Privacy Notice

1. Who we are

This privacy notice is issued by Swift Nest Hosting, a sole trader trading under the name SwiftNest Hosting, of [CORRESPONDENCE ADDRESS] ("SwiftNest", "we", "us", "our"). We are not a registered company and have no company number.

For the purposes of the UK GDPR and the Data Protection Act 2018, Swift Nest Hosting is the data controller in respect of the personal data described in this notice, unless we state otherwise.

You can contact our data protection contact, or raise any data protection query, at privacy@swiftnesthosting.com or by post to [CORRESPONDENCE ADDRESS].

2. What this notice covers

This notice explains how we handle personal data in three situations:

1. When you are our customer. Where you buy hosting, a domain, email, a VPN subscription, a security audit or a website build from us.
2. When you use this website. Where you complete our contact form, apply to us, or otherwise interact with this site.
3. When you use our services. Where you host a website that itself collects personal data from your own visitors.

Clause 3.7 is particularly important if you operate a website: when your website collects personal data from visitors, you are the controller and we act as your processor. That relationship is governed by our contract terms rather than by this notice, and is explained at clause 3.7.

3. The data we collect and why

3.1 Account and identity data

What we collect: your name, company name (if applicable), billing address, email address, telephone number, and the account credentials you create, including your control panel username and password hash.

Why: to create and administer your account, to authenticate you, and to meet our legal obligations. Lawful basis: performance of a contract with you, and compliance with a legal obligation.

We ask for identification evidence only where we are required to do so, for example where we need to satisfy anti-money-laundering checks or investigate suspected payment fraud.

3.2 Billing and payment data

What we collect: your billing address, the Plan you have purchased, invoices, payment status, and transaction references. Where you pay by card or direct debit, we receive confirmation of the transaction from our payment processor.

Why: to take payment, to keep accurate accounting records, and to comply with tax law. Lawful basis: performance of a contract, and compliance with a legal obligation.

3.3 Technical and connection data

What we collect: your IP address, the date and time of connections to our servers, the hostname or domain requested, browser and device type, and the pages or resources requested.

Why: to deliver the services, to diagnose faults, to apply rate limits, and to detect and prevent abuse, fraud and security incidents. Lawful basis: performance of a contract, our legitimate interests in securing and operating the platform, and compliance with a legal obligation.

3.4 Server, security and abuse logs

What we collect: web server access and error logs, FTP and SSH login records, control panel audit logs, mail delivery logs, firewall and intrusion-prevention events, and records of any action we take in response to an abuse report or policy breach.

Why: to operate the platform securely, to investigate abuse and security incidents, to comply with legal requests, and to enforce our Acceptable Use Policy. Lawful basis: our legitimate interests in protecting the platform, our customers, and the wider internet, and compliance with a legal obligation.

These logs are retained for no more than 6 months. See clause 9.

3.5 Email and messaging content

What we collect: the content of emails you send or receive through your hosted mailboxes, including recipients, headers and message bodies, and any content you submit through our support channels.

Why: to provide the email hosting service you have bought, to route and deliver your mail, to filter spam and malware, and to respond to your support requests. Lawful basis: performance of a contract.

3.6 Domain registration data

What we collect: when we register a domain on your behalf, we provide your contact details to the relevant domain registry, including your name, organisation, postal address, email address and telephone number.

Why: to register and maintain the domain, which registries require as a condition of registration. Lawful basis: performance of a contract, and compliance with a legal obligation.

Registries operate public WHOIS or RDAP lookup services, so much of this information is publicly visible on the internet by design and cannot be kept confidential. This is a deliberate requirement of domain registration, not a decision by us. Where you would prefer reduced exposure, our privacy proxy service replaces your contact details with ours where the registry supports it — see clause 13.

3.7 Personal data collected through your own website

If you host a website that collects personal data from your own visitors — for example through a contact form, an account area, a booking system or a checkout — then you are the controller of that data and we are your processor.

In that situation:

• we do not decide what personal data your website collects, why it is collected, or how it is used;
• you must have a lawful basis for that processing, tell your visitors who the controller is, provide the required privacy information, and respond to their rights requests;
• we process that data only on your documented instructions, for the purposes you specify, and for no other purpose;
• you are responsible for the lawfulness of that collection and use. We provide the infrastructure, not legal advice.

Our contract terms contain the written data processing agreement that governs this relationship, including our obligations to protect the data, to use sub-processors only with your authorisation, and to assist you with data subject requests and impact assessments.

3.8 Website security scans and audits

What we collect: where you commission a scan or audit, the URL or IP address of the website, the technical findings, and any vulnerabilities we report.

Why: to provide the scan or audit, and to keep a record of the advice we have given. Lawful basis: performance of a contract and our legitimate interests in the security of our own platform.

