Customers
Suppression list
Addresses no record may be created for again — held as a digest, so the list is not a copy of what an erasure removed.
Erasing a contact takes away their address. That address was also the only thing that could have recognised them — so the spreadsheet somebody imports next month, exported before the erasure, quietly puts them back a fortnight after they asked to be forgotten. The suppression list is what recognises them instead.
The list does not hold the address
It holds a one-way digest of it, computed under a secret this deployment holds separately. Storing the address so it could be compared against would put back the exact thing the erasure removed — and a list of everyone who asked to be forgotten is precisely the file you least want to be keeping.
What goes on it
- An erasure
- Automatic. Every email address and phone number the contact held, added in the same transaction that erases them.
- A complaint or a decision
- Added by hand, with a note. Somebody who wrote asking to be left alone, when there was never a record to erase.
What it stops, and what it does not
| Where a contact would be created | What happens |
|---|---|
| An import row | Skipped, with the reason on that line. The rest of the file imports. |
| A pull from a connected system | Not created. An existing record is still updated. |
| Somebody typing the address in | Refused, and told how to lift it. |
| They fill in your form | Created. The suppression is lifted. |
| They book a meeting | Created. The suppression is lifted. |
Coming back is not the same as being re-added
A right to erasure is the removal of what was held, not a ban on ever holding it again. Somebody who fills in your contact form has handed you their details afresh, and refusing to record it means their enquiry goes nowhere with nobody able to explain why. The distinction the list draws is whether the person acted — not whether the address matched.
Lifting grants no permission to market to them. Suppression decides whether a record exists; consent decides whether anything is sent, and somebody with no consent on record is still refused by name.
Lifting
A lifted entry is kept rather than deleted, with the reason and who did it. That an address was suppressed and then released is the account of how a request was handled, and it is the half a later argument turns on.
There is no way to ask whether an address is on the list
Nothing here answers that question directly, on purpose. An endpoint that did would let anybody with an account test any address in the world and learn who had asked to be forgotten. The list is only ever consulted while something is trying to create a record, where the address is already in hand.