That’s how it should be. You have your data under your control and give companies access which you then can revoke whenever you wish.