Data Processing Terms
In short. When we host your website and mailboxes, we handle personal information for you: for example enquiries from your website’s visitors. You decide what happens to it; we only act on your instructions. These terms are the contract UK data protection law (UK GDPR Article 28) requires between us. They form part of our Terms of Service.
- Who is who
- What we process
- Your instructions
- Confidentiality
- Security
- Our providers (sub-processors)
- Transfers outside the UK
- Helping with people’s rights
- Personal data breaches
- Other help
- When the service ends
- Information and audits
- Review-request emails
- Liability and order of precedence
1. Who is who
1.1 You, the customer, are the controller of the personal data covered by these terms. We, Phoenix Digital Innovations Ltd, trading as Phoenix Hosting (company number 17458875, ICO registration ZC259050), are your processor.
1.2 These terms apply only where we process personal data for you. Where we use personal data for our own purposes (for example your account and billing details), we are a controller and our Privacy Policy applies.
1.3 If you are an individual using our services purely for personal purposes, data protection law may not apply to you as a controller. We will still treat the data as these terms describe.
2. What we process
| Subject matter | Hosting, backing up and supporting your website and mailboxes; passing on enquiries from your website’s forms; sending review-request emails for you; setting up review and social widgets |
|---|---|
| Duration | For as long as we provide the services, plus the deletion periods in section 11 |
| Nature | Storing, hosting, sending, copying for backup and restoring. We only open or read the data where needed to provide, fix or secure the service, or when you ask us to |
| Purpose | Providing the services you ordered, and nothing else |
| Types of personal data | Whatever your website and mailboxes collect or contain: typically names, email addresses, phone numbers, messages and form entries, booking details, visitors’ IP addresses and log data, and email contents. For review requests: customer name, email address and date of the job; unsubscribe records |
| Special category data | Not expected. If your website will collect health information or other special category data (for example as a counsellor or therapist), tell us before your site goes live so we can agree how it is handled |
| Data subjects | Visitors to your website; people who contact you through it or email you; your customers and staff; your customers whose details you give us for review requests |
3. Your instructions
3.1 We process the personal data only on your documented instructions. These terms, your order and the settings you choose in our portal are your instructions. Anything else should be in writing; email is fine.
3.2 If the law requires us to process the data in another way, we will tell you first, unless the law forbids it.
3.3 We will tell you if we think an instruction breaks data protection law, and we don’t have to follow it.
3.4 Your responsibilities. You are responsible for having a lawful basis for the data you ask us to process, for giving your own privacy notice to the people concerned (including on your website), and for the accuracy of what you give us.
4. Confidentiality
Everyone at Phoenix Hosting, and anyone acting for us, who can access your personal data is under a duty of confidentiality and only accesses it where needed for the services.
5. Security
We use appropriate technical and organisational measures to protect your website and data, including access controls, encryption of backups and regular security monitoring. We may change these measures, as long as the overall level of protection does not go down.
Websites on hosting without Managed Protection are not backed up (see our Terms, section 11).
6. Our providers (sub-processors)
6.1 You give us general permission to use the providers below to process personal data for you. Our full list of current and planned providers is under Our providers in our Privacy Policy.
| Provider | What for | Where |
|---|---|---|
| IONOS SE | Hosting your website and mailboxes | UK and EU (Germany) |
| Amazon Web Services EMEA SARL | Sending emails (website enquiries, review requests); encrypted backups for Managed Protection | UK (London) |
| Cloudflare, Inc. | Security and delivery for our portal, which passes on your website’s form enquiries | Global network; US company |
| IT and software support services | Help us operate and support our systems, for example when handling a support request that contains your data | US |
| Trustindex (planned) | Review widgets on your website, only if you order that add-on | EU |
6.2 We have written contracts with our providers that protect the data at least as well as these terms, and we remain responsible to you for what they do.
6.3 Changes. We will give you at least 30 days’ notice by email before adding or replacing a provider that processes your data. You may object within that time. If you object, you may leave without charge: you can end the affected service with no early-cancellation charge, and we refund anything you have paid for the period after it ends.
