PRIVACY POLICY

1 INTRODUCTION

1.1 This Privacy Policy is provided by PageLove Ltd, a company registered in England and Wales under company number 16755312 with registered office at Pagelove Ltd 275 New North Road Islington # 1593 London,  N1 7AA (we, our or us).

1.2 We take your privacy seriously. Please read this policy carefully. It contains important information about how and why we collect, store, use and share information relating to you (personal data), and it explains your rights and how to contact us or the regulator if you have a complaint.

1.3 Our collection, storage, use and sharing of personal data is regulated by law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.4 In this policy, the Services means our website at https://pagelove.com, our hosting and web infrastructure platform, our control panel and tooling, and our support and billing services.

2 WHAT THIS POLICY COVERS, AND WHAT IT DOES NOT

2.1 We are the controller of personal data obtained through the Services about our customers, about people who visit our own website and about people who contact us. That means we are the organisation legally responsible for deciding how and why that personal data is used. This policy explains what we do in that capacity.

2.2 Where our customers host a website or application on our platform, any personal data inside that website or application — for example the details of people who fill in a contact form on it, or whose accounts it holds — is controlled by our customer, not by us. For that personal data we act only as a processor: we host and transmit it on our customer's instructions and we do not decide what it is used for.

2.3 There is one important exception. When you visit a website we host, we record technical information about that request — including your IP address — and we use it for our own purposes: detecting and preventing abuse and attacks, keeping the platform secure and available, and measuring our customers' usage against their plan. For that processing we are a controller in our own right, and clause 3 explains it.

2.4 If you are a visitor to a website we host and you want to know what happens to your personal data, please read that website operator's own privacy notice and contact them. If you contact us instead, we will normally pass your request on to our customer, and we will tell you that we have done so where we are able to.

2.5 The Services may link to, or rely on, websites and services operated by other people. Those services collect information in accordance with their own privacy policies. Clause 9 and our sub-processor list explain who we work with.

3 IF YOU ARE A VISITOR TO A WEBSITE WE HOST

3.1 This clause is for people who have no relationship with us at all — you visited a website, and it happens to be hosted on our platform.

3.2 When your browser requests a page from a website we host, our systems receive and record technical information about that request. That normally includes your IP address, the date and time, the page or file requested, the response we gave, the amount of data transferred, and information your browser sends about itself such as the user agent and the referring page.

3.3 We use that information for three purposes of our own:

1. (a) delivering the page — we cannot route a response back to you without your IP address;
2. (b) security and abuse prevention — detecting attacks, unusual access patterns, automated abuse and attempts to compromise the platform or the sites on it; and
3. (c) usage metering — counting requests and bandwidth so that we can measure our customers' usage against their plan and bill them correctly.

3.4 For the first purpose we rely on our legitimate interests in operating the service and in delivering the page you asked for. For the second and third we rely on our legitimate interests — ensuring the security of network and information systems, which UK data protection law expressly recognises as a legitimate interest, and running our business accurately and fairly. We have balanced those interests against your rights, and you can ask us for that assessment using the details in clause 19.

3.5 We do not use this information to build a profile of you, to track you across different websites, to advertise to you, or to identify you personally beyond what is necessary for the purposes above. We do not sell it.

3.6 You may see a “Powered by PageLove” banner at the foot of a website we host. That is our own branding, added to sites on our free plan. It is the same on every such site, it is not advertising, and it is not chosen or targeted using anything we know about you.

3.7 We keep it for the period set out in clause 11 and then delete or aggregate it.

3.8 We have no practical way of contacting every person who visits a website we host, so we make this information publicly available here instead, and we require our customers to tell their own visitors that they use us. Everything else on that website — its content, its cookies, its forms, its own analytics and any account you hold with it — is the responsibility of the person who operates it, not ours. Clause 2.2 explains the split, and you should read that operator's own privacy notice.

3.9 You have the rights set out in clause 14 in relation to this processing, including the right to object to it. Please use the contact details in clause 19.

4 THE PERSONAL DATA WE COLLECT

4.1 The personal data we collect depends on how you use the Services. We collect and use the following:

4.2 We collect most of this personal data from you directly, when you register, place an order, configure a host, contact us or respond to a survey. Some of it is generated automatically as you use the Services. A small amount comes from other people: our payment processor tells us whether a payment succeeded, and people who report content to us tell us about it.

