Privacy Policy
Revised July 30, 2026
1. The controller
The data controller is IGI Security Services Ltd, a company incorporated in England and Wales and holding company number 15881180, registered office 60 Tottenham Court Road, Suite 4944a, Fitzrovia, London, United Kingdom, W1T 2EW. Hosting Seller is a trading name of IGI Security Services Ltd.
Any question about your personal data, including the rights set out in section 7, should go to info@hosting-seller.com with the words “Data protection” written in the subject line.
Our base is in the United Kingdom, and our customers are spread across the world. So this policy is drafted to satisfy the UK GDPR and the EU GDPR at the same time.
2. The data we hold
- Account and billing details — your name, the email address you use, a billing address, and every invoice raised against the account.
- Payment details — Stripe deals with these. All that arrives on our side is a payment token plus the last four digits of the card. Neither the full number nor the security code ever lands in our systems.
- Support correspondence — tickets, email threads, and whatever detail you decide to include in them.
- Domain registrant details — the contact details every registry insists on seeing before it will put a domain in your name.
- Technical logs — IP addresses, request data and error logs, all thrown off as you work the platform.
- Your site's content — the files, databases and mailboxes sitting on your hosting with us. We stay out of them. The exceptions are narrow: you ask for support and want us to look, or a specific abuse or security report leaves us no choice.
3. Purposes and lawful bases
Every purpose needs a lawful basis under data protection law. Rather than compress ours into a summary, we have written each one out below in full, so nothing is hiding behind a tidy heading.
| Purpose | Lawful basis | What it covers |
|---|---|---|
| Delivering what you ordered | Contract | Opening the account, building your hosting, registering domains, issuing invoices and taking payment for them. |
| Dealing with support requests | Contract | Handling tickets and letters back and forth, along with whatever content you decide to include. |
| Keeping the platform safe | Legitimate interests | Server logs, IP addresses, chasing abuse and stopping fraud. The interest we are protecting is a platform nobody can misuse. That strikes us as proportionate: little is gathered, and none of it stays on file for long. |
| Service notices you cannot opt out of | Contract | Renewal reminders, invoices, maintenance windows, notices when something breaks. That rides with the service, and none of it is marketing. |
| Marketing email | Consent | Sent only where you have opted in. Withdraw at any point, either by using the unsubscribe link at the bottom or by writing to us. |
| Analytics | Consent | Measurement and advertising tags load only once you have accepted the category holding them, and you can take that acceptance back from the footer of any page. |
| Page-speed measurement | Legitimate interests | Core Web Vitals timings, gathered with no cookies and no identifier attached, which lets us see whether real visitors find the site quick rather than trusting a lab bench for the answer. What we are protecting here is a site that works, and we call that proportionate because none of the measurements can be traced back to you as a person. |
| Accounting records | Legal obligation | UK tax law requires us to retain records of every transaction for a fixed period. |
We sell no personal data to anyone, and we put none of it into machine-learning training.
4. Cookies and measurement
A handful of necessary cookies hold the site together — the currency your prices are shown in, and the note of what you decided about cookies, which stops the banner from asking twice. No consent is needed for either.
Everything else sits still until you say yes. This deployment carries no measurement or advertising tag at all, so nothing in either category actually runs, even for a visitor who accepts every last one of them. The Cookie Settings link at the foot of every page opens the panel again with your current answer displayed, so changing or withdrawing it costs you no more effort than giving it did. Our cookie policy has the detail.
Up to August 2026 this section described our analytics as cookieless and denied any advertising trackers. The tooling behind that claim has since been swapped out. What you read here now matches what the site actually loads, rather than an old wording left to drift out of date.
5. Who else handles your personal data
The circle stays small. Every party named below either follows our written instructions under contract, or ranks as a controller in its own right because the service leaves no alternative. A domain registry is the obvious case: it keeps registrant records itself, rather than on our behalf.
| Recipient | Role | Location |
|---|---|---|
| Vercel | Runs this website and delivers its pages | US / global edge |
| 20i | Runs the hosting platform, plus the server that carries our billing system | United Kingdom |
| Stripe | Processes card payments and stores the card details themselves | US / Ireland |
| Namecheap | Handles registration and renewal for most extensions | United States |
| PKNIC | The official registry behind .pk domains | Pakistan |
| Resend | Sends our contact-form and newsletter email, which means it receives the name, address and message you type in | United States |
| Domain registries | Hold the registrant record behind each domain you register with us | Varies by extension |
| Pexels | Serves some of the illustrative photography, which sends your IP to their CDN | Global CDN |
The law can compel us to release data, and we may also use it to bring a legal claim or to defend one.
6. Moving data beyond the UK and the EEA
Your data can cross a border, because not every provider named above operates within the UK or the European Economic Area. Where that happens, the transfer only proceeds behind an appropriate safeguard: a UK adequacy decision for the country receiving it, the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses.
Your hosting account, and everything stored on it, sits inside a London datacentre. Write to info@hosting-seller.com if you would like to know which safeguard applies to any particular transfer.
7. What you are entitled to ask of us
Over your own personal data, these rights belong to you. To exercise one, email info@hosting-seller.com. We answer within one month, and there is no charge from us for doing it.
- Access — Ask for a copy of whatever personal data we hold about you.
- Rectification — Have anything inaccurate or half-finished in your record corrected.
- Erasure — Have your data erased, so long as no legal duty requires us to retain it.
- Restriction — Tell us to hold processing still while a dispute about accuracy or legitimacy gets resolved.
- Portability — Receive back the data you supplied, in a structured and machine-readable form.
- Objection — Object to any processing that rests on the legitimate-interests basis.
- Withdraw consent — Withdraw consent whenever you wish, though whatever was processed beforehand remains lawful.
Before acting, we may need to establish that you are who you say, so your data does not reach a stranger.
Not satisfied with the way we handled your data? A complaint about it can go to the UK's Information Commissioner's Office at ico.org.uk. Inside the EU, the supervisory authority for your own country is the place to go. Given the choice we would rather fix the problem ourselves first, though nothing whatsoever requires you to come to us before taking it to a regulator.
8. How long any of it stays
- Account and billing records — held for the whole time your account stays open, then a further six years counted from your final transaction, which is the period UK tax law sets.
- Support tickets — three years past the closing date, so the history is on hand should the same fault come back.
- Server and access logs — 30 to 90 days as a rule, and longer only where a particular log belongs to a live security or abuse investigation.
- Your hosted content — kept for as long as the service runs, then sitting in backups for a short while after you cancel, and gone with the account once that window closes.
- Marketing consent records — retained until you withdraw consent, along with a record of that withdrawal so we can honour it afterwards.
9. Domains and public WHOIS
Registering a domain hands your contact details to the registry. Where the registry permits it, we turn on free WHOIS privacy, and nothing personal shows up in the public lookup. A number of extensions refuse to allow it, country-code ones in particular, and on those your details can sit on an open record for anyone to read. Ask us before you register if that would trouble you.
10. Children
Nothing we sell is aimed at children, and to the best of our knowledge we collect no data from anyone under 16. If you believe a child has handed us personal details, tell us and we will delete them.
11. Revisions to this policy
If an amendment makes a real difference to the way your data is handled, an email or a notice in your client area reaches you before it takes effect. Look at the date at the top of this page: that tells you which version you are reading. Send any question to info@hosting-seller.com.