Playbook, marketing agency
Delete my data, sent to a company the sender has never heard of
Two completely different people send this. One is a prospect who wants off the agency's own list, which is simple. The other is a member of the public who has traced a message back to the agency that sent it for a client, and their data is not the agency's to delete. Answering both the same way either fails a request or discloses a client relationship.
Why this is not the general answer
The handling pattern for data deletion requests holds across every trade. What follows is the part that does not.
- An agency routinely handles the personal data of people it has no relationship with, on instructions from the client who does, so a request arriving at its website is frequently addressed to the wrong company altogether.
- Naming the client whose list somebody is on discloses that the agency works for that client, and confidentiality in agency contracts commonly covers the existence of the relationship as well as its detail.
- The same data often sits with a freelancer or a subcontractor in the delivery chain, so a deletion instruction has to travel further than the agency's own systems and cannot honestly be confirmed in a sentence.
- The agency's own records are a separate pot entirely: enquiry lists, pitch material, notes from calls that were never billed for, and those it can act on without asking anybody.
How it arrives
- take me off the list you sent that email from
- who gave you my details
- i want everything you hold about me deleted
- we are ending the contract please delete our customer data
- do you keep the pitch material after we said no
- does your freelancer still have our spreadsheet
What has to be indexed for this to work
| Your position on data you handle for clients, written for a stranger | That much of what you hold belongs to a client, that instructions on it come from the client, and how somebody in that position should proceed. Written without naming anybody, because naming is the thing you cannot do. |
|---|---|
| What the agency holds on its own account | Enquiry records, pitch documents, call notes, and how long each is kept. This is the part you can genuinely act on, and separating it from client data is what makes a fast answer possible. |
| The route for a request, with an address and a timescale | Where a request has to be sent, what identification you need, and how long you take. A request typed into a chat box has not been made, and the wording has to say so without sounding like a brush off. |
| What happens to client data at the end of an engagement | What is returned, what is destroyed, over what period, and how anybody outside the agency in the delivery chain is covered. Clients ask this at the point they are already leaving, which is the worst moment to be improvising. |
The reply
If you had a message from us it may have been sent for one of our clients, in which case the data belongs to them and we act on their instructions, so the request goes to them rather than to us. I cannot tell you which business that is. Our own position and the address for a request are on our privacy page [1]. If you want removing from anything the agency holds in its own right, send it to that address and it will be dealt with inside the period stated there [2].
It explains the arrangement without reaching for the vocabulary, because the person reading has no reason to know it. It refuses to name the client immediately rather than after a paragraph of hedging, since the refusal is the substance. And it gives a real address, because a request left sitting in a chat window is not a request.
Where it stops
The trigger. The visitor asks to be removed, asks who holds their data, or a client asks for its customer data to be destroyed at the end of an engagement.
A deletion request has to reach the address on our privacy page to be recorded as one, and a message here is not that. Leave your name and an email if you would like somebody to walk you through it and I will pass that on.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never name the client whose campaign a message came from, because confirming the relationship is itself a disclosure.
- Never confirm that a person is on any list, sits in any system, or is known to the agency at all.
- Never say data has been deleted, since nothing here reaches a system and the sender will stop chasing.
- Never state a retention period for client data that differs from the agreement covering it, because the client sets that and the agency follows it.
Questions
- Most of these are about a client's list. Is a page worth writing?
- It is the page that stops the wrong answer. The tempting reply names the client so the person can go to the right place, and that one helpful sentence breaches a confidentiality term. Writing the refusal in advance is cheaper than explaining it afterwards.
- Can it delete anything, or file the request properly?
- No. It collects a name, an email and a message which is emailed to an address you choose, and that is a notification rather than a filed request. Say so in the reply and give the proper address, or people will assume it was actioned.
- A client wants its data destroyed at the end of a retainer. What should it say?
- What the engagement terms say happens, and nothing beyond. Anybody outside the agency in the delivery chain has to be covered by the same instruction, and confirming that has happened is a job for a person who can check.
Keep reading
- Everything for a marketing agencyService definitions and engagement terms convert. A price quoted for work nobody has scoped is the trap on an agency site.
- Handling data deletion requests in generalA deletion request is a request with a clock on it, not a question. The characteristic failure is silence, so it always has to reach a person.
- Sorting an agency complaint before anybody answers itA late report is a service complaint. A campaign that overspent a client budget is not, and the assistant has to handle the second differently.
- Two pots of money, and the client wants one of them backThe fee bought hours that are already spent. The budget left for a platform. Only one of the two is a conversation about a refund.
- Can we get a call booked, typed by four different peopleA prospect, a client chasing an account lead, a supplier and a student all type the same request. Only one of them is a discovery call.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.