5 SPECIAL CATEGORY DATA

5.1 Special category data (sometimes called sensitive personal data) means information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, and data concerning health, sex life or sexual orientation.

5.2 We do not knowingly or intentionally collect special category data, or data about criminal convictions and offences, about our customers, and you should not send it to us. If you do, we will handle it in accordance with this policy and delete it when we no longer need it.

5.3 Our customers may host content that contains special category data. Where that happens we are a processor, not a controller, as clause 2.2 explains, and our terms and conditions ask our customers to tell us first.

6 HOW AND WHY WE USE YOUR PERSONAL DATA

6.1 Under data protection law we can only use your personal data if we have a proper reason. The reasons we rely on are: to perform our contract with you, or to take steps at your request before entering into a contract; to comply with our legal and regulatory obligations; for our legitimate interests or those of a third party; and, in a small number of cases, where you have given consent.

6.2 A legitimate interest is a business or commercial reason for using your information, provided it is not overridden by your own rights and interests. We carry out an assessment whenever we rely on legitimate interests, balancing our interests against yours. You can ask us for details of that assessment using the contact details in clause 19.

6.3 The table below explains what we use your personal data for and why.

6.4 If we ever need to use your personal data for a purpose that is not compatible with one described above, we will tell you first and explain the legal basis we rely on.

7 MARKETING

7.1 We will only send you marketing emails where you have agreed to receive them, or where you have bought a paid plan from us, or taken steps towards buying one, and we are telling you about our own similar products and services. If you are on the free plan and have not done either, we will only send you marketing where you have agreed to receive it. Every marketing email contains a clearly visible unsubscribe link.

7.2 You can stop marketing at any time, free of charge, by clicking the unsubscribe link, by changing the settings in your account, or by emailing us at support@pagelove.com. Opting out of marketing does not stop us sending you service messages about your account, your billing or the security of the platform — we have to send those.

8 COOKIES AND SIMILAR TECHNOLOGIES

8.1 Our own website uses cookies and similar storage and access technologies. Some of them we may use without asking your permission, because the law allows it; for others we ask for your consent or give you a simple way to object. Our cookie banner and our cookie notice set out the detail, including a list of the specific technologies we use, what each one does and how long it lasts.

8.2 In summary:

1. (a) Strictly necessary and transmission technologies. These are needed to transmit a communication over a network, or are strictly necessary to provide the service you have asked for — for example keeping you signed in, remembering what you have put into a form, balancing load across our servers, authenticating you, preventing and detecting fraud, detecting technical faults and protecting the security of your device. We do not need your consent for these.
2. (b) Statistical technologies. We use these only to collect information about how our website is used so that we can improve it. We do not share what they collect with anyone else except to help us make those improvements. You do not have to consent to these, but we give you a simple, free way to object, and we will stop if you do.
3. (c) Appearance and functionality technologies. We use these to adapt how our website looks or works to your preferences. Again, you do not have to consent, but you may object at any time, simply and free of charge, and we will stop.
4. (d) Everything else, including any analytics or advertising technology that goes beyond the above. We use these only with your consent, which you may withdraw at any time through our cookie settings.

8.3 Most browsers also let you block or delete cookies through their own settings, although doing so may stop parts of our website working properly.

8.4 The hosts our customers run on our platform may use their own cookies. Those are our customers' responsibility, not ours, as clause 2.2 explains.

9 WHO WE SHARE YOUR PERSONAL DATA WITH

9.1 We routinely share personal data with service providers who help us run our business and deliver the Services. Those include our cloud and hosting infrastructure providers, our content delivery network provider, our payment processor, our email and communications providers, our customer support and ticketing providers, our analytics and monitoring providers, and our professional advisers.

9.2 We publish a separate list of our processors and sub-processors at [insert Sub-processor List URL]. That list names each provider, says what it does for us and where it processes personal data, and we keep it up to date. We publish it separately from this policy so that we can keep it current as our infrastructure changes. Our customers can subscribe to be notified when it changes, and our terms and conditions give at least 30 days' notice before we add or replace a sub-processor.

