Hosting UK Privacy Policy

Hosting UK respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you:

• visit a Hosting UK website or customer portal;
• create or use a Hosting UK account;
• purchase, renew, transfer, cancel or enquire about our products and services;
• contact our sales, renewals, billing or support teams;
• communicate with us by telephone, email, online chat, support ticket or social media;
• act as a supplier, partner, reseller or business contact; or
• otherwise interact with Hosting UK.

It also explains your data protection rights and how you can contact us about our use of your personal information.

Hosting UK is a trading name and division of Easyspace Limited.

Easyspace Limited is a company registered in England and Wales under company number 03405586. Its registered office is:
Easyspace Limited
3rd Floor, 11-21 Paul Street
London EC2A 4JU
United Kingdom

Easyspace Limited is part of the iomart group.

References in this Privacy Policy to “Hosting UK”, “we”, “us” or “our” mean Easyspace Limited trading as Hosting UK.

Hosting UK is not a separate legal entity from Easyspace Limited. Easyspace and Hosting UK operate as brands and business divisions of Easyspace Limited. They may use shared employees, customer service teams, systems, infrastructure, billing functions, security resources and administrative services.

Where personal information is used across Hosting UK and Easyspace for customer support, billing, service delivery, account administration, security or business operations, it remains within Easyspace Limited. The appearance of the Easyspace name or brand does not, by itself, mean that information has been disclosed to a separate organisation.

For most activities described in this policy, Easyspace Limited is the data controller. This means Easyspace Limited decides why and how personal information is used.

You can contact our Data Protection Officer at:
Email: dpo@iomart.com
Post: Data Protection Officer, Easyspace Limited, 6 Atlantic Quay, 55 Robertson Street, Glasgow G2 8JD, United Kingdom

Customers may store or process personal information using our hosting, server, cloud, email, backup, website, security or related services.

For personal information placed on our systems by a customer, the customer will normally be the data controller and Easyspace Limited trading as Hosting UK will act as the data processor on the customer's instructions.

Customers are responsible for:

• deciding why and how that information is processed;
• establishing an appropriate lawful basis;
• providing appropriate privacy information to the individuals concerned;
• responding to requests from those individuals;
• configuring and securing their applications and services appropriately; and
• ensuring that their use of our services complies with data protection law.

Our processing of customer-controlled information is also governed by our service terms and applicable data processing provisions.

Where we provide colocation or infrastructure that does not allow us access to customer data, we may not act as a data processor in relation to that data.

This Privacy Policy primarily covers personal information for which Easyspace Limited acts as the data controller.

The information we collect depends on your relationship with us and the services you use.

4.1 Identity and contact information - your name; title and job role; company or organisation name; postal, service and billing addresses; email addresses; telephone numbers; and details of authorised account users and technical contacts.

4.2 Account and authentication information - customer or account number; username and authentication information; account permissions and security settings; products and services associated with your account; renewal, cancellation and communication preferences; account activity and change records; and identity verification information. Passwords are not stored in a form intended to allow them to be read as plain text.

4.3 Order, contract, transaction and payment information - products and services ordered; service configuration and contract information; order, renewal, upgrade and cancellation history; invoices, credits and refunds; payment status; billing information; Direct Debit information; fraud prevention checks; and limited payment card information received from payment processors. Payment card transactions may be processed by specialist payment providers. We do not generally receive or retain complete payment card security codes.

4.4 Domain name information - registrant information; administrative, technical and billing contact details; identity or eligibility information required by a registry; domain ownership and registration records; domain transfer information; registration and renewal history; and communications concerning domain disputes, complaints, abuse or regulatory requirements. Some information must be provided to the relevant domain registry, registrar, naming authority or dispute resolution provider. Depending on the domain extension, applicable rules and the registrant's circumstances, some registration information may be available through domain registration data services or disclosed in response to a lawful request.

4.5 Service, device and technical information - IP addresses; device and browser information; operating system information; login dates and times; session and authentication records; traffic and usage information; DNS information; email, network, server and application logs; service configuration information; security events and alerts; diagnostic information; resource usage; backup and restoration records; and information generated when our systems or services are accessed or used.

4.6 Website and cookie information - pages viewed; links selected; products searched for; items placed in a basket; referring websites; approximate location derived from an IP address; website performance information; form interactions; and cookie or similar technology identifiers. Further information is available in our Cookie Policy and through the cookie controls provided on our website.

4.7 Communications and support information - support tickets; emails; online chat conversations; telephone call recordings; notes made by our employees; technical diagnostic information; complaint and dispute records; survey responses; and communications through social media. Telephone calls may be recorded for quality, training, security, complaint handling and evidential purposes. Where appropriate, we will inform you that a call is being recorded.

