Privacy Policy

This Privacy Policy explains how ANOMONIX LTD, trading as ANOMONIX:Stack ("ANOMONIX:Stack", "we", "us", or "our"), collects, uses, stores, shares, and otherwise processes personal data in connection with our websites, hosting services, domains, email services, infrastructure, customer support, billing, and related business operations.

This Privacy Policy applies to personal data we collect through our website, customer account systems, communications, support channels, ordering processes, and service delivery.

By using our website or services, you acknowledge that your personal data will be handled in accordance with this Privacy Policy.

1. Who We Are

ANOMONIX:Stack is operated by ANOMONIX LTD, a company registered in England and Wales under Company No. 17171765.

For the purposes of UK data protection law, ANOMONIX LTD may act as either a data controller or a data processor, depending on the type of data and the reason it is being processed. Controllers determine the purposes and means of processing, while processors handle personal data on behalf of a controller.

2. When We Act as Controller

We act as a controller where we decide how and why personal data is used for our own business purposes, including:

• operating our website
• managing customer accounts
• processing orders, invoices, renewals, and payments
• handling support requests and service communications
• monitoring platform security, abuse, and fraud
• complying with legal, regulatory, tax, and accounting obligations
• improving our services and internal operations
• managing direct marketing where permitted by law.

3. When We Act as Processor

Where you use our hosting, infrastructure, email, or related services to store or process personal data belonging to your own users, customers, staff, or contacts, we may act as a processor on your behalf, while you remain the controller for that hosted data. The ICO's guidance makes clear that processors act on behalf of controllers and under their authority.

This Privacy Policy mainly explains how we process personal data for our own purposes as controller. Processing we carry out on behalf of customers is usually governed by our service terms and, where appropriate, a separate Data Processing Addendum.

4. Personal Data We May Collect

We may collect and process personal data such as:

• name, business name, and contact details
• billing address and account identifiers
• email address and telephone number
• payment-related information, transaction references, and billing records
• account history, support correspondence, and ticket content
• domain registration details and related contact information
• service configuration records, product selections, and order history
• IP addresses, login records, device/browser information, and server logs
• abuse, security, fraud, and incident-related data
• communications preferences and consent records where relevant
• limited browser-side preference data, such as notice acknowledgement or theme choice, where used on the site. The current page already indicates the site stores limited browser data for theme choice and acknowledgement of the site notice.

We may also receive personal data from payment processors, registrars, fraud-prevention tools, support systems, resellers, or other service providers involved in delivering or securing our services.

5. How We Collect Personal Data

We may collect personal data:

• directly from you when you register, order, contact us, submit a form, open a ticket, or otherwise interact with us
• automatically through logs, authentication systems, cookies, and similar technologies used in connection with the website or services
• from third parties involved in payment processing, domain registration, support, verification, or abuse handling
• from other users acting on your behalf, such as team members or agents
• from publicly available or third-party sources where necessary for fraud prevention, compliance, or service administration.

6. Lawful Bases for Processing

Under the UK GDPR, personal data must be processed lawfully, fairly, and transparently, and a valid lawful basis is required for processing.

Depending on the context, we may rely on one or more of the following lawful bases:

• performance of a contract, where processing is necessary to provide services you have ordered or requested
• legal obligation, where processing is required for tax, accounting, fraud prevention, law enforcement response, or other legal duties
• legitimate interests, where processing is necessary for the operation, security, improvement, or administration of our business and services, provided those interests are not overridden by your rights
• consent, where consent is required or appropriate, such as for certain marketing or optional cookie-based activities.

7. How We Use Personal Data

We may use personal data to:

• create and manage customer accounts
• deliver hosting, domains, email, and related services
• process payments, renewals, invoices, refunds, and billing administration
• communicate about orders, incidents, maintenance, changes, and account matters
• respond to support requests and customer enquiries
• maintain service performance, reliability, and operational integrity
• detect, investigate, prevent, and respond to fraud, abuse, spam, malware, and security incidents
• comply with legal obligations and valid requests from public authorities
• defend legal claims and enforce our terms and policies
• improve our services, systems, and customer experience
• send marketing communications where permitted and in line with your preferences.

