Privacy notice

If you are our customer

Write to privacy@consonas.com. You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable form. For the last of those, the export in the product already does it and you do not need to ask.

You will get an answer from a person. If we cannot do something you have asked for, we will say why rather than not replying.

If a Consonas customer holds your data

Your request goes to them rather than to us. They decided what to collect and why, they are the controller, and we cannot lawfully act on their records without their instruction.

If you do not know who holds your data, or you have written to them and had no reply, write to us anyway. We will tell you who to ask, and we will remind them of their obligation. What we will not do is hand over or delete their records on your say so, because doing that would be a breach in the other direction.

What they answer with is the subject access tooling, which is on every plan including the free one. Where the request reached us first, we forward it and remind them that their month ran from the day you first asked rather than from the day it arrived at the right inbox. If nobody replies we chase once, tell you that we have chased, and say again that a supervisory authority takes complaints without our permission or theirs.

Complaining

If you are unhappy with how we have handled something, tell us first and we will try to put it right. You also have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office, which takes complaints directly, and you do not need our permission or our agreement to do it.

The same person is in two organisations, and only one of them erases

Two of our customers can hold records about the same person without either knowing about the other. If one of them erases that person, the other's records are untouched, and that is correct instead of a shortcoming. They are two controllers who decided separately to hold something, for separate reasons, and one of them cannot instruct the other through us.

It has a consequence a person exercising a right needs to understand: the request has to go to each organisation that holds them, and there is no single place to send it once. We cannot search across organisations on anybody's behalf, and it is worth being precise about why. It is not a policy we could relax if a request were sympathetic enough. Each organisation's records sit in a database of its own, and there is no query that spans them, so the thing being asked for does not exist to be granted.

Somebody is both a colleague and a record

A person can appear twice in the same organisation in two entirely different capacities. They can have an account, because they work there and sign in. They can also appear in the records, because a colleague noted a conversation with them, or because they were a customer before they were a colleague.

Those two are held by different people for different reasons and they come apart when somebody leaves. Removing a person from an organisation ends their access. It does not remove what the organisation holds about them, and it should not, because the second thing was never held for the purpose of letting them in. If what they want is the record gone as well, that is a separate request to the organisation, answered by the organisation, and the audit trail keeps the fact that it happened without the content.

The person asking cannot prove they are the person

The risk in an access request is not usually refusing a genuine one. It is answering a false one, because handing somebody's file to a stranger who asked confidently is a breach that arrives dressed as good service, and it is the failure mode a controller should worry about most.

The proportionate answer is to ask for enough to be confident and no more. Asking for a passport scan to confirm an email address is not caution, it is collecting a document you now have to hold, protect and delete, in order to answer a request about holding less. Where the request comes to us about our own customers, we answer through the channel we already have with them instead of creating an identity record for the occasion.

The erasure is right and the six year rule still applies

Erasure is not absolute, and a notice that implies otherwise is setting a reader up for a disappointment. Where another law requires something to be kept, it is kept. Our own instance of this is billing: if you have paid us, the invoice stays for six years because tax law says so, and it stays even if you ask us to remove everything else.

What we can do is be exact about what that leaves. A billing record holds an amount, a date, an organisation and the details on the invoice. It holds no customer records. So the correct answer to a broad erasure request from one of our customers is that everything goes except the accounting entries, that we will say which ones those are, and that they will age out on their own schedule instead of being kept indefinitely under an excuse.

The request arrives after the organisation has closed

This is the bill for the deletion policy described above, and it is worth naming rather than discovering. When an organisation is closed the records go, and there is no quiet copy retained against a later request. If somebody then writes asking what that organisation held about them, the honest answer is that we cannot tell them, because there is nothing left to look in.

The alternative design keeps a copy for a while so that late requests can be answered. It also means the sentence saying your data is deleted would be false for as long as the copy exists, and we would rather be unable to answer one late question than untrue in a sentence that many more people read.

A public authority asks us instead of asking you

For the records inside your organisation we are the wrong recipient. We do not decide what is in them, we hold them on your instruction, and a demand for them is a demand against you. Our answer is to say so and to direct the request to you, and to tell you that it happened, unless we are legally prevented from telling you, in which case we will say as much as the law leaves us able to say and no less.

We will not treat a polite request from an authority as though it were an order. There is a difference between a legal demand and someone asking to see whether it works, and a supplier that cannot tell the two apart is not a safe place for your records.

Why we will not choose the safer option on your behalf

For at least three of those, we have an opinion, and in each case we think one column is better than the other. We still will not apply it to your organisation, because a processor that decides how long your records are kept, or who may see what, has stopped being a processor and has started deciding the purpose. That would change our obligations, and yours, without either of us having agreed to it.

What we do instead is make the choice visible, put the cost of each side next to it, and set the starting position where the harm from getting it wrong is smallest. That is why obligations such as the audit trail, the consent records, the subject access tooling, two factor sign in and the complete export are on every plan including the free one and always will be. Those are not decisions we think anyone should be making on the basis of price.

The one you cannot revisit

The region is fixed when the organisation is created. Not fixed as a policy that could be waived for a good enough reason, but fixed because the database was created in that jurisdiction and moving it would mean creating a different organisation and importing into it.

There are two regions, the European Union and the United States. There is no United Kingdom region, and organisations in the United Kingdom should choose the European Union. We would rather write that plainly on every page where it matters than let someone find out after they have put a year of records into a choice they cannot change. Where a transfer can still arise, and what covers it, is set out on the sub processors page.

The one no one makes deliberately

The last row of the table is the one that goes unmade. Every organisation decides what may be typed into a note, and most decide it by accident, one sentence at a time, in the direction of whatever the busiest person on the team finds convenient.

We cannot prevent it and neither can anybody else selling you software. Free text takes whatever is typed. What the product can do is make what was typed findable when somebody asks, and deletable when they are entitled to have it gone, which is why the subject access tooling searches free text and does not restrict itself to the tidy fields. The rest is a conversation with your own team, repeated more often than feels necessary.