Privacy Policy

1. Who we are and what this covers

Snappy Host Ltd (“we”, “us”) is the data controller for the personal data described in this policy. We are a company registered in England and Wales under number 12659438, with our registered office at Oak House A, Southwell Road West, Mansfield, Nottinghamshire, NG21 0HJ. We are registered with the Information Commissioner's Office under number ZB032228.

This policy covers the personal data we hold about you: as a visitor to this website, as someone who enquires about our services, and as a customer or a contact at a customer.

We are not required to appoint a Data Protection Officer and have not appointed one. Data protection questions are handled by our directors, and the contact details at the end of this policy reach them.

2. The personal data we collect

We collect the following categories of personal data:

• Identity data. Your name, the company you work for and your job title where you give it to us.
• Contact data. Your billing address, email address and telephone number.
• Account data. Your username, security questions, support tickets, and the settings and preferences on your account. We never store your password in a readable form, and we will never ask you for it.
• Financial data. Your billing details and a record of the payments you have made. Full card numbers are handled by our payment provider and are not stored on our systems.
• Verification data. Where we need to confirm who you are, for example on a domain transfer or a change of account holder, the identification you provide.
• Technical data. Your IP address, browser type and version, operating system, and the pages you visited, from our web server logs and our analytics.
• Communications data. Your enquiries, support tickets, live chat transcripts, emails and calls with us. Calls may be recorded for training and monitoring purposes.
• Marketing data. Whether you have asked to receive our emails, and whether you have opened or clicked them.

We do not knowingly collect special category data (such as data about health, race, religion or sexual orientation) or criminal offence data. Please do not send it to us in a support ticket.

Our services are not directed at children, and we do not knowingly collect personal data about anyone under 18.

3. How we collect it

• Directly from you, when you place an order, create an account, fill in a form on this site, start a live chat, raise a ticket, call us or email us.
• Automatically, as you use this website and our services, through server logs and through cookies. Our cookie policy lists every cookie we set and how to refuse the optional ones.
• From third parties, such as our payment provider confirming a payment has succeeded or failed, a domain registry, or publicly available sources such as Companies House where we need to verify a business.

4. Why we use it, and our lawful basis

Data protection law requires us to have a lawful basis for each purpose we use your data for. Ours are set out below.

4.1 To provide the services you have ordered.

Setting up your account, provisioning your hosting, registering and renewing domains, and giving you access to the control panel. Lawful basis: performance of our contract with you.

4.2 To bill you and take payment.

Issuing invoices, taking recurring payments, chasing overdue amounts and issuing refunds. Lawful basis: performance of our contract with you, and our legitimate interest in recovering money owed.

4.3 To support you.

Answering tickets, live chat, calls and emails, and keeping a record of what was asked and what we did. Lawful basis: performance of our contract with you, and our legitimate interest in keeping an accurate service history.

4.4 To answer your enquiry before you are a customer.

Responding to a contact form, a quote request or a migration enquiry. Lawful basis: our legitimate interest in responding to people who ask us to, and taking steps at your request before entering into a contract.

4.5 To keep the platform secure.

Detecting and preventing fraud, abuse, spam and attacks, investigating compromised accounts, and keeping access and server logs. Lawful basis: our legitimate interest in protecting our platform, our customers and the wider internet, and our legal obligation to keep the service secure.

4.6 To check orders for fraud.

When you place an order, automated checks in our payment and billing systems score it for fraud and risk. Those checks flag an order for attention, but they do not decide it: a person reviews every order before it is accepted or declined. This protects us and our customers from card fraud and from accounts opened to send spam or host malicious content. Lawful basis: our legitimate interest in preventing fraud and abuse, and taking steps necessary to enter into a contract with you.

4.7 To record calls.

Calls may be recorded for training and monitoring purposes. Lawful basis: our legitimate interest in training our team and maintaining the quality of our service.

4.8 To send you service messages.

Telling you about maintenance, incidents, renewals, price changes and changes to these policies. These are not marketing and you cannot opt out of them while you hold an account. Lawful basis: performance of our contract with you.

4.9 To send you marketing.

Our newsletter, offers and hosting guides. Lawful basis: your consent, or where you are an existing customer and the message is about similar services, our legitimate interest under the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations. Every marketing email has a one-click unsubscribe and we act on it immediately.

4.10 To improve the website and our services.

Understanding which pages are useful and where people get stuck. Lawful basis: your consent, given through the cookie banner. If you refuse, our analytics runs in a mode that stores nothing on your device and cannot identify you.

4.11 To meet our legal obligations.

Keeping accounting and VAT records, responding to a lawful request from a court, a regulator, law enforcement or a domain registry, and dealing with copyright takedown notices. Lawful basis: compliance with a legal obligation.

