Solutions · E-commerce and marketplaces
She told you to stop, four times.
Halima Sani withdrew consent in June. She objected. She asked again. Nothing in your stack was wrong, exactly — the withdrawal landed in one system and the audience lived in another, and the two never spoke.
What she did
- 22 Jun · in the appShe withdrew consent to marketing
Recorded correctly, against v2 of the notice, with the wording she saw.
- 22 Jun · same eveningShe objected to the activity
A separate right, and a separate obligation. Both landed in the request register.
- 9 Jul · by emailShe asked why it had not stopped
Support replied that it would take 48 hours. The audience was never touched.
- 18 Jul · complaintShe told the Commission instead
By then the activity she objected to had no lawful basis at all, which is the finding.
What the audience did
- Winback offer23 Jun
- Weekend flash sale27 Jun
- Abandoned cart reminder2 Jul
- We miss you — 15% off9 Jul
- Restock alert14 Jul
- Winback offer, again17 Jul
- Weekend flash sale21 Jul
ACT-030 · marketing to lapsed customers
For thirty-four days this activity had no lawful basis at all
Not the wrong basis. None. A growth lead removed it while the balancing test was redone, intending to put it back — and forty thousand people kept receiving email against a record that said nothing.
Asiri watches the field rather than the intention. A basis removed and not restored inside a day raises it as an open finding with the activity named, because nobody ever remembers on their own — and the campaign does not stop sending while they try.
Everything on your storefront that watches
A tag you added in 2023 is still reporting
Session recording, analytics, retargeting pixels, the abandoned-cart tool somebody trialled. Each one is a recipient of personal data, each one needs a basis, and every one of them belongs in the notice by name.
Card payments
RegisteredYour own transaction log, read on your side. Card numbers never reach you, which is the point of a switch.
Support desk
RegisteredTicket metadata only, never the bodies. Which means nobody can search them to answer an access request — an honest cost of not reading them.
Marketing email
Risk check openHolds 40,100 people in the United States under standard clauses, and the audience Halima is still in.
Session recording
Not in the noticeWatches what people do and remembers it. Consent-grade, and named nowhere a customer can find.
A retargeting pixel from 2023
No ownerNobody who added it still works here. It is still firing, and it is still a recipient of personal data.
Two answers a regulator treats very differently
Seven years is a fact. Forever is a decision.
Transaction records carry a period you inherit from a regulator. Marketing lists and browsing history carry a period you chose — and on your marketing category nothing has been decided at all, which is why 40,119 records are past due against a rule that does not exist.
Set by law
7 years
Transaction records
Inherited from a regulator, so you defend nothing. Asiri records the source beside the period.
Your choice
30 days
Abandoned carts
A decision you made and can justify: long enough to recover the sale, short enough to be proportionate.
Nothing decided
Not set
Marketing lists and open history
40,119 records past due against a rule that was never written. The most common finding in this sector.
Nothing decided
Not set
Browsing and event history
Two activities feed it and neither has a deletion date, so in practice the answer is forever.
Find out who is still in an audience they left
Connect your storefront and your marketing tool. Asiri compares who withdrew against who is still being sent to, and names the ones in both.