For data brokers and privacy teams

If you received an email from [email protected], a person has appointed us in writing to exercise their data protection rights with your organisation. This page explains what that email is, how to check it, and how to reply.

What the email is

• One request, for one named person. Each email is an erasure request and objection (Articles 17 and 21 UK GDPR / EU GDPR), or a deletion request under US state privacy law, sent for a single customer who signed an authority appointing Ceaselist as their agent.
• Sent to the contact you publish for privacy or data protection requests, taken from your own privacy notice. We do not buy, rent or scrape email lists, and we never send marketing.
• Plain text. No attachments, no tracking pixels, no tracked links. The subject always reads "Erasure request and objection on behalf of [name]" with a reference number.
• Only what you need to find the person. Most brokers receive a name and email address. Address and phone go only to people-search sites that already publish them. We never send identity documents without the person's approval each time.

Who can ask us to write to you

• Only an adult in the UK or the EEA, and only about their own personal data. Our terms forbid requests about anyone else, and we close accounts that try.
• They prove they own their email address by signing in through a one-time link sent to it, sign a written authority naming Ceaselist as their agent, and pay for the service before any request is sent.
• We send one request per organisation per person, never in bulk to a list.

What a request looks like

This is generated by the same template that sends real requests; only the person and the organisation are made up.

From: "Jane Example via Ceaselist" <[email protected]>
Subject: Erasure request and objection on behalf of Jane Example [Ref CL-EXAMPLE]

To the Data Protection Officer / Privacy Team at Example Data Ltd,

We act as authorised agent for Jane Example and make this request on their behalf.

Identifiers (use them only to locate and delete their records):
- Name: Jane Example
- Email addresses: [email protected]
- Country: United Kingdom
If you can only locate their records with other details (for example a postal address or phone number), tell us which ones and we will provide them.

Requests:
1. Object to your processing of their personal data (Article 21(1) UK GDPR) and to its use for direct marketing, including profiling for that purpose (Article 21(2)). Objection to direct marketing is absolute (Article 21(3)); for other processing based on legitimate interests you must stop unless you can demonstrate compelling legitimate grounds that override their interests.
2. Erase all personal data you hold about them without undue delay (Article 17(1) UK GDPR, including Article 17(1)(c) following this objection).
3. Restrict processing while you consider this request (Article 18(1)(d)).
4. Communicate the erasure to each recipient you disclosed their data to, and tell us who those recipients are (Article 19).
5. Keep only the minimum needed on a suppression list so that their data is not collected or listed again.
6. Confirm in writing when this is done.

Under Article 12(3) UK GDPR you must respond without undue delay and within one month of receipt. If you offer goods or services to, or monitor the behaviour of, individuals in the UK, the UK GDPR applies even if you are established outside the UK (Article 3(2)).

If you have reasonable doubts about identity (Article 12(6)), tell us the minimum additional information you need and which data you hold that it would be checked against. Please do not ask for data you do not already hold.

Authorisation: https://ceaselist.com/verify/m/example
Reference: CL-EXAMPLE. Please keep it in any reply, and reply to this address.
How these requests work, and how to tell us an address is wrong: https://ceaselist.com/for-brokers

Ceaselist (Noverquis Ltd, company 17521667), authorised agent for Jane Example

Check our authority

Every email ends with an Authorisation link. It shows the person's name, the date they signed, what the authority covers and whether it is still active. If an authority ends, we tell you and stop.

How to reply

• Reply to the email. Each request has its own reply address, so please keep the reference in the subject. We read every reply.
• The statutory deadline is one month from receipt, extendable by two months for complex requests if you tell us why within the first month.
• If you need more information to locate the records, tell us the minimum you need and which data you already hold to check it against.
• If you only accept requests through your own web form, say so. Under GDPR we reply once to explain that an emailed request through an agent is valid. If you still require the form, we stop emailing about that request and tell the person we act for.

Wrong address, or not a data broker?

If we have written to an address that is not your privacy contact, or your organisation holds no consumer data of this kind, reply saying so or write to [email protected]. We stop using that address within one working day and, if you tell us the right one, use that instead. Addresses that bounce are removed automatically and never retried.

How we send

• From mail.ceaselist.com, authenticated with DKIM, SPF and DMARC.
• Only in UK office hours, with a small daily limit per recipient organisation, so a new customer's requests reach you spread over about two working weeks.
• Reminders go only after a deadline passes. Repeat requests follow every three to six months while the person remains a customer, because brokers re-acquire data.
• Any spam complaint stops all our sending for the day until we have reviewed it.

Who we are

Ceaselist is a trading name of Noverquis Ltd, registered in England and Wales (company 17521667), 37 Longfellow Way, London SE1 5TB. We have paid the data protection fee to the Information Commissioner's Office. Questions about a request or about how we operate: [email protected]. Our privacy notice and terms explain what we do with the data our customers give us.