9.3 At the date of this policy, our infrastructure is hosted in the United States and we use Microsoft Azure as our content delivery network provider. Payments are processed by Stripe. We run sign-in and authentication ourselves, so no third party sees your sign-in details. If one of our customers builds a site that uses a third-party sign-in service of its own, that is a matter between the customer, its visitors and that service, and is governed by the customer’s own terms and privacy notice, not by ours. The sub-processor list is the authoritative and current record, and it prevails over this clause if the two differ.

9.4 We only allow a service provider to handle personal data where we are satisfied that it takes appropriate measures to protect it. We put a written contract in place with each of them requiring them to use personal data only to provide services to us and to you, and to keep it secure.

9.5 We or those providers may also need to share personal data with:

1. (a) law enforcement agencies, courts, tribunals and regulatory bodies, in order to comply with legal and regulatory obligations, or where we reasonably consider it necessary to prevent or detect crime;
2. (b) the National Crime Agency, where we are required to report child sexual exploitation and abuse content;
3. (c) the person who reported content to us, and the customer whose content it was, so that a report can be dealt with fairly and each of them can challenge our decision;
4. (d) our external auditors and our professional advisers, including lawyers and accountants, who are bound by duties of confidence; and
5. (e) another party in connection with a merger, acquisition, asset sale, financing, restructuring or insolvency, where information will be anonymised where possible and the recipient will be bound by confidentiality obligations.

9.6 We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.

10 TRANSFERRING PERSONAL DATA OUT OF THE UK

10.1 Our infrastructure currently runs in the United States, and we use a content delivery network to distribute content, which means personal data may be processed in, and served from, locations anywhere in the world. We may change where our infrastructure runs. The current position is always shown on our sub-processor list.

10.2 Under UK data protection law we may only transfer personal data outside the UK where the transfer is approved by regulations made by the Secretary of State, where it is made subject to appropriate safeguards, or where a specific exception applies.

10.3 For transfers to the United States, we rely on one or both of the following:

1. (a) the UK Extension to the EU–US Data Privacy Framework, where the recipient is a US organisation that is actively self-certified to the UK Extension for the type of data concerned. We check that a recipient's certification is active and covers the relevant data before we rely on it, and we check periodically that it remains active; and
2. (b) the ICO's International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with an assessment of whether the protection for the personal data would be materially lower than it is under UK law, taking account of the nature and volume of the personal data being transferred.

10.4 For transfers to other countries, we rely on regulations approving transfers to that country where they exist, and otherwise on the International Data Transfer Agreement or the UK Addendum together with the same assessment.

10.5 You can ask us which mechanism applies to a particular transfer, and ask for a copy of the safeguards we have put in place, by emailing support@pagelove.com. We will provide a copy, redacted where necessary to protect commercial confidentiality or the security of the platform.

11 HOW LONG WE KEEP YOUR PERSONAL DATA

11.1 We keep personal data only for as long as we need it. In general:

11.2 At the end of the retention period we delete or anonymise the personal data. Where deletion is not immediately possible — for example because it is held in a backup — we isolate it and delete it when the backup is next cycled.

12 AUTOMATED DECISIONS

12.1 We use automated systems as part of monitoring the platform for abuse, fraud, attacks and excessive resource use. Those systems may, for example, flag an account, rate-limit traffic, or temporarily restrict a host in order to protect the platform.

12.2 Where a decision has a legal effect on you, or a similarly significant effect — for example suspending or closing your account, or permanently removing a host — we do not take that decision by automated means alone. There is meaningful human involvement before it takes effect, or, where we have had to act immediately to protect the platform, as soon as possible afterwards.

12.3 Where we take a significant decision that is based on automated processing, you have the right to be told about it, to make representations about it, to ask for human intervention on our part, and to contest it. To do any of those things, email us at support@pagelove.com or use the challenge route in our terms and conditions.

12.4 We do not use automated decision-making, or profiling, for marketing purposes.

13 DE-IDENTIFIED INFORMATION

13.1 We may aggregate or otherwise de-identify personal data so that it can no longer be used to identify anyone, for example to produce statistics about platform performance, traffic patterns or attack trends. Once information has been properly de-identified it is no longer personal data, and we may use and share it without restriction. We will not attempt to re-identify it, and we will not publish anything that would allow a particular customer or a particular host to be identified without that customer's agreement.

