01 About this policy
VirexNode Ltd takes the privacy of your information seriously. This policy explains how we collect and use personal data when you visit our website, enquire about our services, open an account, or use our web hosting.
It also explains, in section 11, the different relationship that applies to personal data you store on our servers as part of your own website — where you are the controller and we act on your instructions.
VirexNode is a UK company and this policy is written around the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). We host customers internationally as well as in the UK, and we apply the same standards set out here to every customer regardless of where you are based. If you are located outside the UK, local law may give you additional or different rights, which this policy does not remove.
02 Who we are
For the personal data described in this policy, the data controller is:
- VirexNode Ltd
- Registered in England and Wales, company number 16431001
- Registered office
- 128 City Road, London, EC1V 2NX, United Kingdom
- [email protected]
- Telephone
- 0330 229 6555
- Privacy & data protection enquiries
- [email protected]
We are not required to appoint a statutory Data Protection Officer. Privacy-related questions, and requests to exercise your rights under this policy, are handled directly by our team at [email protected].
03 Information we collect
Information you give us
- Account details — your name, business name, email address, telephone number and postal address.
- Billing details — billing address, VAT number where applicable, and a record of your invoices, payments and refunds.
- Payment details — we accept card payments through Stripe and payments through PayPal. Your card number, expiry date and security code are entered directly into Stripe's own hosted payment fields and go straight to Stripe; they never reach, and are never stored on, VirexNode's systems. If you choose to save a card so that renewals are paid automatically, the card itself is stored securely by Stripe and our client area keeps only a reference token together with the card brand, the last four digits, the expiry date and the name on the card, so that you can recognise it. Paying with PayPal instead creates a billing agreement held by PayPal, of which we store only the identifier and the email address on your PayPal account. Saving a payment method is optional, and you can view or remove one at any time in the client area — removing it deletes the token and card details we hold.
- Enquiry details — anything you tell us through our contact form or by email, such as your current hosting provider, domain name, traffic levels and the problems you are trying to solve. When you use the contact form, the details you enter (name, company, email address, phone number, website and message) are delivered to our team by email through Resend.
- Support correspondence — tickets, emails and call notes, including any technical details you share with us to help diagnose an issue.
- Account security details — your client area password, which is stored only as a salted hash and never in a readable form, and your two-factor authentication settings if you choose to turn it on.
Information we collect automatically
- Server and access logs — IP addresses, timestamps, requested URLs, response codes, user agent strings and referrers, generated when you or your visitors access our infrastructure or our network edge (Cloudflare).
- Security data — records of failed logins, firewall events, blocked requests and other signals used to detect abuse and protect the platform, including signals generated by Cloudflare's security and bot-management features.
- Account usage data — resource consumption such as CPU, memory, storage and bandwidth, used for billing, fair usage under section 7 of our Terms & Conditions, and capacity planning.
We do not currently run analytics tracking (such as Google Analytics) on our marketing website. If that changes, we will update this policy and this section.
Information from other sources
- Payment providers — Stripe and PayPal give us confirmation that a payment succeeded or failed, the reason a payment was declined, limited card metadata such as the card brand, last four digits and expiry date, and the outcome of their own fraud and risk checks. We never see or store your full card details.
- Public sources — publicly available company and domain registration information, used to verify business customers and prevent fraud.
- Abuse reports — information from third parties, blocklist operators or law enforcement about activity on our network.
04 How and why we use it, and our legal basis
We only use personal data where the law allows us to. The table below sets out, for each processing activity, what we use the data for and the legal basis (also called the lawful basis under UK GDPR) we rely on.
| What we use it for | Lawful basis |
|---|---|
| Creating and administering your account | Performance of a contract |
| Providing hosting and support | Performance of a contract |
| Taking payment and issuing invoices | Performance of a contract |
| Storing a card or billing agreement you have chosen to save | Consent — you can remove a saved payment method at any time |
| Taking automatic renewal payments from a saved payment method | Performance of a contract |
| Screening payments for fraud and chargeback risk | Legitimate interests — preventing payment fraud |
| Sending service notices, maintenance and renewal reminders | Performance of a contract |
| Responding to sales enquiries and preparing quotes | Legitimate interests — responding to a request you made |
| Monitoring resource usage and enforcing fair usage | Legitimate interests — keeping the platform stable for all customers |
| Detecting, preventing and investigating abuse, fraud and attacks | Legitimate interests — network and information security |
| Improving our services and infrastructure planning | Legitimate interests — running and developing our business |
| Keeping accounting and tax records | Legal obligation |
| Responding to lawful requests from authorities | Legal obligation |
| Marketing emails to existing customers about similar services | Legitimate interests — PECR "soft opt-in" |
| Marketing emails to non-customers | Consent |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, and concluded they are not. You may object to processing based on legitimate interests at any time — see section 10.
We do not carry out profiling for advertising purposes, and we do not use personal data for automated decision-making that produces legal or similarly significant effects. The one automated step in the process is the fraud screening Stripe and PayPal apply to every payment, which may decline a transaction they consider high risk. That decision is made by the payment provider rather than by us, and it does not affect your account: if a payment is declined you can pay another way or contact us, and a member of our team will look at it.
