Your data rights

1. Overview

If HS Ocean holds personal data about you, the GDPR gives you a set of rights over it. This page explains what those rights are, how to use them, what we will ask you for, and how long we take.

There is no request form on this website. Requests are handled through a monitored inbox and a postal address so that a person reads each one. That is slower than a widget and considerably more reliable.

Everything on this page is free of charge.

2. Your rights

Subject to the conditions set out in the GDPR, you may:

1. Ask what we hold and why (access). You can request confirmation of whether we process personal data about you, a copy of it, and information about the purposes, recipients, retention and the source it came from.
2. Correct it (rectification). If something is wrong or incomplete, we will fix it and, where we have passed it on, tell the recipient.
3. Ask us to delete it (erasure). Where one of the grounds in Article 17 applies, we will delete it. Where an exception applies — for example a legal obligation to keep a record — we will say which one and why.
4. Ask us to pause (restriction). In the situations set out in Article 18 we will keep the data but stop using it, other than to store it, while a question is resolved.
5. Take it with you (portability). Where processing is based on consent or a contract and carried out by automated means, we will provide the data in a structured, commonly used, machine-readable format.
6. Object. You can object to processing based on our legitimate interests, and you can object to direct marketing at any time. For direct marketing there is no balancing test: we stop.
7. Withdraw consent. Where processing relies on consent you can withdraw it at any time, and it is as easy to withdraw as it was to give. Withdrawal does not affect processing already carried out lawfully.
8. Complain. You can complain to a supervisory authority at any time, whether or not you have raised the matter with us first.

2.1 Stopping contact is always available

Independently of any formal request, anybody can simply ask not to be contacted again in connection with an enquiry made through our network. We apply that across every line of business and every country we operate in, not only to the campaign the person happened to touch. We act on it whether or not the GDPR is engaged.

3. How to make a request

3.1 By email

Write to contactus@hsocean.eu with “Data rights request” in the subject line. To help us find your data quickly, please include:

• which right you want to use;
• the email address and telephone number you think we may hold;
• the country you are writing from;
• roughly when you think the enquiry was made, if you remember;
• whether you are writing for yourself or on somebody else's behalf.

3.2 By post

Write to the address in section 7, marking the envelope “Data rights request”. Include the same details and a return address or email so that we can reply.

3.3 Requests about a specific insurer

Once an enquiry has been passed to an insurer, intermediary or comparison platform, that business becomes an independent controller of the copy it received and applies its own retention rules. We can tell you which categories of recipient were involved and, where we hold the information, help you identify who received it, so that you can direct a request to them as well. We cannot delete data from another company's systems on your behalf, and we will never obstruct a request you make to them.

4. Identity checks

We must be reasonably satisfied that a request comes from the person it concerns, or from somebody authorised to act for them. Otherwise we would be handing personal data to whoever asked for it.

Verification is proportionate to the sensitivity of what is involved. In most cases confirming control of the email address or telephone number we hold is enough. Where we need more, we will explain exactly what and why. Anything you send us for verification is used only for that purpose and is deleted once the request is closed.

Where we cannot verify identity, we will say so and, where possible, tell you what would let us proceed. An unverifiable request will not simply be ignored.

4.1 Somebody acting for you

An agent, relative or legal representative may act for you with written authority signed by you, or with a valid power of attorney. We may contact you directly to confirm it.

5. How long we take

We acknowledge requests promptly and answer within one month of receiving a request we have been able to verify.

Where a request is complex, or where you have made several, we may extend by up to two further months. If we do, we will tell you within the first month, explain why, and give the date you can expect an answer.

Where we decline a request in whole or in part, we will explain which exception applies, tell you that you may complain to a supervisory authority, and tell you that you may seek a judicial remedy.

Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse to act. We will explain our reasoning rather than simply stop replying.

6. Complaining to a supervisory authority

If you are unhappy with how we have handled your personal data or your request, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), which is our lead supervisory authority.

You may also complain to the supervisory authority of the EU member state where you live, where you work, or where the matter arose. Complaining to an authority does not prevent you from also raising the matter with us, and raising it with us first is not a precondition.

7. Where to write

Please use the subject line “Data rights request” so that your message reaches the right team on the day it arrives. General business enquiries can use the details on our contact page.