You have received a data subject request from us.

Bletchley sends lawful requests under the UK GDPR on behalf of the people it represents — asking organisations to stop processing, or to erase, that person's personal data. This page exists so you can confirm the request is genuine before you act on it.

statutory floor

exposure across sources 0 of 24 attenuated · floor is irreducible

Verifying a request

What a genuine Bletchley request looks like

All four are true of every request we send. If any one is missing, treat the message as suspicious.

✓It arrives from an address at bletchley.app. Check the authentication results in your mail headers — we publish SPF, DKIM and DMARC on that domain precisely so you can verify it mechanically rather than taking our word for it.
✓It names the individual it concerns and cites the specific right relied on — Article 21 (objection) or Article 17 (erasure).
✓It asks you to reply in writing to the same address. It never asks you to click through to a portal to "release" or "process" anything.
✓It gives a response deadline of one calendar month, per Article 12(3) — not "24 hours", not "immediately".

What we will never do

This list matters more than the one above. It is how you recognise something pretending to be us.

✕Ask you for a payment, a fee, or a cryptocurrency transfer. Ever, for any reason.
✕Ask for login credentials, an API key, or access to any of your systems.
✕Ask you to open an attachment. Our requests are plain text with no attachments.
✕Threaten legal action with a deadline shorter than the statutory month, or claim to act for a regulator. We are not a regulator and never imply we are.
✕Contact you about anything other than one named individual's personal data. We do not do sales, partnerships, security disclosure or press.

How to respond

Reply to the address the request came from. That address is monitored and correspondence is logged with timestamps, which is as much for your protection as ours.

→Confirmation of what you have removed or suppressed, and the effective date.
→Whether the record has been added to a permanent suppression list. Deletion alone usually means the record returns at your next ingest, and we will simply have to write to you again.
→The source you obtained the data from, and any parties you disclosed it to — Article 15(1)(c) and (g).

If you believe the request is misdirected — a different person with the same name, for instance — tell us. We would much rather correct a mistake than have you action the wrong record.

Stage 01 — Find

Where the data actually is

Search surfaces are swept for republished personal details. Most of what matters never reaches page one, so rank alone is not the test.

Stage 02 — Ask

A lawful, specific request

An Article 21 objection stating grounds relating to the individual's particular situation, with erasure under Article 17 in the alternative.

Stage 03 — Verify

Proof, not a promise

The page is fetched again afterwards. A controller saying "processed" is a claim; a page that no longer carries the details is a result.

Stage 04 — Hold

Because it comes back

Sources re-ingest on a cycle. Removed records are re-checked for months, because a removal that silently reverses is not a removal.

What Bletchley is

A privacy programme, not a data broker

Bletchley works on behalf of individuals who want their personal information — home address, date of birth, direct contact details — to stop appearing on third-party websites they never gave it to.

We find where that information has been republished, ask the organisations concerned to stop, and check afterwards that it actually happened. We do not collect, buy, sell or hold data about anyone other than the people who ask us to act for them.

Where information is on a public register by law — a company director's entry at Companies House, for example — we say so plainly and do not ask anyone to remove it. Those requests would be improper and we do not send them.

Limited availability

Apply to the programme

Bletchley is taking on a small number of people at this stage. It suits company directors and others whose details reach the public record through an official register and are then copied widely.

Opens a short form. It is deliberately awkward for automated systems to reach, which is why it sits behind this step.