Data deletion

1Your right to erasure

Under the GDPR (Article 17) you have the right to ask us to delete all personal data we process about you. This is also known as the right to be forgotten. You do not need to give a reason, and making a request is free of charge.

2How to submit a request

Send an email to privacy@aishaa.nl, preferably from the email address you have used to contact us before. Please include:

• your name and, if applicable, your company name;
• a statement that you want us to delete your personal data;
• if applicable: any other email addresses or phone numbers you have used to contact us, so we can find everything.

No special form or legal wording is needed; a short message is enough.

3How we handle your request

After receiving your request, we will send you a confirmation of receipt as soon as possible. We will then delete your personal data from our systems, no later than 30 days after your request. Once the deletion is complete, you will receive a confirmation by email.

If a request is exceptionally complex, the GDPR allows this deadline to be extended. In that case we will inform you within 30 days of your request, stating the reason and the new deadline. In practice, we expect almost every request to be completed well within 30 days.

If we have doubts about whether the request really comes from you, we will first ask you for additional information to confirm your identity. This prevents someone else from having your data deleted.

4What we delete

We delete all personal data we process about you as a controller. This includes:

• contact and demo requests submitted through the website;
• email correspondence and notes from conversations;
• your data in our records, insofar as no statutory retention obligation applies;
• your data held by our processors, such as our hosting and email providers.

Deleted data also disappears from our backups; these are overwritten on a fixed schedule, after which the data is permanently gone.

5When we are not (yet) allowed to delete something

In some cases the law requires us to keep certain data for a limited period. Invoices and payment details, for example, fall under the Dutch statutory tax retention period of seven years. We may not delete such data earlier, but we do restrict its processing: it is only stored and no longer used for anything else, and we delete it as soon as the statutory period has expired. In our confirmation we will tell you whether this applies to your data and, if so, which data and which period are involved.

6Data in an organisation’s aishaa platform

Have you been in contact with an organisation that uses aishaa for its customer service? We process the data from those conversations as a processor, on behalf of that organisation. The organisation is the controller and decides on deletion. In that case, please submit your request to that organisation; it can then also have the deletion carried out in the aishaa platform. If you send such a request to us anyway, we will let you know and refer you to the right organisation.

7Your other privacy rights

In addition to the right to erasure, you also have the right to access, rectification, restriction of processing, objection and data portability. You can read more about these rights in our privacy policy. You can also use privacy@aishaa.nl for these requests.

8Not satisfied with how we handled it?

If you believe we have not handled your request properly, please let us know; we will be happy to resolve it together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority in your own country.