7. Transfers outside the UK
Some sub-processors are in countries the UK treats as giving adequate protection (including the EU and EEA). Some of our sub-processors are based in the United States. Where a sub-processor is certified under the UK–US Data Bridge, we rely on that certification; otherwise we take steps to ensure your information is handled securely and only as needed for the service.
8. Helping you with people’s rights
If someone asks us to exercise their rights over data we hold for you, we will pass the request to you promptly and won’t answer it ourselves unless you ask us to. We will give you reasonable help to respond, for example by finding, exporting, correcting or deleting data on your website or in your mailboxes. Help that takes significant time may be charged at our website edit rate; we will tell you before we start.
9. Personal data breaches
9.1 If we become aware of a personal data breach affecting your data, we will notify you immediately and without undue delay, and give you the information you need to meet your own legal obligations.
9.2 That includes what happened, what data and roughly how many people are affected, the likely consequences, and what we are doing about it. We will update you as we learn more.
9.3 We will help you with your own duties to report to the ICO (normally within 72 hours of you becoming aware) and to tell the people affected.
10. Other help
We will give you reasonable help with data protection impact assessments and with any consultation with the ICO, taking into account what we know about the processing.
11. When the service ends: return and deletion
11.1 Ask us before your service ends and we will give you, free of charge, a zip file of your website’s files and your own content (text, images and uploads). You can copy your mailboxes with any email program before then, and we will help if you ask. This does not include our management portal, its code or any of our tools.
11.2 We then delete your personal data: 30 days after cancellation, or from day 90 after a missed invoice (see our Terms). We will confirm deletion if you ask.
11.3 Backups. After we delete your website, encrypted backup copies may remain in our backup system until they expire automatically, within 12 months. They are kept secure, are not accessed, and are not used to restore your website once your account has closed.
11.4 We may keep data where the law requires it, and keep it protected while we do.
12. Information and audits
12.1 We will give you the information reasonably needed to show we meet these terms. Please start with a written question; most can be answered that way.
12.2 If that isn’t enough, you (or an independent auditor bound by confidentiality) may carry out an audit, on at least 30 days’ written notice, during business hours, at your cost, and no more than once in any 12 months unless there has been a breach or the ICO requires it. An audit must not give access to other customers’ data or weaken our security.
13. Review-request emails
These apply if you use Socials + Reviews Setup or any feature that sends review requests to your customers.
13.1 You are the controller of your customer list. We send the emails only for you and only to the list you give us. We never use your list for anything else or contact your customers for our own purposes.
13.2 You confirm you are allowed to email everyone on the list, either because they are existing customers who were given a simple way to opt out when you collected their details and are being contacted about your own similar services, or because they specifically agreed to hear from you.
13.3 Every email says it is from your business, includes a working unsubscribe link and gives a valid contact address. We keep a list of everyone who unsubscribes or complains, and never email them again for you, even if they appear in a later list. We will stop sending if complaints suggest a list was not lawfully obtained.
13.4 Honest reviews only. You must ask all your eligible customers, not only the ones you expect to be happy, and must not offer any reward or incentive for a review unless the law allows it and it is clearly disclosed. You must not write, buy or commission fake reviews, or ask us to. We won’t filter or hide negative reviews in widgets we set up for you.
13.5 We may pause or refuse to send review requests if we reasonably think they break this section. If you are a business, you will cover our reasonable losses caused by your list or instructions breaking data protection, electronic marketing or consumer law.
13.6 We delete an uploaded customer list within 30 days after its emails have been sent. We keep the unsubscribe list for as long as we send for you, so opt-outs keep working.
14. Liability and order of precedence
Each party’s liability under these terms is subject to the limits in our Terms of Service, except where the law does not allow limits. If these terms conflict with the Terms of Service on data protection, these terms win.
Version 1.2, 6 October 2026. Phoenix Digital Innovations Ltd, trading as Phoenix Hosting, company number 17458875. ICO registration ZC259050.