Getting one company to delete my personal information

Question

As a customer of Resumeble.com's resume-writing service, I uploaded a copy of my MA diploma. Later, when I wrote to them and told them to delete all of my data containing information from documents I provided, a support specialist replied to convince me of the safety of my personal information.

But according to their Privacy Policy they can use my data, can't they?

"Transfer of Data Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside Hong Kong and choose to provide information to us, please note that we transfer the data, including Personal Data, to Hong Kong and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. TrendSpotting Ventures LTD d/b/a/ Resumeble will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place including the security of your data and other personal information."

Answer 1

The quoted section of the policy says that they will store the information in Hong Kong. It also says that they will keep the data secure. It doesn't say anything about how they will use the data.

I followed the link and read the rest of the policy. That does describe how the data may be used. It says that they can use your data to contact you, to market other products and series to you, to provide the services you request on the site, to do marketing analysis, to comply with local law and legal obligations, and similar purposes. It says that data will be retained as long as needed for the purpose it was collected for, and as long as needed to fulfill legal obligations. It looks very standard for a site of the kind you describe, and seems to comply with the GDPR.

Nowhere does it say that they can use your data for other general purposes, or retain it forever.

Of course, a policy is just words. Some firms adhere strictly to such policies, some do not.

I don't know why you wanted the site to delete your info, or what your concerns are. Under the GDPR if you are in Europe, they should delete your info on request. They should only use the info for the purposes listed in the privacy policy.