Privacy Policy

Last updated: [date] · Version: draft

Placeholder – not yet in force This page is a draft outline for review against UK GDPR and the Data Protection Act 2018. It has not been reviewed by a solicitor and must be completed and approved before THOST accepts customers. Items in [square brackets] need to be filled in.

1. Who is responsible for your data

THOST ([legal entity name], [address]) is the data controller for personal data collected through this website and our billing and control panel systems. Contact: [email protected]. [Add ICO registration number if registered.]

2. What we collect and why

Account details – name, email address, postal address and phone number, collected when you order. Used to set up and run your account, invoice you and contact you about the service. Legal basis: performance of a contract.
Payment information – card payments are processed by Stripe. We do not store your full card number; we receive a payment reference and the last four digits. Legal basis: performance of a contract.
Service data – the websites, files, databases and email you store on our servers. We process this only to provide the service, and do not look at it except where needed for support at your request, to investigate abuse, or where required by law.
Technical logs – IP addresses, request times and browser details in web server, mail and control panel logs, kept for [X] days for security, troubleshooting and abuse prevention. Legal basis: legitimate interests.
Support correspondence – emails and tickets you send us, kept so we can help you and refer back to previous issues. Legal basis: performance of a contract / legitimate interests.

3. Cookies

This marketing website does not set cookies. The billing portal and control panel set strictly necessary session cookies so you can stay logged in; these do not require consent. We do not use advertising or third-party analytics cookies. [Update if analytics is added.]

4. Who we share data with

We share personal data only with providers we need to run the service: Stripe (payments), [email delivery provider, if any], and [data centre / infrastructure provider]. We do not sell personal data. We may disclose data where required by law or to protect our rights or the safety of others.

5. Where your data is stored

Our servers are located in the United Kingdom. Stripe may process payment data outside the UK under appropriate safeguards (standard contractual clauses or an adequacy decision).

6. How long we keep it

Account and invoice records are kept for [6] years after your account closes to meet HMRC record-keeping requirements. Service data is deleted [X] days after your account ends. Logs are kept for [X] days.

7. Your rights

Under UK GDPR you have the right to access, correct or delete your personal data, to restrict or object to processing, and to data portability. To exercise these rights, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

8. Changes to this policy

We will post any changes on this page and, where they are significant, tell you by email.