Obex

Obex is our consumer privacy product. It comes from the same company and the same discipline: find the data, prove where it sits, then get rid of it properly.

The hardware side of what we do has an obvious limit. We can sanitise every drive in your building and the broker who bought your details in 2019 still lists your address on a public search page. That copy was never on a disk we could hold.

What the scan looks for

Obex checks the places UK personal data surfaces.

UK data brokers. 192.com, LocateGB and similar people-search sites, which publish names, ages, addresses and the other people living at that address.

Breach databases. The dumps where your email address and passwords have already leaked.

Public registers. Companies House filings carrying your service address, your date of birth and, on older documents, your home address. These behave differently from the rest, and the section below sets out why.

You get a report of what is exposed and where it sits. The scan is free, and the results are yours to keep if you go no further.

What the law gives you

Article 17 of the UK GDPR gives a right to erasure where the statutory grounds are met. It is a qualified right rather than an absolute one. Article 17(3) disapplies it in several situations, including where the processing is necessary to comply with a legal obligation, or for the establishment or defence of legal claims.

For people-search sites the practical route is often an objection under Article 21. Those sites rely on legitimate interests to hold your record, so the argument is about the balance between their interest and yours, and your circumstances feed into that balance directly.

Either way the controller has one month to respond under Article 12(3), and a refusal has to come with reasons. That deadline is the difference between this and the American removal services, which work through voluntary opt-out forms. A broker can ignore one, sit on it, or quietly restore the record later, and owe you nothing for any of it.

It is not a guarantee. Some records cannot be erased, and a refusal with sound reasoning behind it stands. What you get is a documented request, a reasoned answer, and a record of both.

The paid tiers send the requests on your behalf, chase the responses, and re-scan so you can see what has come down and what has crept back.

Companies House is a separate case

Companies House processes the register under a legal obligation and a public task. That puts it outside Article 17 in almost every case. If you are a director, your name, your appointments and your filing history stay on the public register, and no erasure request changes that.

What is available is narrower. Companies House operates its own statutory routes for suppressing a home address that has appeared on the register, and for withholding your full date of birth from the public record. Those are applications made under Companies House rules on their own terms, not erasure under the UK GDPR, and they do not remove the underlying record.

Any service implying it can delete you from the register is selling something it cannot deliver. Obex tells you what is showing and which of those routes applies to it.

Two surfaces, one problem

On a decommissioned laptop the data sits on hardware you control, so we destroy it at drive level and certify it per drive, referenced to the drive serial and the machine it came out of. That is set out under certified data destruction, along with the collection and manifest it runs on.

Online, the data sits in someone else's database. There is no drive to boot and no command to issue, so the tool is a legal notice rather than an erase.

The question does not change: where are the copies, what can be removed, and what proof do you hold at the end of it.

If you have hardware to clear, get a quote or email oliver@kiverefresh.com. If it is your own data you want off the internet, run the scan first and decide once you have read the report.