Ghost is a European-headquartered company and a GDPR controller and processor under EU Regulation 2016/679 and, where relevant, the UK equivalent (the UK GDPR and the Data Protection Act 2018). This page summarises how Ghost complies with European data-protection law, what rights you have as a data subject, and the practical channels for exercising them. Where you need more detail, our full Privacy Policy and our Data Processing Agreement are the authoritative documents.
Your rights as a data subject
Under the GDPR you have a set of rights over the personal data we process about you. We respond to every valid request within 30 calendar days, free of charge, and may extend by a further 60 days for complex requests (with notice). We require reasonable identity verification before acting on any request.
- The right of access (Article 15) — receive a copy of the personal data we hold about you and information about how it is processed.
- The right to rectification (Article 16) — have inaccurate or incomplete data corrected without undue delay.
- The right to erasure / right to be forgotten (Article 17) — have your personal data deleted where one of the statutory grounds applies. Note that some categories of data may be retained for the period required to meet a legal or tax-accounting obligation.
- The right to restrict processing (Article 18) — restrict how we use your data while a dispute or correction is resolved.
- The right to data portability (Article 20) — receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
- The right to object (Article 21) — object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
- The right not to be subject to solely automated decisions (Article 22) — Ghost does not currently make decisions about you that produce legal or similarly significant effects without human involvement.
- The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
- The right to lodge a complaint with a supervisory authority — most often your local EU data-protection authority, or the UK Information Commissioner's Office at ico.org.uk.
Submit any request to privacy@useghost.me, or from the Privacy & Data controls inside your dashboard. If you prefer to write, our postal address is on the contact page.
Legal bases we rely on
- Article 6(1)(b) — performance of contract. Most processing is necessary to provide the Ghost service you have subscribed to: scanning sources for your identifiers, filing removals on your behalf, notifying you of exposures, and maintaining the dashboard.
- Article 6(1)(a) — consent. We rely on consent for optional features (e.g. analytics and marketing cookies, dark-web email scanning where local law requires opt-in).
- Article 6(1)(c) — legal obligation. Tax, accounting, and statutory record-keeping requirements.
- Article 6(1)(f) — legitimate interests. Security, abuse prevention, service improvement using aggregated data, and establishing or defending legal claims, weighed against your interests and fundamental rights.
International transfers
Where personal data of EU, UK, or Swiss data subjects is transferred outside the EEA / UK / Switzerland, Ghost relies on the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and Swiss-specific adaptations. We perform and document Transfer Impact Assessments for each receiving country and apply supplementary technical and contractual measures (encryption, pseudonymisation, transparency reporting on government access requests). See our DPA for the contractual detail.
Data Protection Officer
We have appointed a Data Protection Officer who is responsible for overseeing our compliance with European data-protection law. You can reach the DPO directly at dpo@useghost.me. The DPO is also the named point of contact for supervisory authorities.
EU and UK representatives
Where required by Article 27 of the GDPR or Article 27 of the UK GDPR, we have appointed representatives within the EU and the UK. The current representatives, their postal addresses, and an email channel are listed in section 16 of our Privacy Policy. You may contact them directly to exercise any of your rights.
Children and special-category data
Ghost is not directed at children and we do not knowingly collect personal data from anyone under 18 (or under the local digital-age of consent where it is lower). We do not invite, and ask you not to submit, special-category data (Article 9) such as health, biometric, or genetic information.
Updates
We review this page at least annually and after any material change in European data-protection law or in our processing. The latest version is always available at this URL. For material changes we give at least 30 days' advance notice by email or in-app banner.