REPUBLIC OF CYPRUS OFFICE OF THE COMMISSIONER FOR PERSONAL DATA PROTECTION Our ref. 11.17.001.007.188 10 October 2019 HOSTINGER INTERNATIONAL LTD 61 Lordou Vironos Street 6023 Larnaca, Cyprus Subject: Examination of complaints – exercise of data subjects’ rights under the GDPR Dear Mr XXXXXX, Further to the exchange of communications between the Commissioner and HOSTINGER concerning two complaints involving HOSTINGER, we would like to bring to your attention the following assessment of the Commissioner. Complaint lodged in Spain In July 2018 a complaint was lodged with the Spanish Agency for Data Protection by Mr. XXXXX regarding HOSTINGER’s failure to comply with his erasure request. The data subject requested by e-mail the erasure of his data on 30/05/2018 and 10/07/
- The emails were sent to es@hostinger.com with copy to gdpr@hostinger.com. HOSTINGER did not react to these requests nor send any other response to the data subject. Complaint lodged in Germany While the investigation of the complaint of Mr XXXXXX by the Commissioner was ongoing, a similar complaint was lodged in January 2019 in Germany by Mr. XXXXXX. The complainant claimed that he sent a data subject access request (SAR) by e-mail to gdpr@hostinger.com on 9 December 2018 and did not receive any reaction from HOSTINGER. Hostinger’s response In your initial response to the Commissioner regarding the complaint of Mr. XXXXXX you affirmed that you have searched the mentioned mailboxes - es@hostinger.com and gdpr@hostinger.com – and did not find any message from the data subject, that you also searched the spam and trash folders with no results, that you reviewed the chat records and did not find any conversation with the data subject and that you also contacted the Spanish speaking customers support agents of HOSTINGER and they do not remember such request. You assured that your agreements, policies and processes were reviewed and amended in April 2018, that your staff is well trained and have directions about GDPR requests; you follow GDPR procedures and delete customers’ data when requested. In your letter of 30th May, you provided a copy of the register of client deletion requests, which showcases the amount of handled cases. The register of client deletion requests consists of 985 closed issues as of that date. 1 Iasonos str., P.O. Box 23378, 1682 NICOSIA, CYPRUS Tel.: +357 22818456, Fax:+357 22304565 E-mail: commissioner@dataprotection.gov.cy ,Website: http://www.dataprotection.gov.cy You confirmed that the reason of non-compliance with the erasure request of the data subject is that you did not find any evidence that a deletion request was received and you further confirmed that henceforth you complied with the erasure request and took all necessary actions to delete from your system all personal data of Mr. XXXXXXX. Further to this, in your letter of 30th May you provided explanations regarding proof of the online verification process you carried out, specifically about requests sent by data subjects to the email gdpr@hostinger.com. Concerning the complaint of Mr. XXXXXX, you affirmed that you never received the data subject request, this is the reason he did not receive any response from you. Following the investigation of the Commissioner, you carried out an internal investigation as per above, but no evidence of the SAR was found. You confirmed that following the complaint, you provided the requested information to Mr. XXXXXX and informed him that his e-mail address and other account data shall not be processed for advertising and marketing purposes, including public opinion polling, as per his request. Commissioner’s assessment In light of the explanations provided and the actions taken by HOSTINGER to address the issues at stake, we do not currently intend to take any regulatory action on these complaints. The Commissioner reserves the right, in the event of any future complaints lodged by data subjects, to use all powers afforded to her by the GDPR and by national Law 125(I)/
- We thank you for your cooperation in these matters. Best regards, Commissioner for Personal Data Protection