Keeping your data secure and maintaining your privacy is a significant responsibility and one that we take very seriously. We’ve written this policy to help you understand “what” personal information we collect, “how” we process it, “where” it is stored and how you can access or request deletion of your personal data.

We take our obligations in respect of the privacy of personal data very seriously and we will only process personal information as detailed in this notice, unless we inform you otherwise. In order to ensure that the personal data we hold is accurate and up to date, we request that you inform us of any relevant changes to the personal information we hold about you.

Our Data Protection Officer can be contacted at West Toddlehills, Blackhills, Peterhead AB42 0LY or via our normal means of contact (telephone or email).

By accessing, logging into or registering on our websites (or any sub-domains), you agree that it’s okay for us to process your information and personal data in accordance with the terms of this Privacy Policy. If you disagree with any of the terms in this policy, or wish to be no longer bound by these term, we kindly ask that you cease from entering information into our websites and cancel any temporary or rolling subscriptions.

Your Data

When we refer to “Personal Data” we mean any data held on our system that directly or indirectly identifies an individual. This includes information that you have entered onto the system or have granted access to via a third-party integration.

We may also collect Personal Data about you in relation to how you use your account, i.e. where you are logging in from, how often you log in and what specific features you routinely use. This helps us to tailor your user experience and enhance security.

We comply with current UK Data Protection Legislation which implements the European Community’s Directive 95/46/EC and Directive 2002/58/EC, including, but not limited to, the DPA and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

The UK’s DPA 2018 has already enacted the EU GDPR’s requirements into UK law, and with effect from 1 January 2021, the DPPEC Regulations have amended the DPA 2018 to merge it with the requirements of the EU GDPR, forming a new, UK-specific data protection regime that will work after Brexit called UK GDPR.

Information you provide

This includes the Personal Data you provide, or somebody else provides on your behalf when completing any of the following activities:

• Registering a new domain name or hosting account, including related services such as email
• Submitting information or uploading data within an associated account
• Subscribing to a mailing list
• Ordering a standalone product or service (such as cloud MS Exchange)
• Initiating a support request or submitting information on our “contact us” form.
• Completing a product referral form
• Completing an online survey or questionnaire

The information may include the following types of direct or indirect Personal Data:

• Your name
• Your contact information (e.g. phone, email, address etc)
• Employee details
• Personal Data contained within receipts and invoices
• Personal Data contained within uploaded or attached files to email messages
• Personal Data contained within bank account transactions or other merchant service transactions such as Direct Debit

Information we collect

We also collect information about how you use your account, this helps us to deliver a more customised user experience, identify trends and improve security. Some of this data may be “Personal Data”, in cases where it can be used to identify a person. Here is the information we collect and how it is used:

• Login dates and IP addresses – This allows us to understand how you are using our site or your account and identify unusual access patterns.
• Account usages statistics – This includes things like how much time you spend on the website and which features you use. This helps us to optimise your user experience and make you aware of specific features that may be of interest to you.
• Website traffic – This includes general information on how you found our website, which referring site you arrived from (e.g. Google, Facebook etc), and what device or browser you are using. This helps us to improve our marketing strategies and tailor our website for different devices (PC, tablet and mobile phone, for example).
• Order history – This information includes a record of any orders you place. This helps us to fulfil our obligations to you and provide accurate financial records when requested.
• Email opens and bounces – We track when the emails we send are opened or bounced. This allows us to optimise our mailing list by delisting addresses that are inactive or unresponsive.

Information provided to us by third-parties

In some cases we may receive Personal Data that has been passed to us by a third-party such as a payment processor or bank. This information is only received when you explicitly consent to share your information with us.

Safeguarding data

In order to safeguard your information we ask that you take great care to ensure your password(s) remain private and take all reasonable steps to protect your account from unauthorised access. We also ask that when providing the Personal Data of others (within your own website or via your own mailing lists, for example), that you do so with full consent and in accordance with current Data Protection Legislation.

