Who We Are
This policy explains how we collect and use personal data when you use the websites and services of DragonWebHost, OnePoundEmail and MakeMyKB. It applies to customers, website visitors and anyone who contacts us.
The data controller is Michael Cooper, a sole trader trading as DragonWebHost, OnePoundEmail and MakeMyKB ("we", "us" or "our"). We are based in the United Kingdom and process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact: [email protected]
Our services are only for people aged 18 or over, and we do not knowingly collect data from children.
Data We Collect
- Account and billing details: your name, email address, postal address, phone number, company name, and your order and invoice history.
- Payment information: payments are handled by our payment processors. We do not see or store your full card number. We may hold a payment reference or token so that renewals can be charged automatically.
- Support communications: the content of support tickets, emails and any information you give us while we help you.
- Technical and log data: IP addresses, browser and device information, login times, and server logs. For email services, this includes message metadata such as sender, recipient, subject and delivery status. We do not read the content of your emails unless you ask us to as part of a support request.
- Order screening data: when you place an order, details such as your IP address, email address and country are checked to help detect fraudulent orders.
- Marketing preferences: whether you have opted in to, or out of, marketing emails.
Most of this data comes directly from you. Technical and log data is collected automatically when you use our websites and services.
How and Why We Use It
Under UK GDPR we must have a lawful basis for each use of your data:
- Contract: to set up, provide, bill for and support the services you order, and to send you essential service emails such as invoices, renewal reminders and outage notices.
- Legal obligation: to keep financial records for tax purposes and to respond to lawful requests from authorities.
- Legitimate interests: to keep our services secure, prevent fraud, enforce our Terms of Service and Acceptable Use Policy, protect our servers' sending reputation, improve our services, and send marketing to existing customers as described in Section 4. We only rely on this basis where our interests are not outweighed by your rights.
- Consent: for marketing to people who are not customers, and for any non-essential cookies. You can withdraw consent at any time.
New orders are screened automatically for signs of fraud. An order that is flagged is reviewed by a person before any decision is made to refuse it.
Marketing
If you are a customer, we may email you about our own similar products, offers and news. Every marketing email includes an unsubscribe link, and you can opt out at any time without affecting your service emails.
We will only send marketing to people who are not customers if they have opted in. We never sell your data or share it with other companies for their marketing.
Who We Share It With
We share personal data only where needed to run our services, with the following categories of recipient:
- Infrastructure providers: data centres, server and email infrastructure providers that host our services and your data.
- Payment processors: such as Stripe and PayPal, to take payments.
- Network and security providers: such as Cloudflare, which provides DNS and protects our websites from attacks.
- Email delivery: providers that send our service emails, and Brevo, which sends our marketing emails.
- Fraud prevention: services such as FraudLabs Pro, used to screen orders. Where spam or a chargeback is found to be intentional, details may be reported to FraudRecord.
- Domain registries and registrars: when you register a domain, your registrant details are passed to the relevant registry as required by its rules, and may appear in public WHOIS records where the registry requires it.
- Professional advisers and authorities: accountants, legal advisers, HMRC, the police or courts, where we are required or entitled to by law.
These organisations may only use your data to provide their services to us, or as the law requires.
International Transfers
Our hosting locations include the United Kingdom, the Netherlands, the United States and Singapore, and some of our providers are based outside the UK. Where your data is transferred outside the UK, we make sure it is protected by an approved safeguard, such as a UK adequacy decision, the UK-US Data Bridge, or the UK International Data Transfer Agreement or Addendum.
If you choose a hosting location outside the UK, the data you store on that service will be held in that location.
Data You Host With Us
For the websites, databases, files and mailboxes you store on our services, you are the data controller and we act as your data processor. We only process that data to provide the services, as set out in our Terms of Service, which together with this section form our data processing terms with you.
We will not access that data except to provide the services, to provide support you have asked for, to investigate abuse or security issues, or where the law requires it. We will tell you without undue delay if we become aware of a personal data breach affecting it.
Retention
- Financial records: invoices and payment records are kept for at least 5 years after the 31 January Self Assessment deadline for the tax year they relate to, as HMRC requires.
- Account and support records: kept while your account is active, and for up to 6 years after it closes in case of disputes or legal claims.
- Hosted data: deleted when your service is cancelled. Copies in backups are overwritten in normal backup rotation.
- Log data: kept for a limited period for security and troubleshooting, then deleted or overwritten.
- Marketing data: kept until you unsubscribe. We keep a record that you opted out so that we do not contact you again.
Cookies
Our websites use cookies that are strictly necessary for them to work, such as keeping you logged in to the client area, remembering your basket, and security cookies set by Cloudflare to block malicious traffic. These do not need your consent.
If we use any non-essential cookies, such as analytics, we will ask for your consent first.
Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls, two-factor authentication on administrative accounts, and isolation between hosting accounts. No system is completely secure, and you are responsible for keeping your own account passwords secure.
Your Rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Have your data deleted, where we have no legal reason to keep it.
- Restrict how we use your data.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Receive your data in a structured, commonly used, machine-readable format.
- Withdraw consent at any time, where we rely on consent.
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
Changes to This Policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed. If we make a significant change, we will email customers before it takes effect.