GDPR and Your Data Rights

What this page adds

The privacy policy says what we keep and why. This one says how you make us do something about it. Read that one for the substance; use this one to file a request.

1. Two kinds of data, two different answers

• Data about you as a customer. Your account, invoices, tickets and the domains registered in your name. We decide what happens to it, so the request lands with us and we answer it.
• Data inside a site you host. Your members, your orders, your subscribers. It is only here because you put it here, and you decide what happens to it. Somebody asking us about their record on your website gets pointed back to you.

2. The rights you can use

• See it — we send you everything on file that counts as your personal data.
• Fix it — anything wrong gets corrected.
• Delete it — unless something outranks the request. Invoices usually do: tax law wants six years of them, and a legal duty beats a preference.
• Pause it — processing stops while a dispute about accuracy is sorted out.
• Take it with you — the data you gave us, in a machine-readable form, where we hold it on consent or to perform a contract.
• Object — to anything we do on legitimate interests. Object to marketing and it just stops; there is nothing to weigh.
• Withdraw consent — whenever you like, where consent was the basis. It does not make what happened before unlawful.

3. How to ask

Put "Data request" in the subject line to info@hosting-cheap.com, or go through the contact page. There is no form, and you do not need to quote the legislation — a plain sentence is a valid request and we treat it as one.

Tell us what you want, which account or email address it concerns, and — if you can — narrow it to a system or a period. That is optional, but it usually gets you a far more useful answer than asking for everything.

4. Checking it is really you

Handing an account's data to whoever emails about it would be a breach in itself, so we confirm identity first. A message from the address on the account is normally enough. For a closed account, or a request on somebody else's behalf, we ask for one more check and explain why.

We only ask for identity documents when nothing lighter will do, and we delete them once the check is done.

5. How long

One calendar month from the point we can identify you. Genuinely complicated or repeated requests can take up to two months longer, and if that happens you hear why inside the first month rather than at the end of it.

There is no charge. The law allows one for requests that are clearly unfounded or excessive; we would rather explain why we think a request is excessive than send you a bill.

6. When the answer is no

Some requests get refused in part — a deletion that would destroy records we have to keep, or an access request that would hand you somebody else's data along with your own. When that happens you get the reason, the exemption we are relying on, and how to push back. You do not get silence.

7. Complaining

Start with us through the complaints procedure — it is quicker and we may simply have got it wrong. You do not have to, and going to the regulator first costs you nothing.

For England and Walesthat is the Information Commissioner's Office, at ico.org.uk, which takes complaints from the public directly.

8. Who holds the data

Bohzo Ltd, a company registered in England and Wales under Company No. 15031604, trading as Hosting-Cheap. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA. Requests to info@hosting-cheap.com.