07 International customers & transfers
VirexNode is a UK company and customer websites and account data are hosted in the United Kingdom. Our off-site backups are also stored in the United Kingdom, in OVHcloud's UK region, and our Microsoft 365 mailboxes are stored in the UK. We serve customers around the world as well as in the UK, and we apply the standards in this policy to every customer, wherever you're based.
Some of the providers listed in section 6 — including Stripe, PayPal and Cloudflare — are based in, or process data in, countries outside the UK, principally the United States. Resend, which delivers our contact form enquiries, processes them on servers in Ireland, which is covered by the UK's adequacy regulations for the European Economic Area. Where personal data is transferred outside the UK, we make sure an appropriate safeguard is in place — either the destination is covered by UK adequacy regulations (such as the UK extension to the EU-US Data Privacy Framework), or the transfer is governed by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
You can ask us for details of the safeguards applying to any specific transfer.
08 How long we keep it
We keep personal data only for as long as we need it, then delete it or make it anonymous.
| Data | Retention period |
|---|---|
| Account and contact details | Duration of the account, then 12 months |
| Invoices and accounting records | 7 years, as required by HMRC |
| Saved payment methods (token, card brand, last four digits and expiry) | Until you remove the payment method or close your account |
| Hosting account content and databases | 14 days after cancellation, then permanently deleted |
| Backups | 7 days, on a rolling cycle — older backups are automatically rotated out and deleted |
| Server and access logs | Up to 12 months |
| Security and abuse records | Up to 24 months |
| Support tickets and correspondence | 3 years from closure |
| Sales enquiries that do not become accounts | 12 months |
09 How we protect it
We apply technical and organisational measures appropriate to the risk, including:
- encryption in transit using TLS, with free SSL certificates on all hosted sites;
- firewalls and network-level DDoS filtering;
- access controls, so staff can only reach the data they need to do their job;
- optional two-factor authentication on client area accounts, and passwords stored only as salted hashes;
- card payments handled end to end by PCI DSS Level 1 certified providers, so card numbers are never processed, transmitted or stored by our own systems;
- regular patching of operating systems and platform software;
- monitoring and alerting for unusual activity;
- encrypted off-site backups held with OVHcloud in the UK, kept for 7 days on a rolling cycle; and
- a locked rack restricting physical access to the servers your account runs on.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell affected individuals directly where the risk is high.
10 Your rights
Under UK data protection law you have the right to:
- Be informed
- Know how your data is used — which is what this policy is for.
- Access
- Request a copy of the personal data we hold about you.
- Rectification
- Have inaccurate or incomplete data corrected.
- Erasure
- Ask us to delete data where we no longer have a good reason to keep it. This does not override our legal duty to keep accounting records.
- Restriction
- Ask us to pause processing while a concern is investigated.
- Data portability
- Receive data you provided to us in a structured, commonly used, machine-readable format.
- Object
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent
- Withdraw consent where that is the basis we rely on, without affecting processing carried out beforehand.
To exercise any of these rights, email [email protected]. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if so. There is normally no charge, though we may charge a reasonable fee for manifestly unfounded or excessive requests.
We may ask you to verify your identity before acting, to make sure we do not disclose data to the wrong person.
11 Data on your website
This section is about personal data belonging to your visitors, customers or staff that you store on our servers — for example through a contact form, an online shop, or a membership area.
For that data, you are the data controller and VirexNode is a data processor acting on your behalf. You decide what is collected and why; we simply store and serve it as part of providing the hosting.
In that role we commit to:
- process the data only on your documented instructions, unless required otherwise by law;
- ensure our staff are bound by confidentiality;
- apply the security measures described in section 9;
- not engage another processor for that data without informing you;
- assist you, so far as reasonably possible, in responding to requests from individuals exercising their rights;
- notify you without undue delay if we become aware of a personal data breach affecting your data; and
- delete the data on termination, in line with the retention periods in section 8.
As controller, you are responsible for:
- having a lawful basis for the personal data you collect;
- publishing your own privacy notice to your visitors;
- responding to requests from the people whose data you hold;
- keeping your applications secure and up to date; and
- not storing special category data on shared hosting without ensuring it is appropriate to do so.
If you need a formal data processing agreement for your own compliance records, contact us and we will provide one.
12 Marketing
We may send existing customers occasional emails about services similar to those you already buy from us, as permitted under PECR. Every such email includes an unsubscribe link, and opting out takes effect immediately.
We will not send marketing to non-customers without consent, and we do not share contact details with third parties for their own marketing.
Opting out of marketing does not stop service messages such as invoices, renewal reminders, maintenance notices and security alerts, which we need to send you as part of providing the service.
13 Children
Our services are intended for people aged 18 and over, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
14 Changes to this policy
We review this policy regularly and may update it to reflect changes in the law, our services, or how we operate. The current version is always published here with the date it was last updated.
Where a change materially affects how we use your personal data, we will tell you by email before it takes effect.
15 Contact and complaints
For any question about this policy or about how we handle your data, contact us:
- Privacy & data protection enquiries
- [email protected]
- General enquiries
- [email protected]
- Telephone
- 0330 229 6555
- Post
- VirexNode Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
We would always prefer to resolve a concern with you directly. However, you also have the right to complain to the UK's data protection regulator. If you're based outside the UK, you may also be able to complain to your own local data protection authority.
- Information Commissioner's Office
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline
- 0303 123 1113
- Website
- ico.org.uk