GDPR and Your Data Rights

What this page is for

The privacy policy covers what is held and why. This one covers how you make us act on it — the procedure rather than the substance.

1. Who answers, with a reseller in the middle

Most hosting companies describe two roles. Because a large share of what runs here is resold, there are effectively three positions and it matters which one you occupy:

• You are our customer, asking about your own data. Account, invoices, tickets, registrant records. We are controller and we answer.
• You are our customer asking about data in your site. Your members and orders. You are controller, we are your processor, and the data processing addendum governs it.
• You bought hosting from a reseller. Then your contract is with them, not us. They are the controller for your account data and we hold it on their instruction. Requests should go to the company that invoiced you; we will point you there and, where we can identify them, tell them you asked.

2. The rights

• Access — a copy of what is held about you.
• Rectification — inaccuracies corrected.
• Erasure — subject to overriding duties. Invoices are the usual one: six years is statutory and outranks a preference.
• Restriction — processing paused while accuracy is disputed.
• Portability — data you supplied, machine-readable, where held on consent or contract.
• Objection — to legitimate-interests processing. For direct marketing it is absolute; no balancing applies.
• Withdrawal of consent — any time, without retrospective effect.

3. Filing

Email info@hosting-seller.com with "Data request" in the subject, or use the contact page. No form and no legal phrasing required — a plain sentence is a valid request and is treated as one. Tell us what you want, which account or address it concerns, and any narrowing you can offer.

4. Confirming identity

Handing account data to whoever asks would itself be a breach. A request from the registered address normally suffices; for closed accounts or third-party requests we ask one further check and say why. Identity documents are requested only where nothing lighter will do and are destroyed once checked.

5. Timing and cost

One calendar month from establishing identity, extendable by two months for genuinely complex or repetitive requests — in which case you hear the reason inside the first month. No charge; the law permits one for manifestly unfounded or excessive requests, but we would rather explain the assessment than bill for it.

6. Refusals

Some requests are declined in part — erasure that would destroy records the law requires, or access that would expose a third party's data. You get the reason, the exemption relied on, and how to challenge it. Silence is not an outcome we use.

7. Escalating

Start with the complaints procedure, or go straight to the regulator — that costs you nothing and needs no permission from us. For England and Wales it is the Information Commissioner's Office at ico.org.uk.

8. The controller

IGI Security Services Ltd, registered in England and Wales under Company No. 15881180, trading as Hosting Seller. Registered office: 60 Tottenham Court Road, Suite 4944a, Fitzrovia, London, United Kingdom, W1T 2EW. Requests to info@hosting-seller.com.