How we use your Personal and Financial Data

In this section we explain how your Personal and Financial Data is used by us.

To provide a service

First and foremost your Personal Data and Financial Data will be used to provide you with a stable and reliable service. We will use your Personal Data to provide you access to our services and from time to time to contact you by email, SMS, post, phone or social media concerning your account or any related matters that may be of interest to you.

You may choose to share your Personal Data with a third-party specialist you engage or to provide additional functionality for your account. Your data must only be shared with your explicit consent, although we do ask that you carry out appropriate due diligence before granting any third-party access to your account.

To improve our service

We will use your Personal Data and Financial Data to improve our service to you. This can be through administering support, tracking feature usage, collaborating on beta development, monitoring and addressing security or resolving bugs. We may from time to time rely on trusted outsourcing partners to help with some of these tasks. In such cases we will always endeavour to perform thorough risk assessment and establish strong privacy controls for any outsourcing partner.

To monitor trends

We collect anonymised data about how people use our website. This includes collecting information on the number of visitors, what pages or features are accessed, which country visitors are connecting to the website from, browser types, display size and average viewing times. We may occasionally share this anonymised data with our community, although we will never include specific Personal Data here or any information that would identify you or your business.

Keeping you informed

We will occasionally contact you by email, SMS, post, telephone or social media to let you know about new features, forthcoming changes and relevant industry news. You reserve the right to opt-out from this type of correspondence at any time. You can either click the unsubscribe link from an email bulletin or contact us and we will arrange that for you immediately.

We may also send you non-promotional notifications to update you on specific activity or events in your account. This may include payment queries or invoicing. It may also include reminders relating to your subscription or account status. If you prefer not to receive these types of notifications, we ask you to close your account.

Cookies

We rely on the use of internet cookies to track user sessions and to store particular preferences that facilitate the use of our website. By accessing the website and its sub-domains, you consent to the use of cookies for the aforementioned purposes. If you do not agree to this then we must advise you to cease using any of the services provided on our website.

Exporting your Data

Upon request we can provide you with an export of your Personal Data and Financial Data in a universal machine readable format. You may also schedule a recurring export of your data on a weekly or monthly interval. These can be delivered by email or copied into your own Dropbox account. Due to the multi-tenanted design of our software, we are unable to restore your account to a specific point-in-time from a previously issued data export.

Deleting your Data (Right to Erasure)

Upon request we will physically delete all Financial Data entered into your account. This can be instructed in writing and will result in the closure of your account. We may need to keep data relating to any HMRC period of retention requirement or investigation.

From May 25th 2018, under the provisions of Article 17 of the GDPR Legislation, you also have the right to request that any Personal Data (Notwithstanding those exemptions listed under Article 17, Paragraph 3) be permanently deleted. Upon receipt of such a request we will take all reasonable steps to ensure that this is completed in an expeditious manner.

We don’t store credit or debit card details

We use (optionally) a third-party payment processor (PayPal) to collect credit and debit card payments for annual subscriptions and related products and services. We never directly collect or store payment card information on our servers.

Our payment processor uses a secure encrypted connection for collecting payment card information and implement all necessary controls to keep your payment data safe. Further information can be obtained from the PayPal website.

OTHER WAYS IN WHICH WE MAY SHARE YOUR DATA

In this section we explain a number of other circumstances in which we may share your Personal Data or Financial Data. Please note we do not and will not sell your data in any way for sales. marketing, advertising or any other purpose.

Third-party web services

In some cases, it may be necessary to share data with a third-party web service you have authorised to work with your web hosting account. This may be something like a WordPress plugin. It may also include the export or backup of your data to a document storage service like Dropbox. You will be able to obtain more information from a plugin developer’s website or from a document storage website such as Dropbox, Google Drive and so on.