4.8 Marketing and preference information - whether you have agreed to receive marketing; your preferred communication channels; products and services that may be relevant to you; responses to promotions or campaigns; website and email engagement information; and records of requests to unsubscribe or object to marketing.

4.9 Supplier, partner and business contact information - where you work for or represent a supplier, partner, reseller, professional adviser or other organisation, we may process your business contact details; your role and organisation; communications with you; contract and purchasing information; due diligence records; and payment or account administration records.

4.10 Special category information - We do not normally ask customers to provide special category personal information, such as health information, racial or ethnic origin, religious beliefs, political opinions, trade union membership, sexual orientation or biometric information. You may occasionally disclose sensitive information to us during a complaint, support request or other communication. Please only provide this information where it is relevant and necessary. Where we need to process special category information, we will identify an appropriate lawful basis and an additional legal condition for doing so.

We collect personal information:

• directly from you;
• from someone authorised to act on your behalf;
• from other users associated with your account;
• when you use our websites, portals, systems and services;
• through the Easyspace and Hosting UK shared business systems;
• from domain registries, registrars and naming authorities;
• from payment, identity verification and fraud prevention providers;
• from suppliers and product partners;
• from iomart group companies;
• from resellers, affiliates and referral partners;
• from publicly available business and domain registration sources;
• from security, monitoring and abuse reporting services; and
• where permitted, from organisations to which you have provided relevant instructions or consent.

Please ensure that any information you provide is accurate and kept up to date.

Where you provide personal information about another person, you must have authority to provide it and must ensure they have been given appropriate information about how it will be used.

We must have a lawful basis for each purpose for which we use personal information. Depending on the circumstances, we rely on: performance of a contract; steps taken at your request before entering into a contract; compliance with a legal obligation; our legitimate interests or those of another organisation; consent; and the establishment, exercise or defence of legal claims.

6.1 Providing and managing services - to create and administer accounts; process orders; register, renew and manage domain names; provide hosting, server, cloud, email, backup, security and related services; deploy, configure and manage services where included in your package; communicate about service delivery; manage renewals, upgrades, migrations, changes and cancellations; and provide customer and technical support. Our lawful basis is normally performance of a contract or taking steps at your request before entering into a contract.

6.2 Billing and collecting payment - to issue invoices; process payments; administer Direct Debits; manage refunds and credits; collect outstanding amounts; maintain accounting records; and detect payment fraud. Our lawful basis is performance of a contract, compliance with legal obligations and our legitimate interest in receiving payment and preventing fraud.

6.3 Domain registration and administration - to register, renew or transfer a domain; meet registry or registrar requirements; establish eligibility for particular domain extensions; maintain accurate domain registration records; investigate disputes, complaints or abuse; and comply with applicable domain policies and legal requirements. Our lawful basis is performance of a contract, compliance with legal obligations and our legitimate interest in providing secure and properly administered domain services.

6.4 Support and customer communications - to answer enquiries; diagnose and resolve technical problems; provide account assistance; carry out migrations or service changes; investigate complaints; monitor service quality; train and support employees; and maintain records of advice, instructions and decisions. Our lawful basis is performance of a contract and our legitimate interest in providing effective support, improving service quality and resolving disputes.

6.5 Service, network and account security - to authenticate users; protect accounts, systems, networks and infrastructure; monitor for malicious, unlawful or unauthorised activity; detect and prevent fraud; investigate spam, abuse and security incidents; apply security controls; enforce our terms; protect customers, employees and third parties; and maintain the availability, confidentiality and integrity of our services. Our lawful basis is our legitimate interest in operating secure and reliable services, protecting our business and customers, and complying with applicable legal obligations.

6.6 Service communications - we may send information concerning orders and account changes; invoices and payments; renewals and expiry; maintenance and service availability; incidents and security matters; migrations and platform changes; changes to services or contractual terms; and actions required to maintain or secure a service. These are service communications and are not marketing messages. You may not be able to opt out of them while you hold an account or use a service. Our lawful basis is performance of a contract, compliance with legal obligations and our legitimate interest in administering our services.

6.7 Marketing - we may use contact, account and service information to send information about Hosting UK or Easyspace products, services, upgrades and offers that may be relevant to you. Because Hosting UK and Easyspace are brands of Easyspace Limited, marketing may refer to either brand where the communication is sent by Easyspace Limited and is relevant to the recipient. Depending on the circumstances, we rely on consent or our legitimate interests. Electronic marketing will also be sent in accordance with the Privacy and Electronic Communications Regulations. You can object to direct marketing at any time by using the unsubscribe option in a marketing message, changing your communication preferences where available, or contacting us. You have an absolute right to object to the use of your personal information for direct marketing. We may retain limited information on a suppression list to ensure that we continue to respect an unsubscribe or objection request.

