Privacy Policy

PAC WEBHOSTING LTD · Registered in England and Wales, company number 06221654 · Last updated: 5 October 2026

1. Who we are

PAC WEBHOSTING LTD (“PAC”, “we”, “us”) is the data controller for the personal information described in this policy.

We haven’t appointed a Data Protection Officer because the law doesn’t require one for a business of our type. Please send privacy questions to the contact above.

Which websites this policy covers

• pacwebhosting.uk (our main website)
• billing.pacwebhosting.uk (client area, ordering and billing)
• help.pacwebhosting.uk (knowledge base and support)

It also covers information you give us by email, phone, post or support ticket.

When we are a processor, not a controller

This policy covers information about our customers and website visitors. When you use our hosting, email or other services, you may store personal information about other people, such as your website’s visitors, your customers or your email contacts. For that information, you are the controller and we are your processor. We handle it only on your instructions, under our Data Processing Agreement and Sub-processor List.

Microsoft 365 is supplied under Microsoft’s own customer agreement. Microsoft processes your Microsoft 365 data under its own terms, and we act as your reseller and administrator.

2. Summary

3. What we collect, why, and our lawful basis

Under UK GDPR we must have a lawful basis for each use of your information. The table sets them out.

Where we get information from. Mostly from you. We also get information from:

• payment providers (payment status)
• MaxMind (fraud risk scores)
• domain registries (registration status)
• public sources such as Companies House and WHOIS (to check business details)
• a reseller or agency that orders services on your behalf

AI help assistant. The assistant on help.pacwebhosting.uk is an AI tool provided by HelpJet. It answers from our published help articles. It doesn’t make decisions about you or your account, and its answers can sometimes be wrong, so for anything important please raise a support ticket. Please don’t enter passwords or other personal details into it.

Special category data. We don’t ask for sensitive information such as health or religious beliefs, so please don’t send it in tickets. If you do, we’ll use it only to deal with your request, or delete it.

4. Marketing

If you’re a customer, we may email you about our own hosting products and offers that are similar to what you’ve bought. This is allowed without consent under the PECR “soft opt-in”, as long as we give you a clear way to refuse.

• When you order: the checkout has a marketing box. Untick it if you don’t want these emails.
• At any time: click “unsubscribe” in any marketing email, change your preferences in the client area, or email [email protected].
• Not a customer? We don’t send marketing emails to people who aren’t customers, and there’s no newsletter sign-up on our website.

We never sell your details or send you third-party offers. If you opt out, we keep your email on a suppression list so we don’t contact you again. Service messages still go out whatever your marketing choice, for example renewal notices, invoices, maintenance and security alerts.

5. Who we share information with

We share personal information only when we need to, and only with organisations bound by confidentiality and data protection terms.

Other disclosures. We may also share information:

• with the police, courts, regulators or other authorities when the law requires it, or to prevent or detect crime or fraud
• with debt collection agencies or legal advisers to recover unpaid amounts or deal with disputes
• with a buyer or investor if we sell or reorganise all or part of our business. They must use your information in line with this policy
• with our business continuity partner, an established UK hosting company we already work with, if PAC is ever unable to continue trading. They would take over your services so they carry on without interruption, and use your information in line with this policy

Customer data held in your hosting services is processed by our sub-processors under our Data Processing Agreement. The current list is on our Sub-processor List.

6. International transfers

Our servers and your hosting data are in the UK, with backups in the UK and the EEA. If you order a VPS, you can choose where it’s located: London (UK), Amsterdam (Netherlands), New York or Phoenix (USA). Your VPS and its data are then stored in that location, at your request. Amsterdam is covered by UK adequacy regulations. For the USA locations, we rely on contractual safeguards with our infrastructure provider. Our DNS servers, which answer lookups for the domains we host, are spread across the UK, Amsterdam and the USA so your domains keep resolving if one location has a problem. They hold DNS records, such as the domain name and the server addresses it points to, which are publicly visible by design. The same safeguards apply. Conversations with the AI help assistant on our help site are stored in the USA, and your questions are sent to OpenAI (directly or through Microsoft Azure) to generate an answer. HelpJet protects these transfers with the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum. Some of our suppliers process information outside the UK (see section 5). When they do, we make sure one of these safeguards applies:

• The destination has UK “adequacy” regulations. This includes the EEA, and US organisations certified under the UK Extension to the EU-US Data Privacy Framework.
• A written agreement is in place. This is either the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.

