Reg. C32392 — Effective 25 August 2025
60, Melfar Buildings, Office 12,
Triq C de Brocktorff,
Msida, MSD 1421,
Malta
Email: privacy@ondnet.net
Purpose and scope
This policy explains how individuals can request deletion of their personal data processed by Ondnet Services Ltd ("Ondnet", "we"), including data obtained via Meta (Facebook) Login and other sources. It applies to all Ondnet applications and services that present this policy to users.
Legal basis
Ondnet processes data in compliance with the EU GDPR, including the right to erasure (Article 17), subject to legal and operational exceptions (e.g., statutory retention, fraud prevention, or defense of legal claims).
Data categories we may hold
Depending on the product and your choices, we may process: identifiers (name, email, app‑scoped user ID), contact details, device data, app usage events, content you create (e.g., posts, messages), support tickets, and transactional metadata. If you used Facebook Login, we only hold the fields your consent granted to our app.
How you can request deletion
You may request deletion using any of the following channels: (1) Via Facebook: remove our app from Facebook → Settings & privacy → Settings → Apps and websites, then select our app and request data deletion. Facebook will notify us through an automated Data Deletion Request. (2) Directly with Ondnet: email privacy@ondnet.net from the address associated with your account and include your app username and (if available) your Facebook app‑scoped user ID. (3) In‑product: use Settings → Delete account & data (where available).
What happens when we receive a deletion request
Identity verification: for Facebook requests, we verify the signed_request and parse the app‑scoped user ID; for email requests we may ask for additional verification. Deletion workflow: deactivate access, queue a deletion job, delete or irreversibly pseudonymise personal data in active systems, cascade deletion to downstream processors and log confirmations. Backups and logs: data in immutable backups is not actively edited; it will be overwritten on the next scheduled rotation (currently up to 90 days). Timeframes & confirmation: we start deletion immediately and complete it within 30 days (extensions permitted by GDPR where necessary; we’ll notify you if needed). For Facebook‑initiated requests, we return a status URL and confirmation code.
Facebook Data Deletion Request callback
Our HTTPS endpoint receives Facebook’s POST containing a signed_request; we verify it using our App Secret and extract the app‑scoped user ID. We initiate deletion and respond with JSON: { url: 'https://ondnet.net/deletion-status?code=<CONFIRMATION_CODE>', confirmation_code: '<CONFIRMATION_CODE>' }. This URL lets you check the current status; the code is your reference.
Exceptions (when we may delay or refuse deletion)
We may retain data where necessary to: comply with a legal obligation; establish, exercise or defend legal claims; prevent fraud or abuse; meet financial record‑keeping rules. We will explain any refusal and your rights to complain.
Third‑party processors
Where we use certified processors (e.g., hosting, analytics, communications), we flow down deletion obligations via contract and verify completion. A current list of processors is available on request.
Records & audit
We maintain an internal deletion log containing request date, identity verification outcome, systems affected, processors notified, completion timestamps, and confirmation code.
Questions or complaints
Email: privacy@ondnet.net. You may also contact Malta’s supervisory authority, the Office of the Information and
Data Protection Commissioner (IDPC), Floor 2,
Airways House,
Triq Il‑Kbira,
Tas‑Sliema, SLM 1549,
+356 2328 7100,
idpc.info@idpc.org.mt
or use their online forms: https://idpc.org.mt/contact/.
