Right to Erasure Policy

1. Purpose of the Policy

1.1 The purpose of this document is to outline our policy in relation to the management of ‘right to erasure’ (also known as ‘right to be forgotten’) requests.

1.2 It sets out the right of data subjects to request the removal of personal data held about them, in electronic or hard copy form, by the RDN Group of Companies, including RDN Group Limited, E-Cigarette Direct Limited, Gower Enterprises Limited and Orderly Distribution Limited (each a Group Company and together the RDN Group). It also outlines the procedure to be followed by data subjects when submitting a right to erasure request to a Group Company as well as how the RDN Group handles such requests.

2. Ownership

2.1 The Right to Erasure Policy is maintained by the RDN Group’s Legal Director, who is responsible for leading the team who deal with all ‘right to erasure’ requests received by the organisation. All questions or comments related to this policy or a specific “right to erasure” requests should be directed to the Legal Director.

3. What is personal information?

3.1 Personal information is any data, in both physical and electronic form, related to an identified or identifiable person. It includes anything that can be used to identify a person, directly or indirectly, by means of his or her physical, physiological, mental, economic, cultural or social identity.

4. What is a ‘right to erasure’ request?

4.1 A data subject right to erasure request is a written (including via email) or verbal request for personal information (known as personal data) held about you by the RDN Group or any Group Company to be permanently deleted.

4.2 Under Article 17 of the EU General Data Protection Regulation (GDPR) you have the right to request the removal of personal data stored by the RDN Group without undue delay. Data subjects have the right to have their personal data erased if:

4.2.1 The controller no longer needs the data for the purpose that it was originally collected;

4.2.2 The individual withdraws consent;

4.2.3. The individual objects to the processing and the organisation has no overriding legitimate interest in the data;

4.2.4. The controller or processor collected the data unlawfully;

4.2.5 The data must be erased to comply with a legal obligation; or

4.2.6 The data was processed in relation to the offer of information society services to a child.

5. Can a right to erasure request be refused?

5.1. The RDN Group can refuse to comply with a request for erasure if:

5.2. The processing is protected by the right to freedom of expression;

5.3. Processing the data is necessary to comply with a legal obligation for the performance of a public interest task or exercise of official authority;

5.4. The data is for health purposes in the public interest;

5.5 The data is being used for archiving purposes in the public interest, scientific or historical research, or statistical purposes; or

5.6 The processing is necessary to exercise or defend legal claims.

5.2. The RDN Group maintains a log of Right to Erasure requests for its legitimate interests to ensure that these requests are processed in a timely manner, and to demonstrate compliance if required. This personal data includes the requester’s name, email address and postcode (if relevant) together with the date and outcome of the right to erasure request. This log is only available to the Privacy Team and this personal data will be securely stored separately from any other data and would only be processed if necessary for the above purposes.

5.3. The RDN Group can refuse to comply with a request for erasure if it is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature. We may also refuse a request for erasure where we consider the purpose of the request is to take unfair advantage of discounts or offers.

5.4. If we consider that a request is manifestly unfounded or excessive we reserve the right to:

5.4.1 request a "reasonable fee" to deal with the request; or

5.4.2. refuse to deal with the request

6. How do you make a Right to Erasure request?

6.1. You may email your request to [email protected] from your usual customer email. Please state your name, 1st line of your address and postcode and that you are making a request for the deletion of your personal data. We ask for your address details to help us verify your request and identify your personal data. If you have ever used a different email address for your account or to get in touch with us, you should also include details of that email address.

6.2 You can also complete the Right to Erasure Request Form, available here. In certain cases, we might ask you to provide further information and/or evidence of identity and/authority.

6.3. If you cannot email or complete the online form you can write to us requesting a form from: The Privacy Team, RDN Group Limited, Units 4-5 Bell Court, Felinfach, Fforestfach, Swansea, SA5 4HP and we shall send you a copy by return post.

6.4 You can also make a Right to Erasure request verbally by calling our Customer Service team. You will be asked to confirm your name, email address, and address details to help us verify your request and identify your personal data.

7. What do we do when we receive a valid ‘right to erasure’ request?

7.1 We will first check that we have enough information to be sure of your identity. We usually require the first line of your address and your postcode to verify your identity and complete your request. In some cases we may request additional evidence we reasonably need to confirm your identity. We do this to ensure that the correct data will be identified for erasure and that the erasure is properly authorised. We will then check that we have enough information to find the records you requested for erasure. If we feel we need more information, then we will promptly ask you for this.

7.2 If we request further information from you to confirm your identity and you do not respond, then we will not process your request for erasure until you do respond. After two months, we will usually close your request. You may start a new request at any time, but you will need to provide us with the necessary information.

7.3 Once we have all the information we require, we will conduct a full search of all our relevant databases and filing systems and locate all personal data relevant to you as the data subject. We will also use reasonable endeavours to identify all third-party processors that may also have the personal data and, where possible, instruct them to remove the data from their environments and to confirm erasure. For example, Royal Mail and other delivery companies are also data controllers and it is not possible for us to require them to delete personal data used for delivery of items purchased. You are of course entitled to make further applications for erasure of your personal data to these companies directly.

7.4 At this point we remove the personal data from our day to day digital and physical environments. If the data subject has purchased products from us previously then their purchase data will be separated from their personal data. Purchase data will be anonymised and used in its anonymised form for data analysis and research. Certain personal data may be retained for a slightly longer period of time in our back ups until overwritten.

7.5 If you have an account with loyalty points accrued, your loyalty points will be deleted on removal of your account and cannot be added back at a later date.

7.6 Finally, we will note the outcome of the Right to Erasure request and respond to the data subject to confirm data erasure from our environment.

8. Are there any fees payable?

8.1 While in most instances there is no charge we reserve the right, in accordance with Article 12 of the GDPR to charge a “reasonable fee” for administrative costs or refuse the request if it is considered to be “manifestly unfounded or excessive”.

9. How soon will my ‘right to erasure request’ be dealt with?

9.1 All valid ‘right to erasure requests’, accompanied by valid proof of identity, received by ECD will be dealt with within 30 days of the latest of the following:

9.1.1 Our receipt of your request; or

9.1.2 Our receipt of any further information we may ask you to provide to enable us to comply with your request.

10. Right to Erasure Policy Review

10.1 This policy will be reviewed at least annually by the Legal Director to ensure alignment to appropriate risk management requirements and its continued relevance to current and planned operations, or legal developments and legislative obligations.