6.8 Improving our websites, products and services - we may analyse account, website, service and support information to understand how services are used; identify faults, capacity requirements or performance issues; improve customer journeys; develop or improve products and services; assess the effectiveness of communications; forecast demand; and produce aggregated business statistics. Our lawful basis is normally our legitimate interest in understanding and improving our business and services. Where consent is required for cookies or similar technologies, we will request it separately.

6.9 Legal, regulatory and corporate purposes - to comply with laws, court orders and regulatory requirements; respond to lawful requests from public authorities; obtain legal or professional advice; establish, exercise or defend legal claims; maintain corporate, accounting and audit records; manage insurance and risk; investigate or prevent unlawful activity; support a corporate reorganisation, investment, financing, acquisition or sale; and protect our legal rights and those of others. Our lawful basis is compliance with legal obligations and our legitimate interest in managing legal, regulatory, financial and corporate affairs.

Where we rely on legitimate interests, these may include: operating and improving our business; providing effective customer service; securing our networks, systems and services; preventing fraud and misuse; managing customer relationships; recovering amounts owed to us; maintaining accurate business records; understanding the performance of our services; developing relevant products and services; communicating with existing business customers; protecting our employees and customers; and establishing or defending legal rights.

We consider whether our use of personal information is necessary and proportionate and whether your interests, rights or freedoms override our interests.

You may object to processing based on legitimate interests. We will stop the processing unless we have compelling legitimate grounds to continue or the processing is needed for legal claims.

Hosting UK and Easyspace are operated by the same company, Easyspace Limited. Information may therefore be accessed and used by authorised Easyspace Limited employees and shared business functions regardless of whether those employees or systems use the Hosting UK or Easyspace brand.

This may include shared:

• billing and finance teams;
• customer service and support teams;
• renewals and account management teams;
• security and infrastructure teams;
• legal, compliance and data protection functions;
• customer portals and business systems; and
• management and administration functions.

This use takes place within the same legal entity and is not a disclosure to a separate company.

We may also share information with other companies in the iomart group where necessary for group administration, infrastructure, security, professional support, legal compliance or service delivery. A group company may act as a separate controller, joint controller or processor depending on the activity.

We may share personal information with:

• domain registries, registrars and naming authorities;
• certificate authorities;
• payment processors, banks and Direct Debit providers;
• identity verification and fraud prevention providers;
• suppliers that provide products ordered through Hosting UK;
• data centre, network, connectivity and infrastructure providers;
• software, cloud and platform providers;
• customer support and communications providers;
• security, monitoring, backup and incident response providers;
• analytics and website service providers;
• delivery and postal service providers;
• professional advisers, including lawyers, auditors, insurers and accountants;
• debt recovery and dispute resolution providers;
• regulators, courts, law enforcement agencies and public authorities;
• prospective purchasers, investors or advisers involved in a corporate transaction; and
• other organisations where you have asked us to share information or have consented to the sharing.

The main organisations that process personal information on our behalf, grouped by the service they support, are set out in the expandable list below.

We require service providers processing personal information on our behalf to protect it, use it only for authorised purposes and comply with applicable data protection requirements.

We do not sell personal information to third parties.

We may disclose personal information where reasonably necessary to investigate suspected fraud, criminal activity, security incidents, misuse of our services or breaches of our terms.

Domain registration is subject to rules set by the relevant registry, registrar or naming authority.

We may be required to provide registration information to those organisations. They may retain and use that information as independent data controllers under their own privacy policies and regulatory obligations.

Registration information may also be disclosed:

• through registration data access services where permitted or required;
• to parties demonstrating a lawful and legitimate interest;
• in connection with a domain dispute;
• to law enforcement or regulatory bodies; or
• where required by a court order or applicable domain policy.

Domain privacy or proxy services may be available for some domain extensions, but they are not available in every case and do not remove the obligation to hold accurate registrant information.

Some suppliers, iomart group companies, registries, product providers or support services may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take steps to ensure that an appropriate level of protection is maintained.

Depending on the destination and circumstances, we may rely on:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved European Commission standard contractual clauses;
• contractual, organisational and technical safeguards; or
• another transfer mechanism permitted by UK data protection law.

You may contact our Data Protection Officer for further information about safeguards used for relevant international transfers.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security, regulatory and dispute resolution requirements.

When deciding how long to retain information, we consider:

• whether your account or service remains active;
• the nature and sensitivity of the information;
• the reason it was collected;
• registry and product provider requirements;
• security and fraud prevention requirements;
• applicable limitation periods;
• tax, accounting and audit obligations;
• whether a complaint, dispute or legal claim is anticipated or ongoing; and
• whether the information is held in operational systems, archives or backups.

Core account, contract, order and billing records will normally be retained for the duration of the customer relationship and for up to seven years afterwards.

Other information, including support records, call recordings, technical logs, security records, backup records and website data, is retained under documented operational schedules appropriate to its purpose.