A scan report can itself contain sensitive information about your systems. Reports are confidential, are shared only with the account holder, and are not published or passed to third parties.

3.9 Free tools (speed check and launch checklist)

What we collect: when you use our free website speed check, the web address you enter is sent to Google's PageSpeed Insights service to obtain the measurement — that is how their service works, and we cannot run the check without it. If you ask us to email you the report, we also store your email address alongside the score and the date, in a small log file on our server. The launch checklist form stores only your email address and the date.

Why: to deliver the tool you asked for, and, where you give us your address, to send the report and answer follow-up questions about it. Legal basis: consent, given by choosing to use the email option.

We do not add you to a mailing list, and you can ask us to delete your entry at any time by emailing privacy@swiftnesthosting.com. Lead log entries not followed up within 12 months are deleted.

3.10 Live chat

What we collect: when you use the chat box on our website, we store your messages and any screenshots you attach, along with the name and email address you give us (both optional while we are online; an email address is required if you contact us while we are offline so that we can reply). We also record your IP address, the page you were on, and the date and time, so that we can answer you and deal with misuse. Screenshots are stored outside the publicly accessible part of our server and can only be opened by you or by our support team.

Why: to answer your enquiry and keep a record of the conversation. Lawful basis: consent, given by choosing to use the chat, and our legitimate interests in responding to business enquiries. If you give an email address, we may email you a reply to your enquiry; we do not add you to a mailing list.

You can ask us to delete your chat history at any time by emailing privacy@swiftnesthosting.com. Chat transcripts are otherwise kept as support correspondence (see clause 9).

3.11 Data we do not collect

We do not knowingly collect special category data (such as health, biometric or political opinions) or data about criminal convictions through this website or our standard onboarding process. If your service requires us to process such data, we will put a separate arrangement in place first.

4. Data we collect from this website

Our contact form asks you to provide your name, email address, and — optionally — your telephone number and the town or city in Essex where you are based, along with the service you are interested in and details of your enquiry. We also record the date and time of your enquiry.

Why: to respond to your enquiry, to prepare a quotation, to assess whether we can help, and to keep a record of correspondence. Lawful basis: taking steps at your request prior to entering into a contract, and our legitimate interests in responding to business enquiries and in understanding the needs of our customers.

Re-use and marketing. We use the details you give us to respond to your enquiry. We will only use them to send you marketing communications where you have asked us to, or where we have another lawful basis, such as where you are an existing customer and the message is about services you have bought from us. You can withdraw consent to marketing at any time, and we will stop within 14 days. We do not sell personal data, and we do not share it for third-party advertising.

4.1 Google reCAPTCHA

Our email addresses, support correspondence and billing records are held in our own systems and are not passed to advertising networks.

Cookies and similar technologies

This website does not set advertising or analytics cookies. We deliberately do not run Google Analytics, Meta Pixel, or any advertising tracker, and we do not sell or share data about your visit to advertising networks.

The only technology used on our own pages is:

• Google reCAPTCHA, which is described at clause 4.1 and may set cookies. You can read what those cookies are at policies.google.com/technologies/cookies.
• Our own page counting — only if you accept. If you click Accept on our cookie banner, each page you load sends one count to our own server: the page visited, the website you came from (if your browser shares it — we keep only the site name, never the full address), and whether you are on a phone or a computer. We also record your IP address, which we use to tell visits apart, to detect misuse, and to work out your approximate location (country and city). To do the last part, we send the IP address to ipwho.is, a geolocation service — they receive the address so that they can return the location, and nothing else about you. This uses two first-party cookies and nothing else: swfn_consent remembers your Accept/Reject choice for 12 months, and swfn_vid gives your browser a random ID for up to 13 months so that we can tell new visitors from returning ones and measure whole visits rather than isolated clicks. We store no advertising identifiers, create no fingerprints, and share nothing with advertising networks. Do Not Track is respected until you make a choice — once you click Accept, that specific choice applies going forward. Counts, IP addresses and derived locations older than 180 days are deleted automatically, and you can withdraw consent at any time via the Cookie settings link in our footer, which stops further counting immediately. The lawful basis is consent, given through the banner, and our legitimate interests in understanding how our website is used and in keeping it secure.

Beyond that, we use only what is technically necessary to deliver a page — such as caching headers — and no profiling or fingerprinting.

Your own website. If you host a website with us, the cookies and trackers it uses are entirely under your control. Cookies deployed by WordPress plugins, themes, analytics services, advertising networks and social media widgets on your site are set by those third parties, not by us. You are responsible for ensuring your website complies with the rules on cookies and similar technologies, for obtaining the consent your site needs, and for maintaining a cookie banner that accurately describes what your site does. We are happy to advise, but we cannot review your website's compliance for you.

