GDPR and Your Data Rights

The privacy notice says what we collect, why, and on what lawful basis. This page is the other half: how you actually make us do something about it. If you only want the substance, read that one. If you want to file a request, read this one.

1. Which hat we are wearing

Two different relationships run through the same platform, and your rights differ depending on which one you are in.

• Your own data — we are the controller. Your account, invoices, tickets and the domain records registered in your name. Requests about this come to us and we answer them.
• Your visitors' data — we are the processor. Whatever sits in the database of a site you host with us. We hold it on your instruction and we do not decide what happens to it. If one of your customers asks us for their data, we point them at you. The terms of that arrangement are the data processing addendum.

2. The rights you can exercise

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion, where we have no overriding reason to keep it. Invoices are the usual overriding reason: UK tax law requires six years, and that obligation outranks a deletion request.
• Restriction — processing paused while an accuracy dispute is resolved.
• Portability — the data you gave us, in a machine-readable form, where we hold it on consent or on contract.
• Objection — to processing we do on legitimate interests. Object to direct marketing and it stops, with no balancing test to argue.
• Withdrawal of consent — at any time, where consent is what we relied on. It does not undo what was lawful beforehand.

3. Making a request

Email info@hosting-n-domains.com with "Data request" in the subject, or use the contact form. No particular wording is needed and you do not have to cite the legislation — a plain sentence saying what you want is a valid request and we will treat it as one.

Tell us:

• which right you are exercising, or simply what you want to happen;
• the email address or account the request concerns;
• a date range or a system, if you already know the request is narrow. It is not required, but it usually gets you a useful answer faster than a request for everything.

4. Proving it is you

Handing an account's data to whoever asks for it would itself be a breach, so we confirm identity before acting. A request sent from the address registered on the account is normally enough. Where it is not — a closed account, or a request made on somebody else's behalf — we will ask for one further check and explain why.

We ask for identity documents only where nothing lighter will do, and we delete them once the check is done.

5. How long it takes

One calendar month from the day we have what we need to identify you. Complex or repetitive requests can extend by a further two months, in which case you hear from us inside the first month with the reason.

Requests are free. The law permits a fee for manifestly unfounded or excessive requests, and we would rather explain why we think a request is excessive than quietly bill for it.

6. When we say no

Some requests are refused, in whole or in part — a deletion that would erase records we are legally required to keep, or an access request that would disclose another person's data along with yours. If that happens you get the reason, the exemption relied on, and the route to challenge it. You will not get silence.

7. Complaining

Start with us, through the complaints procedure — it is quicker and we may simply have got it wrong. You do not have to, and going to the regulator first costs you nothing.

The supervisory authority for England and Wales is the Information Commissioner's Office, at ico.org.uk, which takes complaints directly from the public.

8. Who this is with

The controller is UK Health Care Support Ltd, a company registered in England and Wales under Company No. 15042717, trading as Hosting & Domains. Registered office: Office 4648, 58 Peregrine Road, Ilford, England, IG6 3SZ. Data requests go to info@hosting-n-domains.com.