FAQ: How to Withdraw Consent or Request Data Deletion

Making a request

How do I withdraw my consent or ask HReasily to delete my personal data?

Submit the "Withdrawal of Consent" form on our support portal at support.hreasilygroup.com, or reply to an existing support email and say what you want. Tell us:

• your name, and the email address registered with your HReasily account,
• your company name,
• whether you want to stop marketing, withdraw consent for a purpose, or delete your data, and
• which data and which purpose the request covers.

Who can make a request?

Anyone whose personal data HReasily holds can ask. How we handle it depends on who decides what happens to the data. See "I'm an employee of a company that uses HReasily" below.

What should I not send?

Please do not send NRIC or passport numbers, passwords, or payroll information in the form or by email. We will never ask for them in a reply. If we need anything more, we will tell you exactly what and how to send it safely.

Do I need to log in?

No, but we do need to confirm the request is really from you. See the next section.

What is the difference between withdrawing consent and deleting data?

Withdrawing consent means we stop using your data for a purpose you agreed to, such as marketing. Deletion means we remove the data itself. Some requests involve both. If you are not sure, tell us what you want to happen and we will work out the right route.

What happens next

What are the steps after I submit?

1. We acknowledge your request and ask you to confirm it is from you.
2. We verify your identity.
3. Our Data Protection Lead reviews the request, including any records we are required to keep.
4. Before we act, we tell you what the request means for your account and service, and ask you to confirm or change your mind.
5. Our technical team carries out the deletion or change.
6. We email you to confirm what was done.

How do you verify that it's me?

We ask you to reply from the email address registered on your HReasily account, or to have your company's registered HReasily administrator confirm the request. This protects your data, because deletion cannot be undone. If we cannot verify the request, we keep it open for a short period and then close it without taking action. You can contact us again at any time.

How long does it take?

Requests can take longer if they involve data we are legally required to keep. We will tell you if that applies.

What will be deleted?

The personal data covered by your request, in our live systems and in the tools we use to support and bill you, such as our support, billing and marketing systems. Deletion covers copies and temporary files, not only the main record. Where a third-party provider holds the data, we get their confirmation that it has been destroyed.

What might we keep?

Some records must be kept by law, such as payroll, tax and employment records, or if a legal hold applies. If so, we tell you what we kept and why, use it only for that legal purpose, and delete or anonymise it when the period ends. A withdrawal of consent is always given effect: we stop using your data for that purpose even where we have to keep a record.

What about backups?

Backup copies are not deleted straight away. They are kept for the period set in our backup policy, are only used for disaster recovery, and are removed when that period ends. They are not used for anything else in the meantime. Our confirmation email states the date your data left our live systems and how long backup copies remain.

Can I change my mind?

Yes, before we carry out the request. We email you before we act, explaining what it means for your account and service, and you can confirm, limit or withdraw the request at that point. Once deletion is complete it cannot be undone.

Other questions

I'm an employee of a company that uses HReasily. Can I ask you to delete my data?

For employment information in your company's HReasily account, your employer decides how it is used, kept and deleted, and we act on their instructions. We cannot withdraw consent for or delete that information directly on your request. Please send your request to your company's HR team or the person responsible for data protection. Say what data it covers, whether you want it corrected, restricted or deleted, and ask for the outcome in writing. If you would like us to tell your company's HReasily administrator that you raised a request, let us know. We will not share it unless you ask.

I only want to stop marketing emails.

Submit the same form and choose "Stop marketing communications", or use the unsubscribe link in any marketing email. After we verify the request, we stop marketing to you straight away. We keep your email address on a suppression list so we do not contact you again by mistake.

I want to see or correct my data, not delete it.

This is an access or correction request rather than a deletion request. Send it through the same form and we will pass it to our Data Protection Lead. Our Privacy Policy commits to a reply within 30 days.

Can I ask for only some of my data to be deleted?

Yes. Tell us which data and which purpose. We can partly act on a request.

What if I'm not an HReasily customer?

If you are a lead, contact or someone else whose details we hold for our own purposes, such as marketing, we handle the request directly. Use the same form and choose "Not a customer" for "I am a...".

I'm not happy with how my request was handled.

Reply to the email you received and say so, or write to security@hreasily.com. We log privacy complaints and acknowledge them within 2 business days.

I think my data has been exposed or misused.

This is a security matter, not a deletion request. Email security@hreasily.com straight away with what you have seen.

Where can I read more?

See the HReasily Privacy Policy for Individuals or for Non-Individuals, whichever applies to you.