Procedure for exercise of rights

For example, it might happen that people registered with your website hosted by IKOULA, or people who know that their personal data exist in the hosting site that we provide you, ask us directly to exercise their GDPR rights, instead of going to you directly.

For example, take a person who saw his photograph on your website, who wants to remove it or a person who would like to change his details.

In principle, this person should contact you directly: in this case we act as a sub-contractor, such that a natural person whom he should approach is you, the process manager.

But, because there may be some difficulties to reach you or simply because this person would have obtained our contact information in your legal disclaimer and so, the concerned person may contact us directly by mistake.

As per the General Rules on Data Protection GRDP), and more exactly its article 28-3 e), IKOULA, when it is acting as a sub-contractor, helps you, in everyway possible, to fulfil your obligation, in your capacity as the process manager, to act on the request about which the concerned person had contacted us for exercising their rights, provided under chapter III of GRDP.

More specifically, this procedure tells you how IKOULA manages requests that it might receive from people involved in data processing for which you are the process manager and for whom we are the sub-contractor, for the rights of the concerned persons. Mainly it concerns the following rights: right to access, rectification, removal and contestation, right to restrict processing, right to data portability, right to not be subject to automated individual decision-making (including profiling).

As per specific contractual terms signed mutually or when we have not signed any specific document under IKOULA conditions relating to GRDP that you can refer to hereand specifically article 7 of the IKOULA conditions relating to GRDP, when the persons contacting us requesting for exercising the rights, we will “send you these requests as soon as we receive them through email to the address indicated by Client at the time of registering for the services”.

When you receive the email through which we had intimated you the request for exercise of rights, you have to act fast: you have one month to respond to the request of the concerned person.

You still have some questions about how you should respond to requests made by data subjects about their data?

Please click on the below link, on the ICO website:

Of course, if you face even a small problem, please do not hesitate to contact us, either by email or over phone no. given below, so that we can help you by contacting our Data Protection Representative:

Jean-Maxime PEYRAT
H&P Avocats,
26 rue Saussier Leroy,
75017 PARIS
Telephone : +33 (0)1 86 95 08 58