Data deletion

This Data Deletion Policy explains how individuals can request deletion of personal information that Dubuque Main Street (“DMS,” “we,” “us”) maintains, and what exceptions may apply. This policy complements our Privacy Policy.

1) Scope

You can request deletion if you are:

A site visitor or newsletter subscriber
An event registrant, ticket buyer, donor, nominator/applicant for programs or grants
A business owner/manager who submitted a listing or updates
A person who provided media (photos, testimonials, stories) or completed a survey/form

“Personal information” means data that identifies or can reasonably be linked to you (e.g., name, email, phone, account/profile details, submissions tied to your identity).

2) What “deletion” means

When we delete personal information, we will either erase it, anonymize it so it can no longer identify you, or de-identify it for aggregated reporting. Deletion applies to our active systems. Copies in routine backups will be overwritten on their normal cycle and are not used for active processing.

3) How to request deletion (simple steps)

Send an email to privacy@dubuquemainstreet.org with:

Your full name
The email address and (if applicable) phone you used with us
A brief description of what you want deleted (e.g., “newsletter subscription,” “business listing contact,” “event registration,” “donation profile,” “all personal data”)

If you’re an authorized agent, include proof of authority and a way for us to verify the consumer’s identity.

If you prefer, you may also use our website’s Contact form and select “Privacy / Data Deletion.”

4) Verification

To protect you, we verify requests. We may ask you to:

Reply to a verification email sent to the address on file, or
Provide limited additional details (e.g., recent event registered, business name) to confirm identity, or
If acting as an agent, provide the consumer’s signed authorization.

5) What we delete (typical examples)

Newsletter subscriptions and related contact preferences
User profiles or admin access you were granted on our Site
Contact details attached to event registrations, nominations, surveys, or general inquiries
Personal details tied to business listings (e.g., owner name, personal email/phone). We can also remove entire listings upon owner request; note that public facts about a business (name, address) may remain in non-personal, directory-style form if independently sourced.

6) What we may retain (legal or operational exceptions)

We may deny or delay deletion where keeping data is necessary to:

Comply with laws and audits, including charitable records, tax, and accounting requirements (e.g., donation and financial records are typically retained 7 years).
Complete transactions you requested, provide services you expect (e.g., an upcoming event), or enforce refund and chargeback rules.
Detect, prevent, or investigate security incidents, fraud, or misuse.
Maintain records of prior consents or opt-out preferences.
Keep aggregate/de-identified analytics that no longer identify you.
Preserve information needed for legal claims or defenses.
Maintain routine system backups (automatically overwritten on a rolling cycle, typically 30–90 days).

If an exception applies, we will limit use of the retained data to the permitted purpose and delete it when the purpose ends.

7) Third-party platforms & processors

We use trusted service providers (e.g., payment/donation processors, ticketing platforms, email services, survey tools, map/media hosts, web analytics). When we delete your data, we will also forward your request to relevant processors we engaged for your activity, or instruct you how to contact them directly when required by their policies. Deletion from those platforms will follow each provider’s own timelines and rules.

8) Facebook/Instagram (“User Data Deletion”)

If you connected a Dubuque Main Street Facebook Page or interacted with our Facebook/Instagram integrations:

Email privacy@dubuquemainstreet.org with subject “Facebook Data Deletion Request.” Include your name, the Page name/ID, and the email you used.
We will revoke tokens and delete associated logs not required for security or audit, then confirm completion.
You may also revoke our access in your Facebook/Instagram settings at any time.

9) Timelines

We aim to respond to deletion requests within 45 days of receipt and verification. If we need more time (e.g., complex or multiple systems), we will notify you and may extend once for a reasonable period as permitted by law. For EEA/UK residents, we generally respond within 30 days (with permissible extensions for complexity).

10) Outcomes you can expect

We will confirm one of the following:

Deleted: We erased/anonymized the personal data in active systems.
Partially deleted: Some data removed; specified items retained under Section 6.
Denied (with reason): We’ll explain why and, where applicable, how to appeal.

11) Appeals

If you believe we erred or improperly denied your request, reply to our email with “Appeal” in the subject line. We’ll have a different reviewer evaluate and respond within a reasonable period consistent with applicable laws.

12) Children’s information

Our Site isn’t directed to children under 13. If you believe a child provided personal information, contact us. We will delete it promptly unless retention is legally required.

13) Changes to this policy

We may update this policy from time to time. The Effective date above shows the latest version. Material changes will be posted on this page and, when appropriate, highlighted on the Site.

14) Contact

Dubuque Main Street
Email: privacy@dubuquemainstreet.org
Mailing address: 1069 Main Street, Dubuque, IA 52001
Phone: 563-589-4400