Marketing information is retained until you opt out, the information is no longer required, or we determine that it is no longer accurate or relevant. We may retain a suppression record after you opt out.

Information held within a customer's hosted service is normally retained in accordance with the service terms, cancellation process and applicable backup cycles.

Domain registries and other independent organisations may retain information according to their own legal and operational requirements.

We may retain information for longer where required by law or where necessary for an active complaint, investigation or legal claim.

Our websites, portals and online services use cookies and similar storage or access technologies.

These may be used to:

• operate essential website functions;
• maintain sessions and shopping baskets;
• authenticate users;
• remember settings and preferences;
• protect websites and accounts;
• understand website performance;
• identify errors; and
• measure how visitors use our websites.

Where consent is required, non-essential technologies will not be used until you have made an appropriate choice.

Where an applicable legal exception allows a technology to be used without consent, we will still provide clear information and any required means of objecting.

You can manage your choices through our website cookie controls and, where appropriate, through your browser or device settings.

Further information about the technologies currently used, their providers, purposes and durations is available in our Cookie Policy.

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access; accidental loss; unlawful disclosure; alteration; destruction; and misuse.

Measures may include:

• access controls and authentication;
• encryption in transit and, where appropriate, at rest;
• logging and monitoring;
• vulnerability and security management;
• network and infrastructure controls;
• backup and recovery arrangements;
• employee confidentiality obligations;
• employee security and data protection training;
• supplier due diligence;
• incident response procedures; and
• physical security controls at relevant locations.

Access to personal information is restricted to employees, contractors and suppliers who need it for an authorised business purpose.

No internet-based service can be guaranteed to be completely secure. You are responsible for protecting your account credentials and notifying us promptly if you suspect unauthorised use of your account.

Where a personal data breach creates a legal obligation to notify affected individuals or the Information Commissioner's Office, we will make the required notification.

We may use automated tools to support security monitoring, fraud detection, account protection, service management and risk assessment.

Where we make a decision based solely on automated processing that produces a legal or similarly significant effect, we will provide the information and safeguards required by law. These may include the opportunity to request human intervention, express your view or challenge the decision.

We do not ordinarily use special category personal information to make significant decisions based solely on automated processing.

Hosting UK services are intended for people aged 18 or over and for business use.

Our terms require individual users to be at least 18 years old. We do not knowingly offer accounts or services directly to children.

Where we become aware that we have collected a child's personal information contrary to our terms, we will take appropriate steps to investigate and, where necessary, delete or restrict that information.

Depending on the circumstances and the lawful basis used, you may have the right to:

• ask for confirmation that we process your personal information;
• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information;
• ask us to restrict the use of personal information;
• receive certain information in a portable format;
• object to processing based on legitimate interests;
• object to direct marketing;
• withdraw consent at any time;
• request safeguards in relation to certain automated decisions; and
• complain about how your personal information has been used.

These rights are not absolute. In some circumstances, we may be unable to comply fully with a request, for example where information must be retained to comply with a legal obligation, protect another person's rights or establish or defend a legal claim.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

You will not usually be charged for exercising your rights. We may charge a reasonable fee or refuse a request where the law permits us to do so, including where a request is manifestly unfounded or excessive.

We may ask for information to confirm your identity and ensure that personal information is not disclosed to an unauthorised person.

To exercise your rights, contact our Data Protection Officer using the details in section 2.

Please contact our Data Protection Officer if you have concerns about how Hosting UK or Easyspace Limited has used your personal information.

You can submit a complaint by email or post using the contact details in section 2.

We will:

• provide an accessible way to make a data protection complaint;
• acknowledge receipt of the complaint without undue delay and, in any event, within 30 days;
• take appropriate steps to investigate it;
• keep you informed where appropriate;
• respond without undue delay; and
• explain the outcome and any action taken.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator.

We would appreciate the opportunity to address your concerns first, but you are not required to contact us before approaching the Information Commissioner's Office.

Our websites and services may contain links to websites or services operated by other organisations.

Easyspace Limited is not responsible for the privacy practices of independent third parties. You should review their privacy information before providing personal information or using their services.

Where you purchase a third-party product through Hosting UK, the provider may act as an independent data controller for some activities.

We may update this Privacy Policy to reflect:

• changes to our products and services;
• changes to our systems, suppliers or business structure;
• changes to legal or regulatory requirements; or
• improvements to how we explain our use of personal information.

The latest version will be published on our website with the date it was last updated.

Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals.

Questions, rights requests and data protection complaints should be sent to:

Data Protection Officer
Easyspace Limited
6 Atlantic Quay, 55 Robertson Street
Glasgow G2 8JD
United Kingdom

Email: dpo@iomart.com

For ordinary account, billing or technical support enquiries, please use the Hosting UK customer portal or the contact details published on the Hosting UK website.