If you’d like more detail on the safeguards for a particular supplier, contact [email protected].

Domain registration data goes to the registry that runs your chosen extension, which may be outside the UK (for example, .com is run in the USA). This transfer is necessary to register the domain you asked for.

7. Automated fraud checks

When you place an order, we send some order details to MaxMind for a fraud risk score. These include your IP address, email address, billing address and order details. MaxMind’s checks include comparing where your IP address is located with your billing address.

If an order scores as high risk, it’s held for a member of our team to review. We don’t cancel an order on the automated score alone. We may contact you to verify your identity or payment.

If you think an order was wrongly held or refused, contact us. A person will review the decision and you can give us any information you’d like us to consider.

8. How long we keep information

We may keep information for longer if we need it for a legal claim or a regulator asks us to. When a retention period ends, we delete the information or anonymise it securely.

9. How we protect your information

PAC is certified under Cyber Essentials, the UK government-backed scheme for protecting organisations against common cyber attacks. Our other measures include:

• servers in secure UK data centres, protected by hardware firewalls and hardware DDoS protection in front of our infrastructure, plus server firewalls, malware scanning and regular patching
• our network and infrastructure registered with the National Cyber Security Centre’s Early Warning service, so we’re alerted to threats and vulnerabilities affecting our systems
• TLS encryption on all our websites, forms, the client area and payment pages
• payments handled by PCI DSS-compliant providers, so we never store full card details
• staff access limited to what each role needs, with multi-factor authentication on admin systems
• two-factor authentication available on your client account and your hosting control panel (Enhance) login
• identity checks before we discuss or change an account
• regular off-server backups

No system is completely secure. If we have a personal data breach that’s likely to put you at risk, we’ll tell you and the ICO as the law requires. You can help by using a strong, unique password and turning on two-factor authentication.

10. Your rights

Under UK data protection law you have the right to:

• access a copy of your information
• correct information that’s wrong or incomplete
• delete your information, where we no longer have a reason to keep it
• restrict how we use it while a concern is looked into
• portability: receive information you gave us in a machine-readable format (such as CSV), or have it sent to another provider
• object to our use of it based on legitimate interests, and to direct marketing at any time
• withdraw consent where we rely on it. This doesn’t affect anything we did before you withdrew
• ask for a person to review an automated decision (section 7)

How to make a request. Email [email protected], or write to the Data Protection Contact, PAC WEBHOSTING LTD, Suite 2 Albion House, 2 Etruria Office Village, Forge Lane, Etruria, Stoke-on-Trent, ST1 5RQ.

We’ll reply within one month. For complex requests we may extend this by up to two more months, and we’ll tell you if we do. It’s free unless a request is clearly unfounded or excessive. We may need to confirm your identity first. Usually we do this by asking you to contact us from your registered email or client account.

Complaints

If you’re unhappy with how we’ve handled your information, please tell us first at [email protected]. We’ll acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO) at any time:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

11. Children

Our services are for businesses and adults. We don’t knowingly collect information from anyone under 18. If you think a child has given us their details, contact us and we’ll delete them.

12. Cookies

We use essential cookies to run our websites and client area. We only use analytics cookies if you accept them. Our Cookie Policy lists every cookie, and you can change your choice at any time using the “Cookie settings” link in our website footer.

13. Changes to this policy

We’ll update this policy when our practices or the law change, and show the date of the latest version below. If a change significantly affects you, we’ll tell you by email or through the client area before it takes effect.

Last updated: 5 October 2026