6. How we use your data

We use personal data only for the purposes set out in this notice, and only on the lawful bases described. Specifically, we use it to:

1. provide the services you have contracted for, and support you in using them;
2. take payment, issue invoices, and keep accounting records;
3. register, renew and manage domains on your behalf;
4. route, deliver and filter your email;
5. monitor our platforms for security, abuse, fraud and capacity, and enforce our Acceptable Use Policy;
6. respond to enquiries, and provide quotations and demonstrations;
7. send service messages — such as renewal reminders, invoices, maintenance notices, security alerts and outage notifications — about services you have bought;
8. send you the newsletter or offers you have asked for, where you have asked for them;
9. improve our services, our website and our support, using aggregated or anonymised information wherever we can;
10. detect and prevent fraud, and comply with our legal and regulatory duties;
11. establish, exercise or defend legal claims;
12. comply with valid requests from law enforcement and regulators.

We do not use your data for automated profiling for advertising, and we do not make decisions that produce legal or similarly significant effects for you by automated means alone.

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms, and we have put in place safeguards to limit the impact on you.

7. Who we share your data with

We do not sell, rent or trade personal data. We share it only with the categories of recipient below, and only where it is necessary to deliver the service or meet a legal obligation.

7.1 Service providers and sub-processors

We use third-party suppliers to run our business. They act on our instructions and may not use your data for their own purposes. Our sub-processors include providers of:

• hosting and data centre infrastructure (UK-based data centres);
• payment processing and billing;
• domain registration, for the registry operation described at clause 3.6;
• email delivery, spam filtering and IP reputation management;
• website hosting, backup storage and content delivery;
• accounting, invoicing and business administration;
• customer support, including abuse and security monitoring.
• IP geolocation for our website statistics (ipwho.is) — receives IP addresses only, in order to return the country and city; see clause 5.

Where our contract with you allows us to appoint sub-processors, we will notify you before a change takes effect and give you a reasonable opportunity to object. To see the current list, email privacy@swiftnesthosting.com.

7.2 Professional advisers and authorities

We may disclose data to our professional advisers (such as accountants and solicitors), our auditors, insurers, and to regulators, tax authorities, law enforcement or courts where we are legally required to do so. Where we are permitted to, we will tell you about the disclosure unless we are prohibited by law.

7.3 Your website's visitors

Where you host a website that collects personal data from visitors, you decide what is collected and who receives it. We do not sell visitor data and we do not share it with advertisers. We disclose visitor data to third parties only where you instruct us to, or where the law requires it.

7.4 Business transfers

If we sell or transfer all or substantially all of our business to a new owner, we will give you notice before your information is transferred and you will have the opportunity to object. Any new owner must process your data on the same terms as this notice.

8. International transfers

Our primary servers are located in the United Kingdom, and the great majority of personal data is processed in the UK and is therefore subject to UK law only.

However, some of our suppliers process data outside the UK or EEA. Where that happens, we rely on an adequacy regulation covering the destination country, or on the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. We have assessed the transfer, and we take supplementary measures — such as encryption in transit and at rest, and access controls — where we judge them appropriate.

The clearest example is Google reCAPTCHA, which involves a transfer to the United States, as described at clause 4.1. To find out which of our suppliers process data outside the UK, email privacy@swiftnesthosting.com.

9. How long we keep your data

We keep personal data only for as long as we need it, and then delete or anonymise it.

• Account and billing records — for the duration of your contract, and then for 6 years afterwards, because tax law and company law require us to retain accounting records for that period.
• Server, security and access logs — up to 6 months.
• Website visit counts — 180 days, then deleted automatically. These contain page views, referrer site names, device types, IP addresses and derived country/city locations, but no advertising identifiers and no fingerprints. The cookies on your own device (swfn_consent up to 12 months, swfn_vid up to 13 months) are removed by clearing your cookies or using Cookie settings.
• Backup copies containing your Content — for 7 days, being deleted or overwritten on a rolling basis. Where your Plan includes automatic backups, we take them once a day.
• Website Content on your account after cancellation — up to 30 days from the date of cancellation, so that you can retrieve it. We then delete it.
• Support correspondence — 3 years from the last contact, so that we can maintain a useful history of what we have done for you. Live chat transcripts and attached screenshots count as support correspondence.
• Enquiries and quotes that do not become customers — 24 months, so that we can pick up a conversation where you left it.
• Marketing records — until you unsubscribe, plus a suppression record so that we do not contact you again after you ask us to stop.
• Abuse and enforcement records — 6 years, so that we can demonstrate what action we took where necessary.
• Security scan and audit reports — 3 years from the date of the report.
• Domain registration data — for the duration of the registration plus the registry's required redemption period.

Where we anonymise data, it can no longer be linked back to you, and at that point it is no longer personal data.

10. Your rights

Under the UK GDPR you have the following rights. We respond to all requests free of charge and normally within one month.

