We only use personal information where we have a clear reason to do so — mainly to provide your services, take payment, keep accounts secure, meet legal duties and improve WebFlag. We do not sell your personal information.
1. Who we are
WebFlag is the trading name of WebFlagUK Limited, a company registered in Scotland under company number pending confirmation, with its registered office in Glasgow, Scotland (“WebFlag”, “we”, “us” or “our”).
For UK data-protection law, we are usually the controller of personal information collected through our website, customer portal, sales, billing and support operations. Where customers store personal information within their hosted websites, databases or email accounts, the customer will usually be the controller and WebFlag will act as a processor under our Data Processing Terms.
Our ICO registration number will be published here if registration is required.
2. Personal information we collect
| Category | Examples | How we obtain it |
|---|---|---|
| Identity and contact | Name, business name, postal address, email address and telephone number | From you when you enquire, order or contact support |
| Account information | Portal username, customer ID, account preferences, authentication and security records | Created when you register or use the Portal |
| Billing and transaction | Billing address, invoices, payment status, product history and limited payment metadata | From you and our payment providers; we do not normally store full card details |
| Service and technical | Domain names, IP addresses, server and access logs, DNS records, service configuration, resource usage and security events | Generated when you use our services |
| Support and communications | Tickets, emails, chat messages, call notes and troubleshooting information | From your communications with us |
| Website usage | Pages visited, device and browser details, referring source and cookie identifiers | From cookies, logs and analytics tools |
| Compliance and abuse | Fraud indicators, identity checks, complaints, copyright or abuse notices and enforcement records | From you, service providers, registries, authorities or third parties |
Please avoid sending special-category information or highly sensitive personal information through support tickets unless it is genuinely necessary.
3. How we use personal information
- to create and manage your account;
- to process orders, payments, renewals, cancellations and refunds;
- to register, renew, transfer and administer domain names;
- to provision, operate, secure and support hosting, email and related services;
- to detect fraud, abuse, malware, spam and unauthorised access;
- to communicate service notices, invoices, security alerts and support responses;
- to comply with tax, accounting, regulatory and legal obligations;
- to improve our website, products, support and customer experience;
- to send marketing where permitted, with an unsubscribe option in every marketing email; and
- to establish, exercise or defend legal claims.
4. Our lawful bases
Depending on the activity, we rely on one or more of the following lawful bases:
- Contract: where information is necessary to provide services you ordered or to take steps before entering a contract.
- Legal obligation: where we must keep records, respond to lawful requests or meet tax, company, consumer or regulatory duties.
- Legitimate interests: where necessary to run, protect and improve WebFlag, prevent fraud, secure our systems, recover debts and communicate with business customers, provided those interests are not overridden by your rights.
- Consent: where required, including for certain cookies or marketing. You may withdraw consent at any time.
5. Who we share information with
We share information only where necessary and subject to appropriate safeguards. Recipients may include:
- our hosting, infrastructure, security, backup and monitoring providers;
- WHMCS and other billing, customer-management and support technology providers;
- payment processors, banks, accountants and fraud-prevention providers;
- domain registries, registrars and registration service providers;
- email delivery, analytics, communications and customer-support providers;
- professional advisers, insurers, auditors and debt-recovery providers;
- law-enforcement, courts, regulators or public authorities where legally required; and
- a purchaser or successor if WebFlag is reorganised, sold or transferred.
We do not sell personal information.
6. Domain-name registrations
When you register or transfer a domain, we must provide required registrant and contact information to the relevant registry or registrar. Their own terms and privacy notices will also apply. For .uk domains, registration information may be validated and processed by Nominet. Some registration data may be disclosed where a registry is legally required to do so or where a person demonstrates a legitimate reason under the registry's rules.
7. International transfers
Some suppliers, registries or technical systems may process personal information outside the United Kingdom. Where this happens, we use an appropriate legal safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.
8. How long we keep information
We keep personal information only as long as reasonably required for the purpose collected, including legal, tax, accounting, fraud-prevention and dispute-resolution requirements.
| Record | Typical retention |
|---|---|
| Customer, invoice and transaction records | Normally 6 years after the relevant financial year or end of the relationship |
| Support tickets and service communications | Normally up to 3 years after closure, unless needed longer for a dispute or security reason |
| Security and access logs | Usually between 30 days and 12 months, depending on the system and risk |
| Marketing preferences | Until you opt out, plus a suppression record so we respect your choice |
| Backups | Deleted or overwritten according to the relevant backup cycle |
These periods may vary where law, a registry rule, an active dispute or a security investigation requires longer retention.
9. Your rights
Depending on the circumstances, you may have the right to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information;
- ask us to restrict how information is used;
- object to processing based on legitimate interests or direct marketing;
- receive certain information in a portable format;
- withdraw consent where we rely on consent; and
- complain to the Information Commissioner's Office.
To exercise a right, email privacy@webflag.uk. We may need to verify your identity. Rights are not absolute, and lawful exemptions may apply.
You can complain to the ICO through its website or by telephone on 0303 123 1113. We would appreciate the chance to resolve your concern first. You can use our complaints process for a data-protection complaint.
10. Security
We use administrative, technical and physical safeguards designed to protect personal information, including access controls, encryption where appropriate, monitoring, backups and staff or supplier confidentiality measures. No internet service can be guaranteed completely secure, so you are also responsible for using strong unique passwords, enabling multi-factor authentication where available and protecting your devices and login details.
11. Cookies and similar technologies
We use essential cookies to operate the website and Portal. With consent where required, we may also use analytics or preference cookies. More detail is provided in our Cookie Policy, including how to change your choices.
12. Children's information
Our services are intended for businesses and adults aged 18 or over. We do not knowingly offer accounts directly to children.
13. Changes to this policy
We may update this policy to reflect changes to our services, suppliers or legal obligations. The latest version will be published here with an updated date. We will provide additional notice where a change materially affects how we use personal information.
14. Contact us
For privacy questions or requests, contact:
WebFlag Privacy Team
Email: privacy@webflag.uk
Post: Registered office details will be published before live orders open.