Privacy policy.

Who we are

Netchameleon is a sole trader located in the north east of England, at Saxondale, High Escomb, Escomb, Bishop Auckland, Co Durham, DL14 7ST.

For the personal data described in this policy, we are the controller. This means we decide how and why it is used. For personal data stored inside your hosting account or website (such as your own customers' details), you are the controller and we are your processor. That is covered by our Data Processing Agreement rather than this policy.

If you have any questions about this policy or your data, contact us through our contact page, by email at sales@netchameleon.co.uk, or by post at the address above.

What we collect

• Account and contact details: your name, email address, phone number, billing address and, if you buy as a business, your business name.
• Order and billing details: what you have bought, your subscriptions, invoices and payment history. Card payments are handled by Square. We see only limited details, such as the card type, the last four digits and the expiry date, never your full card number.
• Domain registration details: the registrant name, address, email and phone number that domain registries require.
• Enquiries and correspondence: what you tell us when you fill in a quote form, contact form or complaint form, or when you email us.
• Project material: logos, images, text and other files you send us for Creative Services.
• Marketing preferences: whether you have signed up to our newsletter, and whether you open or click on our emails.
• Technical data: your IP address, browser and device type, and the pages you visit, recorded in our server logs and through the cookies described in our Cookie Policy. This includes which website or campaign brought you to us when you place an order.

How we use it

Data protection law requires us to have a lawful basis for each way we use your data. Here is what we do and why.

We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you. Our payment provider, Square, runs automated fraud checks on card payments.

Marketing

We only send marketing emails if you have opted in. Every marketing email has an unsubscribe link, or you can ask us to stop at any time. Our newsletter system records whether emails are delivered, opened and clicked so we can improve them and stop sending to addresses that bounce.

Unsubscribing from marketing does not stop service emails about your account, orders and renewals, which we need to send you.

Who we share it with

We never sell your personal data. We share it only with organisations that help us provide our services, and only as much as they need:

We may also share data where the law requires it, for example with HMRC, the police or a court, or to protect our rights or other people's safety. If our business is sold or reorganised, your data may be transferred to the new owner, who must use it in line with this policy.

International transfers

Most of your data is stored in the UK. Some of our suppliers, such as Square and Google, may process data outside the UK, including in the United States. Where they do, we rely on safeguards recognised under UK law, such as UK adequacy regulations or the International Data Transfer Agreement. For some domain endings (such as .com), registration details must be sent to registries and registrars outside the UK to register the domain.

How long we keep it

• Orders, invoices and payment records: 6 years after the end of the financial year they relate to, as UK tax law requires.
• Your account: for as long as you have it, then up to 6 years after your last order, so we can deal with any questions or claims.
• Hosting data (your website files, databases and email): deleted when your hosting plan ends, apart from copies in backups, which expire on their normal schedule.
• Quote requests and enquiries that do not lead to an order: up to 2 years.
• Newsletter subscriptions: until you unsubscribe. We then keep your email address on a suppression list so we do not email you again by mistake.
• Server logs: kept for a limited period for security, then deleted.

Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete (you can also update most details yourself in My account);
• ask us to delete your data, where we no longer need to keep it;
• ask us to restrict how we use your data, or object to us using it based on legitimate interests;
• object to direct marketing at any time;
• ask for data you gave us to be sent to you or another organisation in a machine-readable format; and
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, contact us. We will respond within one month. There is normally no charge.

Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, restricted access for our team, and payment handling by Square so card numbers never reach our systems. If a data breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

Cookies

Our website uses a small number of cookies and similar technologies. Our Cookie Policy explains what they are and how to control them.

Children

Our services are not intended for children, and you must be 18 or over to place an order. We do not knowingly collect data from children.

Complaints

If you are unhappy with how we have used your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed. If we make significant changes, we will let you know by email or on our website.