GDPR and Your Data Rights

What this page adds

The privacy policy answers what we hold and why. This one answers the practical question that follows: how do you make us do something about it. Read that page for the substance and this page to file a request.

1. Two relationships, two answers

The platform carries two very different kinds of personal data, and which one you are asking about changes who has to answer you.

• Data about you as our customer. Account, billing, tickets, domain registrant records. We decide what happens to it, so we are the controller and the request lands with us.
• Data inside a site you host. Your members, your orders, your newsletter subscribers. We only hold it because you put it there; you decide what happens to it. A request from one of your visitors gets pointed back to you, and the data processing addendum is the contract governing that arrangement.

2. The rights themselves

• See it — a copy of the personal data we keep about you.
• Correct it — anything wrong gets put right.
• Delete it — unless something outranks the request. Invoices usually do: HMRC requires six years of them, and a statutory duty beats a preference.
• Freeze it — processing paused while a dispute over accuracy is settled.
• Take it elsewhere — the data you supplied, machine-readable, where we hold it on consent or to perform a contract.
• Object — to anything we do on legitimate interests. Object to marketing and there is no balancing exercise; it simply stops.
• Withdraw consent — whenever you like, where consent is the basis. It does not retroactively make past processing unlawful.

3. Asking

Send it to info@hostingfastnet.com under a "Data request" heading, or raise it from the contact page. There is no form and no required phrasing — you do not need to quote the legislation, and a plain sentence is a valid request that we will treat as one.

Tell us:

• what you want to happen;
• which account or email address it concerns;
• any narrowing you can offer — a system, a period. Optional, but a targeted request tends to produce a far more useful answer than "everything".

4. Checking it is you

Releasing an account's data to whoever emails about it would be a breach in itself, so identity gets confirmed first. A message from the address on the account normally settles it. For closed accounts, or requests made for somebody else, we will ask for one more check and tell you why we need it.

Identity documents are requested only when nothing lighter works, and they are destroyed as soon as the check clears.

5. Timing

One calendar month, running from the point we can identify you. Genuinely complex or repetitive requests may take up to two months longer, and if that happens you will hear the reason within the first month rather than at the end of it.

There is no charge. The law allows one for manifestly unfounded or excessive requests; we would rather explain why we consider a request excessive than send an invoice.

6. Refusals

Some requests get declined in part — a deletion that would destroy records we must keep, or an access request that would hand you somebody else's data alongside your own. When that happens you get the reason, the exemption we are relying on, and how to challenge it. What you will not get is no reply.

7. If you are not satisfied

Come back to us first through the complaints procedure — it is faster and we may simply have made a mistake. You are under no obligation to, and going straight to the regulator costs you nothing.

For England and Wales that regulator is the Information Commissioner's Office at ico.org.uk, which accepts complaints from the public directly.

8. The controller

Vitalcare at Home Ltd, a company registered in England and Wales under Company No. 15098204, trading as HostingFast. Registered office: Office 4648, 221–323 High Road, Chadwell Heath, Romford, England, RM6 6AX. Requests to info@hostingfastnet.com.