GDPR and Your Data Rights

What this page adds

The privacy policy answers what we hold and why we hold it. This page takes the practical question that comes next: how do you make us act on it? Read the other page for the substance, and this one to file a request.

1. Two relationships, two answers

Two very different kinds of personal data sit on the platform, and which of them you are asking about decides who has to answer you.

• Data concerning you, our customer here. Account details, billing, tickets, domain registrant records. What happens to that is decided by us, which makes us the controller, so the request lands here.
• Data held within a site you run. Your members, your orders, the people on your newsletter list. It sits with us purely because you put it there, and you are the one who decides its fate. A request from one of your visitors gets sent back to you, and the data processing addendum is the contract that governs that particular arrangement.

2. The rights themselves

• See it — a copy of whatever personal data we hold on you here.
• Correct it — whatever is wrong gets corrected.
• Delete it — unless something outranks it. Invoices normally do, since HMRC requires six years of them, and a statutory duty will always beat a preference.
• Freeze it — processing goes on hold until a dispute about accuracy is resolved.
• Take it elsewhere — the data you gave us, in machine-readable form, where the basis is consent or performing a contract.
• Object — to anything we run on legitimate interests. Object to marketing and no balancing exercise takes place at all; it just stops.
• Withdraw consent — at any moment you choose, wherever consent is the basis. Past processing does not become unlawful because of it.

3. Asking

Send it to info@hostingfastnet.com under a heading of Data request, or else raise it from the contact page. No form exists and no particular phrasing is required. Quoting the legislation is unnecessary, and a plain sentence counts as a valid request, which is exactly how we will treat it.

Tell us:

• what you want to happen;
• the account or email address it relates to;
• any narrowing you can offer, whether a system or a period. That is optional, though a targeted request tends to bring back a far more useful answer than asking for everything.

4. Checking it is you

Handing over the data on an account to whoever happens to email about it would itself be a breach, so identity is confirmed before anything moves. A message sent from the address on the account usually settles that. Where an account has closed, or the request is made for another person, we will ask for one further check and explain why it is needed.

We ask for identity documents only where nothing lighter will do, and they get destroyed the moment the check clears.

5. Timing

One calendar month, counted from the moment we can identify you. A genuinely complex or repetitive request may run up to two months beyond that, and where it does, the reason reaches you inside the first month rather than at the tail end of the process.

Nothing is charged. The law does permit a fee for manifestly unfounded or excessive requests, but explaining why we regard a request as excessive appeals to us more than sending an invoice.

6. Refusals

Some requests are refused in part: a deletion that would wipe out records we are obliged to keep, or an access request that would hand you data belonging to another person alongside your own. Where that happens you receive the reason, the exemption we rely on, and the route to challenge it. Silence is the one thing you will never get.

7. Where the answer disappoints you

Bring it back to us first, using the complaints procedure — that route is quicker, and we may simply have got something wrong. You are under no obligation to take it, and heading straight for the regulator costs you nothing.

For England and Wales that regulator is the Office of the Information Commissioner, found at ico.org.uk, and it takes complaints from the public direct.

8. The controller

Vitalcare at Home Ltd, a company registered in England and Wales under Company No. 15098204, trading as HostingFast. Registered office: Office 4648, 221–323 High Road, Chadwell Heath, Romford, England, RM6 6AX. Requests to info@hostingfastnet.com.