Data Deletion

1. Purpose

Calceum Limited (“Calceum”, “we”, “us”) explains on this page how to have personal data we hold about you deleted. It covers data from every part of the Calceum service, including data we receive from third-party platforms such as Meta (Facebook, Instagram and WhatsApp) when you or your accounting practice use our integrations.

This page is also the data deletion instructions page for Calceum’s Meta app.

• Registered: Calceum Limited, company no. 17240312, Red Gables, West Common, Harpenden, AL5 2JQ
• Contact: privacy@calceum.com
• ICO registration: ZC156359

2. Who can request deletion

Three groups can ask, and the route differs because the responsibility does:

• Someone who contacted an accounting practice through its Facebook Page, Instagram account or WhatsApp number, or who submitted one of its lead forms. That practice is the controller of your data and Calceum acts as its processor, so section 5 applies to you.
• A practice that uses Calceum, or a member of its staff, asking about the practice’s own account, its connected channels, or a person on its records.
• Someone acting on another person’s behalf, with reasonable evidence of authority to do so.

3. How to request deletion

Email privacy@calceum.com from the address you want us to act on, with the subject “Data deletion request”. To help us find the right records, tell us:

• who you are: your name, and the practice you deal with or work at, if any;
• what you would like deleted: everything we hold, or something specific such as the messages you sent to a practice through a social channel;
• where the data came from, if you know: the Facebook Page, Instagram account or WhatsApp number you contacted, and the name or handle you used;
• whether you are asking for yourself, for a practice, or on someone else’s behalf.

If we need identification to be sure the request is genuinely yours, we will ask for the minimum necessary and nothing more.

4. Our response timeline

• We acknowledge a request within 5 working days.
• We complete the deletion, or explain which exception applies, within one calendar month, as the UK GDPR requires.
• Where a request is complex, that period may be extended by up to two further months. If we need to do that we will tell you, with the reason, inside the first month.
• We confirm in writing when the deletion is done, and tell you what was retained and why, if anything was.

5. If you contacted an accounting practice through Facebook, Instagram or WhatsApp

When you message an accounting practice through its connected social or messaging channels, or submit one of its lead forms, that practice is the controller of your data and Calceum processes it on the practice’s instructions. You can:

• ask the practice directly. It can delete your record, and its instruction to us covers the copy held in Calceum; or
• email privacy@calceum.com. We will pass your request to the practice and assist it in completing the deletion, and we will tell you that we have done so.

We do not decide on our own account whether a practice’s client records are erased, because they are not ours to decide about. What we can always do is delete the copy we hold once the practice instructs it, and tell you where your request has got to.

6. Data we receive from Meta

Where a practice has connected a Facebook Page, an Instagram professional account or a WhatsApp Business number, the data we receive and store for that practice is:

• Identifiers for the connected account: the Facebook Page ID, the Instagram professional account ID, the WhatsApp Business Account ID and its phone number ID.
• Identifiers for the person messaging: the page-scoped ID (Messenger), the Instagram-scoped ID, or the WhatsApp number, and the sender’s name as Meta provides it.
• The messages themselves: message content, message IDs, timestamps, and any media sent to the practice.
• Lead form responses: the answers a person gave to the practice’s own lead form.
• The connection’s access token, held encrypted, so the practice’s channel keeps working.

We do not receive or store passwords, friend or follower lists, posts, insights, or advertising data, and we do not use any of it for advertising or profiling.

7. Removing Calceum’s access at Meta

If you are a practice user who connected a channel and you want to revoke that access:

• Disconnect in Calceum. The integration settings let you disconnect a channel. Collection stops straight away: no further messages, sender details or lead responses are received or stored. The connection record itself, including its stored access token, is kept in a disconnected state so that reconnecting later keeps your history. It is not used while the channel is disconnected, and it is deleted on request.
• Remove Calceum at Meta, for Facebook and Instagram. Go to Settings & privacy → Settings → Business integrations, select Calceum, and choose Remove. Calceum connects through Facebook Login for Business, so it appears there and not under “Apps and websites”, which lists personal-account apps only. Instagram is covered by the same entry, because it connects through the linked Facebook Page.
• WhatsApp has no self-serve equivalent. Disconnect in Calceum and email privacy@calceum.com, and we will remove our app’s subscription to your WhatsApp Business Account.
• Then ask for the stored data to be deleted. Removing access stops anything new arriving; it does not by itself erase what has already been stored. Email privacy@calceum.com to have that deleted too. What we delete, what we may retain, and how long a copy can persist in backups are set out in sections 8 and 9.

8. What deletion covers, and what we may retain

On a verified request we delete the personal data we hold about you, including the data listed in section 6. Two limits apply:

• Where the data belongs to a practice’s records, deletion follows the practice’s instruction, as described in section 5.
• We may retain data we are legally required to keep, for example accounting or anti-money-laundering records, and only for as long as that law requires. Anything retained stays protected as set out in the Privacy Policy.

9. Residual data in backups and logs

Deleting a record from our live systems does not instantly remove every copy of it, and we would rather say so than imply otherwise:

• Database backups are encrypted and held on a rolling cycle, currently 7 days. We do not keep long-lived copies of the database outside that cycle.
• Operational logs are kept for 30 days. They record message identifiers, delivery events and error information rather than message content.
• We do not restore deleted data from backups except to recover from an incident.

10. Sub-processors

Where a sub-processor holds a copy of the data, we instruct it to delete that copy using whatever deletion mechanism it provides, and we keep a record of the instruction. We cannot guarantee the timing inside another provider’s systems beyond what its own terms commit to. The providers we use are listed on the Sub-Processors page.

11. Complaints

If you are not satisfied with how we handle a deletion request, contact privacy@calceum.com. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

12. Review

We review this page at least once a year, and whenever the service, our sub-processors or the applicable law change. The date below is the last revision.

Last updated: 12 September 2026