What is Right to Restriction? 

Under the General Data Protection Regulation (GDPR), there are some situations where you have the right to limit the purposes for which the controller (in this case, us here at Drop) can process your data, even in situations where you may not be entitled to having that data erased. These include situations where the data is being used in legal claims; serving substantial public interest; protecting the rights of someone else; or other purposes you have consented to. You will also be informed before the restriction is lifted. 

"Restricting the processing of personal data" means that the controller may only hold the data, and use it for very limited purposes, as opposed to processing it fully.

Here are the situations in which you are entitled to the right to restrict processing: 

  1. If you contest the accuracy of the data being processed, you can request the restriction of that data’s processing. However, it will only be restricted until the controller has verified that accuracy. 
  2. If the processing is unlawful, you have the right to erasure (see below) but you can also choose to go for restriction of the processing instead.
  3. If the controller no longer needs the data for their intended purpose, but the data is required by you to establish, defend, or exercise legal rights
  4. When the verification of an erasure request is pending.

You can contact privacy@getdrop.com with the subject “Do not process” and we will get back to you within 30 days. 


What is Right to be Forgotten? 

Under GDPR, you’re entitled to have your personal data erased by the controller (again, that would be us at Drop in this case) in the following situations: 

  1. The data is no longer needed for the controller’s original purpose. 
  2. When the processing of the data is based on consent and this consent is withdrawn (and there is no other legal ground for the processing)
  3. When you object to the processing of your personal data and there are no overriding legitimate grounds for the processing
  4. When the personal data has been processed unlawfully 
  5. When the data has to be deleted to comply with an EU law 
  6. When the personal data is processed in relation to the offer of information society services to a child

You can at any time ask us to delete your account (or "forget you") and we'd be happy to do so.

When you request to have your account deleted, it means that as well as your profile and saved or created recipes being deleted from our own databases, all of your usage data is removed from every single third-party service that we use here at Drop. 

If you want to proceed, please contact privacy@getdrop.com with the subject “Delete my account” and we’ll process your request within 30 days and notify you when it's done.