Data subject request procedure

Use this procedure when a person asks to use a right over their personal data: access, portability, rectification, erasure, restriction, objection, or withdrawal of consent. It also covers complaints. It follows the regulator's guidance:

• ICO, Individual rights: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/
• ICO, Subject access requests: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/

This document is not legal advice.

1. Time limits

• Reply within one calendar month of receipt (Art. 12(3)): a request received on 3 March is due 3 April; if the next month has no matching date, the last day of that month. Internal target: 7 days; deletions the same day.
• Acknowledge within 72 hours.
• Extension: up to two more months for a complex request or several requests; tell the person within the first month, with the reason.
• Clock pause (DUAA s.76, in force 5 February 2026): if we need proof of identity, or must ask what the person wants where we hold a lot of data about them, the clock starts when we get the answer. Ask at once.
• Searches need to be reasonable and proportionate (Art. 15(1A), DUAA s.78).
• No fee, unless a request is manifestly unfounded or excessive; then we may refuse or charge a reasonable fee, with a written reason and the right to complain.
• US state requests (for example California): confirm within 10 business days, answer within 45 calendar days (extendable by 45 with notice).

2. Intake

A request can arrive by any channel, in any words. It doesn't need to say "GDPR" or "subject access".

Log every request the day it arrives (section 8).

3. Identity

Proportionate checks only. Never ask for a passport or ID document for an ordinary request.

3.1 Accounts

Wamemba me accounts are anonymous unless backed up. Work out which kind it is:

Never merge, move or delete an account on an email request alone when the account is anonymous: the person cannot be told apart from anyone else. Offer the in-app route instead.

3.2 Third parties

A lawyer, a relative or a US "authorised agent" needs written authority from the person. For California requests, an authorised agent may act with signed permission; we may still verify the consumer directly.

3.3 Requests about a child

The child is a data subject. The right is the child's.

• A parent asking about their own child's data (the usual case): the parent is the account holder. Handle as the parent's request; the parent acts for a young child.
• A child asking directly (usually an older child, years later): a child can exercise their own rights when they understand them; in the UK this is usually from about 12, and in Scotland the law presumes it at 12 (Data Protection Act 2018 s.208). Treat the request seriously and kindly. Check the child is who they say (a detail only the family would know, sent from an address the child controls). Then:
• Access: give the child the sayings about them (not the parent's private notes about other children).
• Erasure or objection: delete the sayings about that child, or the child, unless a strong reason exists not to. Tell the account holder before deleting unless that would not be in the child's best interests (for example, a safeguarding concern). Record the reason.
• A parent who is not the account holder (for example, a separated parent) asking for a child's sayings: the other parent's account is the other parent's data too. Do not disclose without the account holder's agreement unless the law requires it; log the request and take advice (solicitor brief, Q6).
• Any sign that a child is at risk: stop, and follow safeguarding (contacts in breach-response.md section 3).

4. What each right means for Wamemba me

4.1 Manual account deletion (until the in-app path ships)

1. Verify identity (section 3). For an anonymous account, prefer the in-app route.
2. Ask the parent to delete the app after we confirm, or warn them: the app keeps a copy on the phone, and an app whose account was deleted on the server shows the "gone" screen and keeps that copy (docs/decisions/2026-10-14-session-for-deleted-account.md). If they want the phone's copy gone too, deleting the app removes it.
3. In one transaction as service role: delete the families the account owns where it is the only member (cascades children, sayings, lines, meanings, links); remove its membership of other families (a partner's family keeps its sayings, which belong to that family); delete Storage objects under its clips (coming); delete the auth.users row.
4. Delete the PostHog person (distinct id = user id). Sentry events age out (30 or 90 days); delete them by user id if asked.
5. Coming: RevenueCat customer delete (keep transaction records 6 years), cancel nothing (the store subscription is the parent's to cancel; tell them how).
6. Confirm in writing, and say what we keep and why (backups for 7 days; transaction records).
7. Log it (section 8).

4.2 Anonymous accounts, "gone", and the 90-day clean-up

• Anonymous accounts are real accounts with real data. They have every right a backed-up account has; only identity is harder (3.1).
• "Gone": when the server says an account no longer exists but its sayings are still on a phone, the app keeps them and shows "We can't find your account... Write to us at hello@wamemba.me and we'll help you keep them." A parent writing this way wants their sayings back, not deleted. Help them: if the account was deleted by a request, confirm that with them; otherwise, investigate (logs, auth.audit_log_entries). Until the "Bring these sayings into a new account" carry-over exists, the sayings can only stay on that phone; tell the parent honestly and log the case.
• The 90-day clean-up (coming, S4): never-subscribed anonymous accounts are deleted 90 days after the app was last opened, with a 7-day notice when notifications are allowed. A request to restore an account removed by the clean-up cannot be met from the database after the 7-day backup window; before it, a restore from backup is possible but disproportionate for one account: decide case by case and log it. The clean-up must not run before the carry-over exists (prerequisite in the decision above).

4.3 Where the data is

4.4 Exemptions and other people's data

• Other people's data. A saying can name other people (a sibling, "Dad", a teacher's first name). These are part of the family's own record and go in the family's export. A family's sayings are not given to anyone outside it.
• Legal retention. Transaction records stay 6 years.
• Legal claims. Keep what is needed to establish or defend a claim (Art. 17(3)(e)).

5. Responding

1. Reply from hello@wamemba.me, in plain words and the brand's voice.
2. For access: send the data as a JSON file and a readable copy, through a link that expires within 7 days, or as an encrypted attachment. Never paste sayings into an email body.
3. Say what we did, what we did not do and why, and how to complain to the regulator: https://ico.org.uk/make-a-complaint/ , 0303 123 1113.
4. Log the response.

6. Complaints

Since 19 June 2026 (Data Protection Act 2018 s.164A, inserted by DUAA s.103) a controller must make it easy to complain about its use of personal data, acknowledge each complaint within 30 days, investigate it without undue delay, and tell the person the outcome.

• How to complain: email hello@wamemba.me (the privacy policy, section 9, asks for the word "complaint"). Coming: a complaint form in the app or on the site.
• Treat any message that expresses dissatisfaction about how we use personal data as a complaint, whatever words it uses.
• Acknowledge within 30 days (target: 3 days); investigate; reply with the outcome and the right to go to the regulator.
• Log it in the request log with type "complaint".

7. Requests that are not UK GDPR requests

• EU residents: handle exactly like UK requests.
• US state laws (California and others): Wamemba me is below the CCPA thresholds (annual revenue over $26,625,000 from 1 January 2025, or 100,000 consumers, or half of revenue from selling or sharing) and other states' thresholds, but gives the same rights to everyone: know, delete, correct, non-discrimination. We do not sell or share, so there is no opt-out to honour.
• COPPA: if a parent tells us a child used the app, delete what the child provided and log it.

8. Request log template

Keep the log in docs/privacy/request-log.md (create it at the first entry). No names or emails: use a SHA-256 hash of the lower-case email, or the account id. Keep entries 6 years.

| Date received | Due date | Right(s) or complaint | Channel | Email hash or account id | Identity check | Child's own request? | Extension? | Completed | Outcome | Exemptions used |
|---|---|---|---|---|---|---|---|---|---|---|

9. Actions

10. Review

With ropa.md. Next review: 2027-04-15.