In these cases, data must be shared only on the basis that you have provided explicit consent and that you have completed the necessary authorisation for our servers (hosting your website) to pass data to each of these web services. When working with a third-party web service in this way, we always ask that your data is only sent over a secure encrypted connection and that your website should have an SSL certificate installed to prevent unauthorised interception.

Outsourcing partners

In order to provide a robust and reliable service, we depend on a number of cloud service providers to carry out key operations within our business. This includes things like document storage, payment processing, email processing, marketing assistance, social media management,domain name registration and website hosting and security.

Whenever we entrust your data with an outsourcing partner, we always carry out thorough due diligence and ongoing monitoring to ensure that appropriate privacy controls are in place and maintained at all times. Our partners are all required to adhere to the same principles of GDPR and will have an appropriate privacy policy and we will take all reasonable measures not use any provider that does not provide this assurance.

The personal data we collect from you may be transferred to or stored at a destination outside of the European Economic Area (EEA) at your explicit request. For example, you may wish to have your website hosted at a datacentre nearer a geographical area of business you wish to target. We may also hire staff or outsourcing partners who process your data outside of the EEA. In such cases we will share only the minimum data required and ensure sufficient privacy controls are implemented to protect your privacy in accordance with this Privacy Policy. Non identifiable tracking data (like Google Analytics data) might also be processed outside the EEA although we believe they are making efforts to keep this data stored within the EEA – more information on their updated policies can be found here.

Sale of business assets

We reserve the right to share Personal Data with a prospective buyer of business assets. This would be subject to the terms of a Non Disclosure Agreement.

Law enforcement disclosures

We reserve the right to share Personal Data with law enforcement agencies, if the restriction of such information may prejudice an investigation into unlawful activity. Such exemptions will be sought under current Data Protection Legislation and we will have no legal liability for such disclosures.

Keeping your data secure

We recognise the responsibility to ensure that your data is kept safe and secure at all times. We will ensure that whenever your Financial Data or Personal Data is passed to and from our servers, that it is done so on a secure, encrypted connection. This may be when you are accessing data on our or your website or when we are required to exchange data with third-party services.

We also ask that you ensure your password remains private and take all reasonable steps to protect your account from unauthorised access. It is your responsibility to take reasonable precautions to secure your website and to ensure it is running up-to-date systems unless you have paid us to do this on your behalf. For example, if you use WordPress or Joomla you must ensure it is always running the latest version and that all plugins or extensions are also up-to-date.

Data ownership

You own all of the Data you provide to us. More specifically we recognise the owner of an account and the data contained therein as the individual or entity that controls access to the email supplied as part of your login credentials.

In cases where a dispute arises between personnel within your organisation or a third-party, we will play no role in arbitrating such disputes and will acknowledge the email owner as the account holder.

Should a dispute over account ownership arise, we ask that you resolve this by establishing control over any login email address via your IT service provider. When you have relinquished control over the login or account holder email address, you may then proceed to initiate a password reset to regain access to an account.

Your rights

• You have the right to unsubscribe from any promotional materials that we may send from time to time, by way of email, SMS, post, phone or any other medium. You will also receive general notifications about account activity such as when an invoice is due/paid or when a subscription is due for renewal. If you would also wish to cease receiving this type of correspondence we ask that you close your account.
• Right to Erasure – You have the right to request that your Personal Data is deleted (notwithstanding those exemptions allowed under GDPR and the current UK DPA). You will be able to request removal of all applicable Data.
• Right to Rectification – You have the right to request that any incorrect Personal Data we hold about you is corrected, if that information is inaccurate or incomplete. If you are unable to make the necessary rectification from within your account please contact us.
• Right to Data Portability – You have the right to request a machine readable export of all Personal Data we hold about you. This will be delivered as a ZIP file containing multiple CSV files.

Policy changes

We may from time to time make minor edits to this Privacy Policy. When we make more substantial changes to the terms in this Privacy Policy we will notify you accordingly.