In Customer zero we described how Alethexis applies to itself the method it sells. This is the less comfortable part: what we found when we audited our own lead capture —the resource forms, the assessment and the newsletter— and saw that five things our texts promised were fulfilled by no mechanism at all.
The pattern
None of the five was a sentence written knowing it was false. They all had the same shape: a public text stated a practice, and the mechanism that should carry it out did not exist or was not switched on. The text was written before the mechanism, and nobody went back to check that the mechanism had arrived.
The GDPR names this. Its Article 5(2) provides that "the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1". A promise without a mechanism cannot be demonstrated.
The five
1. Twelve months of retention nobody was counting. Three surfaces —the notice on the resource form, the assessment text and the record of processing activities— stated that requests were kept for twelve months. No task deleted them. This is the principle in Article 5(1)(e) GDPR: data "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". The first deadline would have fallen on 10 July 2027, so it had no effect. A daily task now deletes requests older than twelve months, except those from people who became customers.
2. Thirty days' notice that nobody asked for. The data processing agreement (DPA) we sign with customers requires us to notify them at least 30 calendar days before adding a sub-processor. Adding a sub-processor in July 2026 left no record of that notice: the clause existed, but the onboarding process did not ask for it. An automated check now fails if a new sub-processor in the DPA annex has no recorded notice date.
3. A first layer carrying what was not its own. The information shown next to a form —the first layer— carried the retention period, which belongs to the further information, and did not say who receives the data or whether it leaves the European Economic Area. The data protection officer set the order: controller, purpose, legal basis, recipients and transfers, rights and a link to the second layer. That is now how it reads on the resource and newsletter forms, and next to the communications checkbox it says that leaving it unticked does not prevent the download.
4. A newsletter without a clock. The privacy policy stated that subscriber data is kept until unsubscription or 24 months of inactivity. Nothing carried it out: the retention task only covered the contact list, not the newsletter list, nor the contact stored with the email provider. A monthly task now deletes, at the email provider, the contact of each subscriber inactive for 24 months, keeps their opt-out if they had one and anonymises their record. It does not depend on any switch that could be left off.
5. An opt-out lost on anonymisation. When someone unsubscribed, the opt-out lived in their own contact record. But the retention task also anonymised unsubscribed records, and anonymising removed the email. If that same person left their email again months later, they came in as a new contact, without the opt-out. It did not happen: no record had been anonymised. The opt-out now lives in a separate register that keeps a fingerprint of the email, never the email itself, survives anonymisation and is checked on every sign-up and before every commercial send. If the check fails, nothing is sent.
How they were found
Not through an incident. Through the written criteria of the data protection officer, on 29 and 30 September 2026, checked against what production actually did: for each commitment in the public texts, which mechanism fulfils it, where it runs and how we know it has run. In five cases, the answer to the first question was "none".
What others can use
The check is short and needs no tools. Take your privacy notice and your record of processing activities and, for each sentence that promises something —a deadline, a notice, an opt-out—, answer three questions:
- Which mechanism fulfils it: a task, a process, a named person?
- Is it switched on in production, not just written in the code?
- How would you know it had stopped working?
If a sentence has no answer to the first question, the sentence is ahead of the mechanism. It is cheaper to find it that way than on the day someone asks.
Content in accordance with Article 5(1) and (2) of Regulation (EU) 2016/679. The facts described are Alethexis's own and are documented in its internal change records.
This article is for information purposes only and does not constitute legal advice.