Your Data Subject Rights

Effective date: 2026-05-13

SpaceHub Ltd (“SpaceHub”, “we”) is the data controller for personal data processed via the platform at spacehub.mu. The Mauritius Data Protection Act 2017 gives every individual a set of rights over their own data. This page explains those rights and how to exercise them.

For the underlying disclosures — what we collect, why, who has access, and how long we keep it — see our Data Protection Policy.

1. Your rights at a glance

• Access. Receive a copy of every piece of personal data we hold about you, in a portable JSON format.
• Rectification. Have inaccurate or incomplete data corrected.
• Erasure. Request deletion of your account and personal data, subject to legal retention obligations (notably tax records, dispute archives).
• Portability. Receive your data in a structured, commonly-used format and ask us to transmit it to another provider where technically feasible.
• Restriction. Ask us to pause processing your data while a dispute or correction is investigated.
• Objection. Object to processing based on legitimate interest, including for marketing analytics.
• Withdraw consent. Where processing relies on your consent (analytics cookies, marketing email), you can withdraw it at any time without affecting prior lawful processing.
• Complain. Lodge a complaint with the Data Protection Office of Mauritius.

2. Self-service tools

Most rights are exercisable directly from your account, without contacting us:

• Export your data. Sign in → Settings → Your data → Download my data. Returns a JSON file with every booking, message, AI conversation, dispute, loyalty entry, and profile field.
• Edit your profile. Sign in → Settings → Profile. Most identity and contact fields are editable inline.
• Delete your account. Sign in → Settings → Your data → Delete account. Requires typing the confirmation phrase. Active bookings are cancelled and you are signed out.
• Cookie preferences. Click the Cookie link in the footer or visit our Cookie Policy.

3. Email-based requests

For everything else — rectification of data we hold but don’t expose for self-edit, restriction or objection requests, or formal access requests — write to our Data Protection Officer at dpo@spacehub.mu. Please include:

• The email address associated with your account.
• The right you are exercising.
• Enough detail to identify the data concerned.

We may ask for additional verification to make sure the request is from the account holder. We respond within 30 calendar days; complex requests may take up to 60 days, with an interim status update.

4. Retention beyond deletion

After you delete your account, we retain a minimum set of records for the following purposes and durations:

• Booking and payment records: 7 years (Mauritius Companies Act and Income Tax Act).
• Dispute case files: 7 years (limitation period for civil claims).
• Audit logs of admin actions: 5 years.

These records are kept in pseudonymised form (your account ID, not your name) where the underlying record allows.

5. International transfers

Personal data is processed on infrastructure operated by Supabase (Pacific region) and Vercel (Mumbai region). Transfers happen under standard contractual clauses and are limited to what is necessary to run the service.

6. Children

SpaceHub is not intended for users under 18. If you believe a child has created an account, please contact dpo@spacehub.mu and we will delete it.

7. Contact

Data Protection Officer
SpaceHub Ltd
Port Louis, Republic of Mauritius
dpo@spacehub.mu