4 ms·

If it really keeps credit card details, that’s way more than just a tombstone.

• fshbbdssbbgdd 4y ago
  (Asking out of ignorance, I don’t know how this works) Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
  • marcofatica 4y ago
    They could mail a check.. oops now they need your mailing address Or they could call you and ask.. oops now they need your phone number etc
  • Traster 4y ago
    In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".
    • fshbbdssbbgdd 4y ago
      In general, it’s not that strange to sell something then realize you can’t actually deliver it and make a refund. I guess HelloFresh is a little bit different from the average e-commerce business because they sell perishable food. But probably there’s some case where they would take some money then later decide to give it back.
  • rrobukef 4y ago
    Encrypted archival of PII for a limited time, say a year. GDPR allows the storage for legal reasons. A one way hash of PII, salted, stretched, this is enough to verify identity but also doesn't keep the PII directly (I know only 8 billion people on earth is not enough entropy. Still you make a legal effort and segregate it from your network)
  • aPoCoMiLogin 4y ago
    you only need the transaction details to call your payment gateway to do the refund, unless you are the payment gateway.