Data Deletion Instructions

1. Start here: which situation applies to you

Scafell Tech Private Limited builds and operates messaging and case-management systems on behalf of client organisations — municipal bodies, utilities and companies. In law those organisations are the Data Fiduciary for the data collected through their WhatsApp business number, and we are their Data Processor. That is why a deletion request has to reach the right party.

• You sent a complaint or service request over WhatsApp to an organisation — see section 2.
• You are an officer or administrator at an organisation that uses our software — see section 3.
• You emailed us about our services and want that correspondence deleted — see section 4.

In every case you can write to privacy@scafelltech.com. Requests are free of charge.

2. If you messaged an organisation over WhatsApp

Option A — ask the organisation you contacted

This is the most direct route. The organisation running the WhatsApp business number you messaged decides what happens to the data collected through it, including whether it can be erased while a complaint or a statutory record is still open. Its own privacy notice will name a grievance officer or data protection contact.

Option B — ask us and we will act on it

If you do not know who to contact at the organisation, or would rather come to us, email privacy@scafelltech.com with the subject line “Data deletion request”. We will identify the client organisation your data belongs to, pass the request to it without delay, and carry out the deletion on its instruction.

What to include

Please include all of the following, so that we can find the right records without further correspondence:

• The WhatsApp phone number you messaged from, in international format — for example +91 followed by your number.
• The organisation you contacted, or the WhatsApp business number you messaged.
• Any complaint or reference number you were given.
• The approximate date of your messages.
• Whether you want everything deleted, or only specific items — for example a photograph or a voice note.

You can also make the request by post to the registered office address in section 10.

3. If you administer the service for a client organisation

Client organisations can request deletion in three ways, under the terms of their agreement with us:

• Individual records — deletion of a named person’s data, for example in response to a request made to your grievance officer. Send the request from an authorised administrator account to privacy@scafelltech.com.
• Bulk deletion — deletion of a defined set of records, for example all closed cases older than a stated date, or all media attached to them.
• End of contract — on termination we return or delete all personal data we hold for you, as your agreement directs, and confirm in writing when deletion is complete.

Deletion of a staff account is handled the same way: the account is disabled, its record deleted, and the audit entries recording actions that officer took remain in the case record, since removing them would break the audit trail your own oversight depends on.

Where the software includes an administrator function for deleting or exporting records, that function can be used instead of writing to us; it is described in the documentation issued with your deployment.

4. If you have only corresponded with us

If you contacted us about our services — a procurement enquiry, a technical question, general correspondence — we hold that data as Data Fiduciary in our own right. Email privacy@scafelltech.com from the address you wrote from, ask for your details to be deleted, and we will delete them and confirm.

5. What gets deleted

Where a request is accepted in full, we delete the following from our production systems:

• Your WhatsApp phone number and the profile name associated with it.
• The content of messages you exchanged with the organisation.
• Photographs, video and voice notes you sent, from the media storage they are held in.
• Locations you shared, and the coordinates derived from them.
• The case record itself, or — where the organisation must keep a record that the case existed — the identifying fields within it, leaving a record that cannot be linked back to you.

Copies in backups are removed on the backup rotation cycle, after which they are not recoverable. Backups are not used to restore deleted records.

6. What may be retained, and why

A deletion request may be refused in part. Where that happens we tell you which items are affected and the reason. The usual reasons are:

• The complaint is still open. Data needed to resolve an active case is kept until it is closed. You can ask again after closure.
• A law or a statutory authority requires the record. Public bodies in particular have record-keeping obligations for the requests they receive and the action taken on them; we cannot override those.
• Legal proceedings or an audit. Data relevant to an actual or anticipated claim, investigation or audit is kept until it concludes.
• Anonymised and aggregate data. Counts and statistics that no longer identify anyone — for example the number of complaints of a given type in a ward — are not personal data and are not deleted.
• Audit entries. Records showing which officer acted on a case and when are retained for accountability, without your identifying details.

Because the client organisation is the Data Fiduciary, the decision on any of these grounds is that organisation’s to make. We will tell you which organisation made it and how to escalate to its grievance officer.

7. What deletion does not cover

Deleting data from our systems does not remove:

• The conversation on your own phone. Your copy of the chat stays in your WhatsApp app until you delete it there. WhatsApp’s Help Centre explains how to delete a chat, and how to block or report a business.
• Data held by Meta. Messages are carried by the WhatsApp Business Platform operated by Meta Platforms, Inc. Data Meta holds is governed by its own terms; see WhatsApp’s Privacy Policy.
• Records the organisation keeps elsewhere. If the organisation you contacted copied your complaint into its own file, register or system, that copy is outside our systems and must be raised with that organisation.

8. How long it takes

1. We acknowledge your request on receipt.
2. We confirm your identity and identify the client organisation concerned.
3. Deletion is carried out and confirmed to you in writing.
4. Copies are removed from backups on the next rotation cycle, after which they are not recoverable.

We act without undue delay at each stage, and within the time applicable law allows.

If a request will take longer — for example because the case is still open or the client organisation has to decide on a statutory retention point — we tell you why and when to expect an answer.

9. Confirming who you are

Before deleting anything we need to be reasonably satisfied that the request comes from the person the data is about, so that one person cannot erase another’s records. Normally it is enough to confirm ownership of the WhatsApp number the data is held against — for example by replying to a confirmation message sent to it.

We ask only for what is necessary to establish this. We do not require you to send identity documents, and anything you do send for verification is used for that purpose only and then deleted.

Requests on behalf of someone else — for example by a guardian, or by a nominee under the Digital Personal Data Protection Act, 2023 — need evidence of that authority.

10. Contact

Deletion and privacy requests
Scafell Tech Private Limited
privacy@scafelltech.com
A 406, Om Decora 9 Square, Nana Mava Road, Mota Mava, Rajkot 360005, Gujarat, India

If you are not satisfied with how a request was handled, our grievance route is set out in section 13 of the Privacy Policy, and the Digital Personal Data Protection Act, 2023 allows you to complain to the Data Protection Board of India.