Legal

Privacy Policy

Last updated: 25 June 2026

This policy explains what personal data Gander Web Ltd collects, why we collect it, how we use and protect it, and the rights you have over it. We are committed to handling your data responsibly and in line with UK data protection law.

1. Who we are

Gander Web Ltd ("Gander Web", "we", "us") provides UK web hosting, VPS hosting, server colocation and Microsoft 365 services, and operates the website ganderweb.co.uk. For the personal data described in this policy, Gander Web Ltd is the data controller.

Where you host a website or server with us, you may be the data controller for the personal data you store on our infrastructure, and Gander Web acts as a data processor on your behalf for that content.

2. The information we collect

We only collect data we need to provide and support our services:

• Account & billing details: your name, email address, phone number, billing address and company name. Card payments are processed securely by our payment providers; we do not store full card numbers.
• Support communications: the content of support tickets, emails and chats you send us, so we can help you and keep a record.
• Service data: the domains, hosting accounts, servers and services you order, and configuration details needed to run them.
• Content you store, files, databases, emails and other data you place on your hosting or servers. We process this on your behalf and do not access it except where needed to deliver support, maintain the service, or comply with the law.
• Technical & log data. IP addresses, browser and device information, and server/access logs, collected automatically and used for security, troubleshooting and abuse prevention.
• Website usage, anonymised analytics about how visitors use our website (see Cookies below).

3. How we use your data, and our legal bases

Under UK GDPR we rely on the following lawful bases:

• To provide your services, setting up, running and supporting your hosting, servers and licences. Legal basis: performance of a contract.
• Billing and accounts, invoicing, taking payment and keeping financial records. Legal basis: contract and legal obligation.
• Security & abuse prevention, protecting our network, detecting fraud and dealing with abuse reports. Legal basis: legitimate interests.
• Service messages, sending essential notices such as renewals, maintenance and security alerts. Legal basis: contract / legitimate interests.
• Marketing, only where you have asked to hear from us; you can opt out at any time. Legal basis: consent.
• Legal compliance, meeting our legal and regulatory obligations. Legal basis: legal obligation.

We do not sell your personal data.

4. Cookies and analytics

Our website uses a small number of cookies and similar technologies:

• Essential cookies, needed for the site and your account to work.
• Analytics. Google Analytics (via Google Tag Manager) helps us understand how the site is used, in aggregate, so we can improve it.
• Third-party widgets. Trustpilot (reviews) and Instatus (our service status page) may set their own cookies, and Cloudflare provides security and performance for the site.

You can control or block cookies through your browser settings. Blocking some cookies may affect how the site works.

5. Who we share your data with

We share data only with trusted providers who help us deliver our services, and only as far as needed. These include:

• Payment providers, to process payments securely.
• Microsoft, where you buy Microsoft 365 licences or email through us.
• Our UK data centre and infrastructure partners, who house and connect the servers your services run on.
• Cloudflare, for content delivery, DDoS protection and DNS.
• Domain registries and registrars, where you register or transfer a domain.
• Authorities or advisers, where we are required to by law, or to protect our rights.

These providers act under contract and may only use your data to provide their service to us.

6. International transfers

We keep your data in the UK wherever possible. Some of our providers (such as Microsoft, Google and Cloudflare) may process data outside the UK. Where they do, the transfer is protected by appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

7. How long we keep your data

We keep account and service data for as long as you are a customer, and afterwards only as long as needed. Financial and billing records are retained for at least six years to meet UK tax and accounting rules. Support tickets and server logs are kept for a shorter period appropriate to their purpose, then deleted.

8. How we protect your data

We use technical and organisational measures to keep your data safe, including encryption in transit (HTTPS/TLS), access controls, network firewalls and DDoS mitigation, and UK-based data centres with physical security. No system is perfectly secure, but we work to protect your data and to respond quickly to any incident.

9. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where appropriate;
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on it.

To exercise any of these rights, email [email protected]. We will respond within one month.

10. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed. Significant changes will be highlighted on this page.