Privacy Policy
In short. We use your information to provide the services you order, take payment, keep your account secure and meet our legal duties. We don’t sell it. We share it only with the providers listed under Our providers, and only what they need.
Questions or requests: [email protected].
This policy covers Phoenix Hosting acting as a controller: for our own customers, people who contact us, and visitors to our website and client area. When we handle personal information for a customer (for example enquiries from their website’s visitors, or their mailboxes), the customer is the controller and our Data Processing Terms apply instead.
- Who we are
- Whose information this covers
- What we collect
- Why we use it
- Automated decisions
- How long we keep it
- Our providers
- Transfers outside the UK
- Your rights
- Cookies
- Security
- Complaints
- Changes
1. Who we are
Phoenix Digital Innovations Ltd, trading as Phoenix Hosting, a company registered in England and Wales with company number 17458875. We are the controller of the personal information described in this policy.
We are registered with the Information Commissioner’s Office (ICO), registration number ZC259050.
- Privacy questions and requests: [email protected]
- Reporting a security problem: [email protected]
2. Whose information this covers
- Customers, and people who contact us about becoming one (including sole traders and the staff of business customers who deal with us).
- Visitors to phoenixhosting.co, our client area, our onboarding forms and our management portal.
3. What we collect
| Type | Examples | Where from |
|---|---|---|
| Account and contact | Name, business name, email, postal address, phone, login details | You, when you sign up |
| Billing | Invoices, payment history, card type and last 4 digits, billing address. We never see or store your full card number; our payment provider does | You; Stripe |
| Onboarding brief | Answers about your business and website, logos, photos, text, links to your social and review profiles, and your choices (such as asking us to start work straight away) | You, through our onboarding forms |
| Mobile number for security checks | Used to confirm it’s really you before sensitive changes, such as password resets, domain transfers or changing account contacts | You |
| Order records | Your request to start work, with the date and time; your website acceptance (who, when, IP address and browser, version accepted) | Our systems |
| Support and communications | Emails, tickets, call notes, complaints | You |
| Domain registration | Registrant name, address, email and phone, as domain registries require | You |
| Technical and security | IP address, browser, pages requested, login times, security logs, failed logins | Your device, automatically |
| Cookies | See our Cookie Policy | Your device, automatically |
Our services are not aimed at children and we don’t knowingly collect information about them.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Setting up and running your account; building and hosting your website; providing add-ons | Contract |
| Taking payment and following up unpaid invoices, as set out in our Terms | Contract |
| Keeping accounting and tax records | Legal obligation |
| Keeping a record of your request to start work and of your website acceptance | Legal obligation (consumer law) and legitimate interests (being able to show what was agreed) |
| Registering domain names in your name | Contract |
| Security checks using your mobile number; protecting our systems and other customers; preventing fraud and abuse (including reCAPTCHA on our client area forms) | Legitimate interests: keeping accounts and websites safe |
| Answering questions and complaints | Contract, or legitimate interests |
| Service messages (renewal reminders, security alerts, changes to our terms) | Contract, or legal obligation |
| Telling existing customers about similar services we offer | Legitimate interests, with an unsubscribe link in every message. Our mailing list is opt-in |
| Running our business efficiently with the help of technology providers (see section 7) | Contract, and legitimate interests (running our service well) |
Where we rely on legitimate interests, you can object (section 9). You can opt out of marketing at any time.
5. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Routine steps such as payment reminders follow fixed dates set out in our Terms, and a member of our team can pause them for any customer.
6. How long we keep it
| Information | How long |
|---|---|
| Invoices and payment records | 6 years, as HMRC requires |
| Support tickets and emails | 2 years after the ticket is closed |
| Enquiries from people who don’t become customers | 12 months |
| Account and contact details; order records (start-work request, website acceptance) | While you are a customer, then up to 6 years, so we can deal with any claim |
| Onboarding brief and files; your mobile number for security checks | While you are a customer; deleted with your account |
| Your website, mailboxes and data we host | Deleted 30 days after your service ends, or from day 90 after a missed invoice (see our Terms). Encrypted backup copies may remain in our backup system until they expire automatically, within 12 months. They are kept secure, are not accessed, and are not used to restore your website once your account has closed |
| Server and security logs | Normally up to 5 weeks, longer if needed to investigate a security incident |
| Marketing opt-outs | As long as needed to make sure we don’t email you again |
7. Our providers
We don’t sell your information. We share it only with the providers below, and only what each needs to do its job. This list includes the providers we plan to use, so that changes are rare. We will update it before we start using anyone new.
