GDPR & Data Protection

Controller & Processor Roles

Website Hosts UK may act as a data controller for personal data collected and used for our own business purposes, such as customer accounts, billing, support, fraud prevention, security, service administration and communications.

Website Hosts UK may act as a data processor where customers use our hosting services to store or process personal data inside websites, databases, email accounts, applications, VPS services or VDS services.

Where you use our services to host personal data belonging to your own users, customers, visitors or subscribers, you are normally responsible for deciding why and how that data is processed. In that case, you are generally the controller for that hosted content.

Customers are responsible for ensuring their own privacy notices, cookie notices, consent mechanisms, data protection records and processing activities are appropriate for their websites and services.

Personal Data We May Collect

Depending on how you interact with Website Hosts UK, we may collect and process personal data such as:

• Name and contact details
• Email address and telephone number
• Billing address and payment-related information
• Account login and service details
• Domain registration details
• Support ticket content and correspondence
• IP addresses, server logs and security logs
• Fraud prevention, abuse and compliance records
• Website contact form submissions
• Live chat messages or support interactions

We may also process technical data generated by the use of our services, such as access logs, mail logs, DNS records, resource usage, service status information and security events.

Lawful Basis for Processing

Under the UK GDPR, organisations need a lawful basis when processing personal data. Website Hosts UK may rely on different lawful bases depending on the purpose of processing.

The ICO states that Article 6 of the UK GDPR sets out lawful bases and that at least one must apply whenever an organisation handles personal information. :contentReference[oaicite:1]{index=1}

How We Use Personal Data

Website Hosts UK may use personal data to:

• Create and manage customer accounts
• Provide hosting, domain, email, VPS and VDS services
• Process orders, renewals, billing and payments
• Respond to support requests and service enquiries
• Send service notices, renewal reminders and account updates
• Monitor service performance, security and abuse
• Investigate fraud, spam, malware, phishing or policy violations
• Maintain logs required for security and operational purposes
• Improve our website, systems and customer experience
• Comply with legal, regulatory and contractual obligations

We aim to process personal data only where it is necessary, proportionate and relevant to the purpose for which it is used.

Hosted Content, Websites & Customer Data

Customers may store or process personal data through websites, databases, email accounts, applications, file storage, backups, VPS services or VDS services hosted with Website Hosts UK.

Examples may include contact form submissions, customer records, order details, mailing list data, website user accounts, analytics data, uploaded files, application data or email content.

Where customers use our services to process data for their own purposes, customers are responsible for ensuring that their use of the services complies with applicable data protection law.

Customers should ensure their websites have appropriate privacy notices, cookie notices, consent controls, security measures and data retention practices where required.

Third Parties & Sub-Processors

Website Hosts UK may use third-party providers and sub-processors to deliver services, process payments, manage billing, provide support tools, maintain infrastructure, detect fraud, monitor systems or provide live chat.

Where third-party services process personal data on our behalf, we aim to use providers that offer appropriate data protection, confidentiality and security commitments.

Customers using our services should consider whether they require a data processing agreement or additional contractual terms depending on the nature of the data they host or process.

Security Measures

Website Hosts UK uses appropriate technical and organisational measures designed to protect personal data and hosted services. Measures may include:

• Account authentication and access controls
• SSL/TLS encryption for supported services
• Server and network monitoring
• Firewall and abuse prevention controls
• Malware, spam and security monitoring where applicable
• Backups and recovery processes where included with the service
• Logging and security event investigation
• Restricted internal access where appropriate

Customers are also responsible for securing their own websites, passwords, CMS installations, plugins, themes, applications, scripts, email accounts and server configurations.

Where customers operate VPS or VDS services, they are generally responsible for server-level security unless a managed service has been specifically agreed.

Data Retention

Website Hosts UK retains personal data for as long as necessary to provide services, manage accounts, comply with legal obligations, resolve disputes, enforce terms, maintain security and support business records.

Different categories of data may be kept for different periods. For example, billing records may need to be retained for legal or accounting purposes, while support records may be retained to help manage customer service history.

Hosted customer content is generally retained while the relevant service remains active, subject to backups, account status, suspension, deletion, cancellation and service-specific retention rules.

Your Data Protection Rights

Depending on the circumstances, individuals may have rights under data protection law, including the right to:

• Access personal data
• Request correction of inaccurate data
• Request deletion of personal data
• Request restriction of processing
• Object to processing
• Request data portability
• Withdraw consent where processing is based on consent
• Complain to the Information Commissioner’s Office

Some rights may be limited where we need to retain data for legal, contractual, security, fraud prevention, accounting or legitimate business purposes.

If your request relates to data controlled by one of our customers through a hosted website or service, we may direct you to contact that customer as the relevant data controller.

Data Breaches & Security Incidents

If Website Hosts UK becomes aware of a personal data breach affecting data for which we are responsible, we will assess the incident and take appropriate action in line with applicable data protection requirements.

Where we act as a processor for customer-hosted data and become aware of a relevant security incident, we will take appropriate steps to support the customer where required.

Customers should promptly report suspected security incidents, compromised websites, exposed data, malware, phishing, unauthorised access or email compromise through support.

International Transfers

Some third-party services, support tools, payment processors, infrastructure providers or connected systems may process personal data outside the United Kingdom.

Where international transfers occur, we aim to rely on appropriate safeguards or transfer mechanisms where required by data protection law.

Customers should also consider international transfer requirements where their own websites, plugins, analytics tools, payment systems, email marketing services or third-party integrations process personal data.

Exercising Your Rights

To exercise your GDPR or data protection rights in relation to personal data controlled by Website Hosts UK, please contact:

Please include enough information for us to identify your account, request or affected data. We may need to verify your identity before responding.

You also have the right to contact the UK Information Commissioner’s Office if you have concerns about how personal data is handled.