DATA POLICY
GDPR Compliant Data Handling
✅ Our data handling practices meet EU GDPR requirements with appropriate safeguards, documented processes, and verified compliance measures.
Data Policy Overview
Last Updated: September 9, 2025
This Data Policy explains how Hamhey collects, uses, processes, and protects your personal data when you use our relocation services platform. We are committed to transparency about our data practices and ensuring your privacy rights are respected at all times.
This policy complements our Privacy Policy and Security Policy, providing detailed information about our data handling practices in accordance with GDPR, CCPA, and other applicable data protection regulations.
Data We Collect
Personal Information
- Identity Data: Name, date of birth, nationality, passport/ID information
- Contact Data: Email address, phone number, postal address
- Profile Data: Username, preferences, feedback, survey responses
- Financial Data: Payment information, banking details (processed securely through third parties)
- Academic/Professional Data: University information, course details, employment history
Technical Data
- Device Information: IP address, browser type, device identifiers
- Usage Data: Pages visited, time spent, click patterns, feature usage
- Location Data: Approximate location based on IP address (with consent)
- Communication Data: Messages, chat logs, support interactions
Relocation-Specific Data
- Housing Preferences: Budget, location preferences, accommodation type
- Documents: Uploaded documents (securely encrypted and stored)
- Partner Interactions: Communications with partner organizations
- Service History: Previous bookings, appointments, service usage
How We Use Your Data
Service Provision
- Matching you with suitable accommodation and services
- Facilitating communication with partners and service providers
- Processing payments and managing your account
- Providing customer support and assistance
- Personalizing your experience and recommendations
Legal Basis for Processing
Contract Performance: Processing necessary to fulfill our services to you
Legitimate Interest: Improving our services, fraud prevention, analytics
Consent: Marketing communications, optional features, location services
Legal Obligation: Compliance with applicable laws and regulations
Analytics and Improvement
- Understanding user behavior and preferences
- Improving platform functionality and user experience
- Developing new features and services
- Quality assurance and performance monitoring
Data Sharing & Third Parties
We do not sell your personal data. We may share your data only in the following circumstances:
Trusted Partners
- Accommodation Providers: Sharing necessary information to facilitate bookings
- Educational Consultancies: Connecting you with relevant services
- Property Management Companies: For housing-related services
- Payment Processors: Secure processing of financial transactions
Service Providers
- Cloud Infrastructure: AWS and other certified cloud providers
- Analytics Services: Anonymized data for platform improvement
- Communication Tools: Email, SMS, and messaging service providers
- Security Services: Fraud prevention and security monitoring
Legal Requirements
We may disclose your data when required by law, court order, or to protect our rights, property, or safety, or that of our users or others.
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations.
Retention Periods
Account Data:
Until account deletion + 30 days
Transaction Records:
7 years (legal requirement)
Communication Logs:
2 years for support purposes
Marketing Data:
Until consent withdrawn
Automated Deletion
- Inactive accounts are automatically flagged for review after 3 years
- Temporary files and cache data are regularly purged
- Backup data follows the same retention schedules as primary data
- Anonymized analytics data may be retained indefinitely
Your Data Rights
Under GDPR and other data protection laws, you have several rights regarding your personal data:
Access & Portability
- • Request a copy of your data
- • Download your data in portable format
- • Understand how we use your data
Correction & Deletion
- • Correct inaccurate information
- • Delete your personal data
- • Restrict processing of your data
Control & Consent
- • Withdraw consent at any time
- • Object to data processing
- • Opt-out of marketing communications
Legal Protection
- • Lodge complaints with authorities
- • Seek legal remedies
- • Request data protection impact assessments
How to Exercise Your Rights:
Contact us at privacy@hamhey.com or through your account settings. We will respond to your request within 30 days and may require identity verification.
International Data Transfers
As a global relocation platform, we may transfer your data internationally. We ensure all transfers are protected by appropriate safeguards:
EU-U.S. Data Privacy Framework
We are evaluating participation in the EU-U.S. Data Privacy Framework for enhanced privacy protections when transferring EU data to the US.
Standard Contractual Clauses (SCCs)
EU-approved contracts ensuring your data receives essentially equivalent protection as in the EU when transferred to third countries.
Adequacy Decisions
Transfers to countries with adequate data protection as recognized by the European Commission.
Additional Safeguards
Technical and organizational measures including encryption, access controls, and continuous monitoring of legal developments.
Transfer Impact Assessments:
We conduct transfer impact assessments and implement supplementary measures where necessary to ensure the protection of your personal data during international transfers.
GDPR Compliance Structure
Data Controller
Hamhey Corporation (Delaware, USA)
Responsible for determining purposes and means of data processing
EU Representative
To be appointed as required under Article 27 GDPR
Contact point for EU data protection authorities and data subjects
Data Protection Officer
dpo@hamhey.com
Monitors compliance and serves as contact point for data protection matters
Lead Supervisory Authority
To be determined based on main establishment or EU representative location
Primary regulatory contact for GDPR compliance
Your Right to Complain:
You have the right to lodge a complaint with any EU Data Protection Authority. Find your local authority at your national data protection website (e.g., ICO in UK, CNIL in France, BfDI in Germany).
Data Protection Contact
For any questions about our data practices or to exercise your rights, contact our Data Protection team:
Email: privacy@hamhey.com
Data Protection Officer: dpo@hamhey.com
Response Time: Within 30 days of receiving your request