4.12 To establish, exercise or defend legal claims.

Including in a dispute over an unpaid invoice or an abuse complaint. Lawful basis: our legitimate interest in protecting our legal position.

5. Who we share it with

We do not sell your personal data and we do not share it for anyone else's marketing. We share it only with the following categories of recipient, under contract and only for the purpose described:

• Our payment providers, to take payment and process refunds by card, Direct Debit and PayPal. Bank transfer and BACS payments, which we accept by prior agreement, involve no third-party processor.
• Our billing and support platform, which stores your account, invoices and support tickets.
• Our data centre and infrastructure providers in the United Kingdom, who house the servers your data sits on.
• Domain registries and registrars, such as Nominet and ICANN-accredited registrars, where you register or transfer a domain. Registry rules require us to pass on registrant contact details.
• Google, if you accept analytics cookies, as the operator of Google Analytics 4.
• PostHog, if you accept Analytics, for website and checkout usage analytics and session replay in our EU project. Typed fields are masked before recordings leave your browser.
• Crisp IM SARL, as the operator of our chat window, which loads on every page of this site.
• Our email delivery providers, to send service messages and marketing.
• Our telephony provider, which carries our calls.
• Nobody, for your backups. Off-site backups of your account are held on our own backup servers and on premises, not with a third-party storage provider.
• Our professional advisers, including our accountants, auditors, insurers and solicitors, where they need it to advise us.
• Law enforcement, regulators, courts and registries, where we are required by law to disclose it or where it is necessary to protect our rights or someone's safety.
• A buyer or seller of our business, if we are acquired or we acquire another provider, in which case we will tell you and this policy will continue to apply to your data.

We require every supplier who processes personal data on our behalf to do so only on our instructions, to keep it secure, and to be bound by a written contract meeting the requirements of Article 28 of the UK GDPR.

6. Where your data is held, and transfers abroad

The servers hosting your website and email are located in the United Kingdom, in data centre space we take from a third-party UK operator. Our own business records are held in the United Kingdom and the European Economic Area.

Some of our suppliers may process personal data outside the UK. Where that happens, we make sure one of the following safeguards applies:

• the country has been found by the UK Government to provide an adequate level of protection; or
• the transfer is made under the International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, together with a transfer risk assessment.

You can ask us for a copy of the safeguard that applies to a particular transfer.

7. How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, and then delete or anonymise it.

• Account and contact data: for as long as you hold an account, and then 6 years after it closes, which matches the period in which a contract claim could still be brought.
• Invoices, payments and accounting records: 6 years from the end of the accounting period, because we are legally required to.
• Support tickets and chat transcripts: 3 years.
• Website content, databases and mailboxes: deleted after the services end, as part of routine housekeeping. We do not commit to a retention window and you should not rely on being able to recover anything after your final day, so please take your own copy before then. See the Acceptable Use Policy for the backup detail.
• Server, access and security logs: 90 days.
• Marketing preferences: until you unsubscribe, and then a minimal record of your unsubscribe indefinitely, so that we do not email you again by mistake.
• Enquiries that do not become orders: 12 months.
• Call recordings: kept for no longer than we need them for training and monitoring.

8. Your rights

Under UK data protection law you have the following rights. All of them are free to exercise.

• Access. To be told whether we hold personal data about you and to receive a copy of it.
• Rectification. To have inaccurate data corrected and incomplete data completed.
• Erasure. To have your data deleted where we no longer have a good reason to keep it. This does not override our legal obligation to keep accounting records.
• Restriction. To ask us to pause our use of your data, for example while we check its accuracy.
• Portability. To receive the data you gave us in a structured, commonly used, machine-readable format, or to have it sent to another provider.
• Objection. To object to processing we carry out on the basis of legitimate interests, and to object to direct marketing at any time, which we will always act on.
• Withdrawing consent. Where we rely on your consent, to withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Automated decision-making. Not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect. We do not make decisions that way. Automated checks flag an order for attention, but a person reviews every order before it is accepted or declined, and we will contact you for more information if we need it.

To exercise any of these, email [email protected] or raise a ticket in the client area. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you within the first month if we need to. We may ask you to confirm your identity first, so that we do not hand your data to somebody else.

9. How we keep it secure

We use appropriate technical and organisational measures to protect personal data, and restrict access to staff who need it and who are under a duty of confidentiality. We review our controls regularly.

No system can be guaranteed secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO and, where the risk is high, tell you directly.

10. How to complain

If you are unhappy with how we have handled your personal data, please tell us first through our complaints procedure. We would much rather put it right.

You also have the right to complain to the Information Commissioner's Office at any time, whether or not you have raised it with us. The ICO can be contacted at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes to this policy, and how to contact us

We review this policy regularly and will update the date at the top when we change it. Where a change is significant we will tell you by email before it takes effect.

Please keep the details on your account up to date, so that what we hold about you stays accurate.