-based access.
• We review this process under our ISMS and, where applicable, SOC 2 controls, and track remediation.
• Changes to deletion tooling/process are tested and documented before production use.

11) Policy updates and language (Policy Updates)

• Reviewed at least annually, or sooner if laws, platform requirements, audits, or security events require changes.
• Significant updates appear at https://legal.tanqory.com and via registered email; we note effective date, version, and a summary of changes.
• The English version is authoritative; translations are for convenience.
• Questions: privacy@tanqory.com.

---

Appendix A: Examples of data we delete, limit, or retain

• Delete/de-identify: account profile (name/email/verified phone), account/store/domain settings, identifiable marketing records, support interactions tied to the requester, usage/activity logs tied to the requester.
• Redact/summarize: records containing third-party data (e.g., shared support threads), activity logs that expose others’ IP/device details.
• Retain (legal/contractual): accounting/tax/financial transaction records; fraud-prevention and security logs; records under legal hold or court order; data needed to establish, exercise, or defend legal claims.
• Backups: purged on scheduled retention (e.g., application DB ~30 days, file/email ~60 days, infrastructure snapshots ~90 days) and not reused in production except for legal/security necessity. Contractual or local-law requirements may adjust durations; we will communicate material changes.

Appendix B: Sample reasons for denial/deferral

• Manifestly unfounded, excessive, or repetitive requests under applicable law.
• Data required to meet legal obligations, court orders, or enforcement of legal rights.
• Data that would infringe others’ rights and cannot be separated.
• Inadequate identity or authorization documentation (including POA/ID mismatch).
• Data under active security/fraud investigation or legal hold.
• U.S. state-law exceptions (e.g., CPRA/CCPA): completing transactions requested by the consumer; security and fraud prevention; debugging/repairing errors; exercising free speech or ensuring others’ free speech; internal uses reasonably aligned with consumer expectations; compliance with legal obligations.

Appendix C: Additional requirements (U.S. states and other regions)

• For U.S. state laws with deletion and “Do Not Sell/Share/Targeted Advertising” rights (e.g., CPRA, CPA), Tanqory offers a “Do Not Sell/Share” opt-out and honors Global Privacy Control (GPC) signals for in-scope accounts.
• If new state/country laws add deletion or transfer requirements, we will update this appendix and notify via dashboard/registered email.
• For enterprise customers, binding SLAs and any specific deletion commitments are governed by the Order Form/contract addenda referenced therein.

---

Glossary

• MFA (Multi-Factor Authentication): Authentication using two or more factors.
• POA (Power of Attorney): Written authorization for an agent to act on behalf of the account holder.
• TLS (Transport Layer Security): Protocol for encrypting data in transit.
• AES (Advanced Encryption Standard): Standard for encrypting data at rest or in transit.
• ISMS (Information Security Management System): Framework for managing information security risks.
• SOC 2: Audit framework covering security, availability, confidentiality, processing integrity, and privacy controls.
• DPA (Data Protection Authority): Government authority overseeing data protection laws.
• Retention: Time period for which data must be kept by law or contract.
• Backups: Non-production copies of data held for continuity and security; not used in production unless required.