In use now
| Provider | What for | Information | Where |
|---|---|---|---|
| IONOS SE | Website hosting, customer email, our servers | Website content, mailboxes, account information | UK and EU (Germany) |
| Openprovider (Hosting Concepts B.V.) | Domain registration | Registrant name and contact details (passed on to domain registries as their rules require) | Netherlands (EU) |
| Cloudflare, Inc. | Domain name service, security and delivery for phoenixhosting.co and our client area | Visitor IP addresses and request data | Global network; US company |
| Amazon Web Services EMEA SARL | Sending email (Amazon SES); encrypted backups (Amazon S3) | Email addresses and content; encrypted backups | UK (London) |
| Stripe Payments UK Ltd | Card payments | Payment details (held by Stripe), name, email | UK, EU and US |
| Google (reCAPTCHA) | Spam and abuse protection on client area forms and checkout | IP address, browser and device signals | US |
| IT and software support services | Help us operate and support our systems | Account and website information as needed | US |
| Tailscale Inc. | Secure network access for our team | Device and connection information only | US and Canada |
| Telegram | Internal team notifications | Operational alerts, which may include customer names or domain names | Outside the UK |
Stripe acts as our processor when it takes payments for us, and as an independent controller for its own fraud-prevention and legal duties. See Stripe’s own privacy notice for that part.
Planned
| Provider | What for | When |
|---|---|---|
| Cal.com (run on our own server) | The Online Bookings add-on | When the first customer orders it. Run on our own server, so no extra third party |
| Bitwarden | Our team’s password manager | When we set it up |
| Trustindex | Review widgets for customers who order that add-on | When first ordered |
We may also share information with our professional advisers (such as our accountant, solicitor or insurer), with the police, courts or regulators where the law requires it, and with a buyer if our business is sold (you would be told).
8. Transfers outside the UK
Most of your information stays in the UK. Some providers are in the EU, which the UK treats as giving adequate protection. Some of our providers are based in the United States. Where a provider is certified under the UK–US Data Bridge, we rely on that certification; otherwise we take steps to ensure your information is handled securely and only as needed. Ask us at [email protected] if you would like details for a particular provider.
9. Your rights
You have the right to:
- access a copy of your personal information;
- have inaccurate information corrected;
- have information deleted, where we no longer have a good reason to keep it;
- restrict how we use it while a concern is looked into;
- object to uses based on legitimate interests, and always to direct marketing;
- data portability: receive information you gave us in a common format, where we rely on contract or consent;
- withdraw consent at any time, where we rely on consent.
Email [email protected]. We may need to confirm who you are first (for example with a check to your mobile number). We reply within one month. If a request is complex we may extend this by up to two more months, and we will tell you why.
10. Cookies
Our website and client area use only cookies that are strictly necessary for them to work and stay secure, including Google reCAPTCHA on client area forms. We don’t use analytics or advertising cookies. You can make or change your choice at any time with the “Cookie settings” link at the bottom of every page. Full details are in our Cookie Policy.
11. Security
We use appropriate technical and organisational measures to protect your website and data, including access controls, encryption of backups and regular security monitoring. No system is completely secure. If a breach is likely to put you at high risk, we will tell you without undue delay. Found a vulnerability? Please email [email protected].
12. Complaints
Please contact us first at [email protected] so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113.
13. Changes
We will publish any changes here with a new version number and date. If a change is significant, we will tell customers by email.
Version 1.2, 6 October 2026. Phoenix Digital Innovations Ltd, trading as Phoenix Hosting, company number 17458875. ICO registration ZC259050.