10.1 The rights themselves

• Right to be informed — you have the right to know what personal data we hold about you, why we hold it, who we share it with, and how long we keep it. This notice is designed to satisfy that right, and you can ask for anything further.
• Right of access — to get a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate data corrected and incomplete data completed.
• Right to erasure ("right to be forgotten") — to have your data deleted in certain circumstances. We may decline where we are required to keep the data, for example for tax accounting or where needed to establish or defend a legal claim.
• Right to restriction — to restrict how we use your data while a dispute about accuracy or legitimate interests is resolved.
• Right to data portability — to receive certain data in a structured, commonly used, machine-readable format so you can move it to another provider. This applies to data you gave us and which we process on the basis of consent or contract.
• Right to object — to object to our processing based on legitimate interests, and in particular to marketing. When you object to marketing, we stop immediately and in any event within 14 days.
• Right to withdraw consent — to withdraw consent at any time where we rely on consent. Withdrawal does not affect processing we carried out before you withdrew it.

10.2 How to exercise a right

Email privacy@swiftnesthosting.com from the address on your account, or write to us at [CORRESPONDENCE ADDRESS]. Please tell us which right you wish to exercise and enough detail for us to find your records — your account name and domain names will usually be sufficient.

We may ask you to verify your identity before we release information, to prevent someone else obtaining your data. We will ask for proportionate verification, and we will not ask for a document you would not ordinarily be expected to have.

We aim to respond within one month. If a request is complex or we receive many at once we may take up to two further months, and we will tell you if that happens and why.

10.3 If we decline a request

If we cannot comply with a request we will tell you why, and we will explain that you have the right to complain to the ICO at clause 16.

11. Automated decision-making and profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you. That means we do not, for example, decide to refuse service, set your price, or offer you a specific deal based solely on automated analysis.

We do use some automated processes to keep the platform secure, including automated abuse and malware detection. These systems may flag an account for review, but a decision to suspend or terminate an account is always taken by a person. You can ask us for information about any automated decision affecting you, and you can ask for human intervention.

12. How we protect your data

We maintain a range of technical and organisational measures appropriate to the risk, which are described in full at clause 21 of our Terms & Conditions. In summary these include:

• UK data centres with physical access controls and separation between customers;
• encryption in transit, including free SSL certificates and TLS for control panel, FTP, email and database connections;
• multi-factor authentication for privileged access to our own infrastructure, and least-privilege access rules;
• network segregation, firewalls, rate limiting and intrusion detection between customers;
• patched and monitored server software, with staged rollouts;
• role-based access to customer data, restricted to staff who need it;
• staff confidentiality obligations and security awareness training;
• regular backup and restoration testing.

Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will notify you without undue delay, tell you what happened in plain terms, and explain the steps you should take.

No system is completely secure. If you believe your account has been compromised, contact us immediately at abuse@swiftnesthosting.com and change your passwords.

13. International and public data

We do not publish your details anywhere else. We do not maintain a public customer list, and we do not disclose who our customers are.

Where your website publishes an email address in a mailto link or in the page source, that address will be collected by web crawlers and may end up in spam lists. We can help you obfuscate addresses, but the decision about how to publish your contact details rests with you.

14. Children

Our services are aimed at businesses and adults. You must be 18 or older to enter into a contract with us.

We do not knowingly collect personal data directly from children under the age of 18, and we do not knowingly permit children to create accounts. If you are under 18, you may use the services only with the written consent of a parent or guardian who enters into the contract on your behalf. If you believe a child has provided us with personal data without a parent or guardian's consent, please tell us at privacy@swiftnesthosting.com and we will delete it.

Where you host a website aimed at children, or which collects personal data from children, you are responsible for ensuring that you have a valid basis for that collection and that you obtain any consent required. You must not use our services in a way that collects children's data without a proper basis.

15. Changes to this notice

We review this notice at least annually, and whenever we make a material change to what we collect or how we use it. The effective date at the top of this page shows when the current version took effect.

Where a change materially affects how we use your data, we will give you at least 30 days' notice by email before it takes effect, and we will summarise what has changed. This notice does not form part of your hosting contract, so we may update it without requiring your consent, but where a change would reduce your rights or widen our use of your data we will always tell you first.

16. How to contact us or complain

SwiftNest Hosting

Swift Nest Hosting (a sole trader, not a registered company)

Correspondence address

[CORRESPONDENCE ADDRESS]

Data protection enquiries

privacy@swiftnesthosting.com

General support

support@swiftnesthosting.com

If you are unhappy with how we have handled your personal data, please tell us first so that we can put it right. We will acknowledge your complaint within one UK working day and aim to resolve it within 10 working days.

If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office. You can contact the ICO at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
ico.org.uk/make-a-complaint

We would rather you gave us the chance to fix it first, but you are under no obligation to do so before contacting the ICO.