14 YOUR RIGHTS

14.1 You have the following rights, which you can usually exercise free of charge. Some of them apply only in particular circumstances, and we will tell you if a right does not apply to your request and why.

14.2 To exercise a right, email us at support@pagelove.com or write to us at the address in clause 19. Please tell us which right you want to exercise, and what information your request relates to, and give us enough information to identify you. We may ask you for more information to confirm your identity.

14.3 We will respond within one month. That month runs from the later of the day we receive your request, the day we receive any information we have asked for to confirm your identity, and the day any fee we are entitled to charge is paid. We may extend it by a further two months where your request is complex or where you have made a number of requests, and if we do we will tell you within the first month and explain why. If we reasonably need more information from you in order to identify the information your request relates to, the time we spend waiting for your answer does not count towards that period.

14.4 The Information Commissioner's website at ico.org.uk has more detailed information about each of these rights.

15 KEEPING YOUR PERSONAL DATA SECURE

15.1 We have appropriate technical and organisational measures in place to prevent personal data from being accidentally lost, or used or accessed unlawfully. These include encryption of data in transit and at rest, access controls, passkey-based sign-in rather than passwords, multi-factor authentication for administrative access, logging and monitoring, and separation of environments. We limit access to personal data to those who have a genuine business need for it, and they are subject to a duty of confidence.

15.2 We have procedures for dealing with any suspected personal data breach, and we will notify you and the relevant regulator where we are legally required to do so.

15.3 No system is completely secure. You are responsible for keeping your passkeys and the devices that hold them secure, for the security of the code and dependencies you deploy, and for the secrets you store on the platform.

15.4 If you believe you have found a security vulnerability in the Services, please tell us at security@pagelove.com.

16 HOW TO COMPLAIN

16.1 If you have any question or concern about how we use your personal data, please tell us first so that we have the chance to put it right. You can complain to us by email at support@pagelove.com, by using our complaint form, by telephone, or by writing to us at the address in clause 19. Our telephone number and postal address are in clause 19. We will make it easy for you to complain and we will not make you use a particular route.

16.2 We will acknowledge your complaint within 5 business days of receiving it. We will then take appropriate steps to look into it and respond without undue delay, and we will tell you the outcome. If it is going to take us a while, we will keep you updated on progress.

16.3 You also have the right to complain to the Information Commissioner, who is the UK's data protection regulator. You can do that at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. You do not have to complain to us first, although we would prefer the chance to put things right.

16.4 If you are in the European Economic Area, you may also complain to the supervisory authority in the country where you live or work, or where the problem happened. You may also raise the matter with our Article 27 representative — see clause 19.

17 CHILDREN

17.1 The Services are not intended for use by anyone under 18, and we do not knowingly collect personal data about children through them. If you believe a child has given us personal data, please tell us at support@pagelove.com and we will delete it.

18 CHANGES TO THIS POLICY

18.1 We may change this policy from time to time, for example to reflect a change in the law, in the Services, or in the way we work. The version number and date at the top of this policy tell you when it was last updated.

18.2 Where we make a significant change we will tell you — for example by email, or by a notice in the control panel or on our website — before it takes effect. Where a change means we will use your personal data for a new purpose, we will tell you before we start.

18.3 We keep previous versions of this policy. If you want a copy of the version in force on a particular date, ask us at support@pagelove.com.

19 HOW TO CONTACT US

19.1 For any question about this policy or about our privacy practices, to exercise a right, or to make a complaint, please contact us:

19.2 We are not required to appoint a Data Protection Officer, and we have not appointed one. If you have a data protection question, use the privacy address above and it will reach the people responsible for data protection here.

19.3 Because we offer our services to people in the European Union, we have appointed a representative in the Union under Article 27 of the EU General Data Protection Regulation. Our representative is Rafael Moreira of [insert address], and you can contact them at eu@pagelove.com. You may raise any data protection matter with them instead of, or as well as, us.

19.4 Separately, our legal representative in the Union under Article 13 of the Digital Services Act, and our points of contact under Articles 11 and 12 of that Regulation, are set out in our Terms and Conditions.