GDPR and Your Data Rights

What this covers

The privacy policy sets out what is held and on what basis. This document handles the mechanics of making us act on it. Substance there; procedure here.

1. Controller or processor

Two distinct relationships run through one platform, and which applies determines who must answer you.

• Data about you as our customer — account, invoices, tickets, registrant records. We determine the purposes, so we are controller and the request rests with us.
• Data inside a site you host — your members, orders and subscribers. It exists because you put it there and you determine what happens to it. A request from one of your users is directed back to you; the data processing addendum governs that relationship.

2. Available rights

• Access — a copy of the personal data held about you.
• Rectification — correction of inaccuracies.
• Erasure — subject to overriding obligations. Invoices are the usual one: six years is a statutory retention period and outranks a preference.
• Restriction — processing suspended while accuracy is disputed.
• Portability — data you supplied, machine-readable, where held on consent or contract.
• Objection — to processing under legitimate interests. Objection to direct marketing is absolute; no balancing applies.
• Withdrawal of consent — at any time where consent was the basis, without retrospective effect.

3. Filing

Email info@hostingally.com with "Data request" in the subject, or use the contact page. No form, no prescribed wording, no need to cite the legislation — a plain sentence is a valid request and is treated as one.

Include:

• what you want to happen;
• the account or email address concerned;
• any narrowing you can offer — a system, a date range. Optional, but it produces a sharper answer than a request for everything.

4. Identity

Disclosing an account's data to whoever asks would itself be a breach, so identity is confirmed first. A request from the registered address normally suffices. For closed accounts, or requests made on another's behalf, one further check is requested with the reason stated.

Identity documents are requested only where nothing lighter suffices, and are destroyed once the check completes.

5. Deadline

One calendar month from the point identity is established. Complex or repetitive requests may extend by two further months, in which case the reason reaches you inside the first month rather than at its end.

No charge applies. The legislation permits one for manifestly unfounded or excessive requests; we would rather explain the assessment than invoice for it.

6. Refusals

Requests are sometimes declined in part — erasure that would destroy records required by law, or access that would disclose a third party's data alongside your own. Where that happens you receive the reason, the exemption relied upon, and the route to challenge. Silence is not an outcome we use.

7. Escalation

Start with the complaints procedure — faster, and we may simply have erred. There is no obligation to, and approaching the regulator directly costs nothing.

The supervisory authority for England and Walesis the Information Commissioner's Office at ico.org.uk, which accepts complaints from the public directly.

8. The controller

Fairdeal Renovations Limited, registered in England and Wales under Company No. 15026869, trading as HostingAlly. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA. Requests to info@hostingally.com.