8. Direct Marketing

Where legally permitted, we may send you information about our services, updates, offers, or announcements. Electronic marketing must also comply with PECR rules, and the ICO notes that consent or the "soft opt-in" may be relevant depending on the situation.

You can opt out of marketing communications at any time using the unsubscribe option provided or by contacting us.

Service and account communications that are necessary for the provision, security, renewal, or administration of your services are not treated as optional marketing.

9. Sharing Personal Data

We do not sell personal data.

We may share personal data where necessary with:

• payment processors and billing providers
• domain registrars, registry operators, and certificate authorities
• infrastructure, hosting, data centre, backup, and network providers
• software, support, monitoring, and security vendors
• fraud-prevention, compliance, and abuse-management providers
• professional advisers such as lawyers, accountants, auditors, and insurers
• courts, regulators, law enforcement, or public authorities where required by law or where disclosure is reasonably necessary to protect rights, safety, or platform integrity.

The ICO distinguishes between sharing data with another controller and processing on behalf of a controller, so the legal role can differ depending on the relationship and purpose.

10. International Transfers

Some of our suppliers or service providers may be located outside the United Kingdom, or may make personal data accessible from outside the UK. The ICO's transfer guidance explains that UK GDPR transfer rules apply when personal information is sent, or made accessible, to a separate organisation outside the UK in circumstances covered by the legislation.

Where we transfer personal data internationally, we will take appropriate steps to ensure the data is protected in accordance with applicable law, including the use of appropriate safeguards where required.

11. Data Retention

Individuals have the right to be informed about retention periods, and privacy information should explain how long data is kept.

We retain personal data only for as long as necessary for the purposes for which it was collected, including for service delivery, security, compliance, dispute resolution, enforcement, and statutory record-keeping.

Retention periods may vary depending on the type of data. For example, we may retain:

• account and billing records for financial, tax, and audit requirements
• support and correspondence records for service continuity and dispute handling
• technical logs for security, diagnostics, and abuse prevention
• backup and disaster recovery data for operational resilience, subject to rotation and retention cycles
• limited preference or notice-acknowledgement data for website functionality.

Where personal data is no longer required, we will delete it, anonymise it, or otherwise securely dispose of it, unless continued retention is required by law.

12. Security

The ICO states that the UK GDPR requires organisations to process personal data securely using appropriate technical and organisational measures.

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures may include:

• encryption in transit where appropriate
• access controls and authentication measures
• secure credential handling
• logging, monitoring, and alerting
• segmentation, patching, and security hardening
• internal access restriction on a need-to-know basis
• resilience, backup, and recovery measures
• review and response procedures for incidents and abuse.

No internet-based service can be guaranteed completely secure, and you are also responsible for securing your own devices, credentials, applications, and hosted environments.

13. Personal Data Breaches

The ICO states that certain personal data breaches must be reported to the supervisory authority within 72 hours of becoming aware of the breach, where feasible, and that affected individuals must also be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

If we become aware of a personal data breach affecting personal data for which we act as controller, we will assess it promptly and take action in line with applicable law.

Where we act as processor for customer data, we will notify the relevant customer as controller without undue delay after becoming aware of a breach affecting that customer data, subject to our contractual terms and the circumstances of the incident.

14. Cookies and Similar Technologies

The ICO's PECR guidance says cookies and similar technologies are regulated, and consent is required for some uses unless an exemption applies.

We may use cookies, local storage, and similar technologies to:

• operate and secure the website
• remember site preferences
• maintain session continuity
• record notice acknowledgement or similar functional preferences
• support future analytics or measurement tools if introduced.

At present, your current page states that the site does not currently use Google Analytics, ad tracking, or third-party marketing pixels, and instead stores limited browser-side data for theme choice and notice acknowledgement. If that changes, the policy and any consent controls should be updated before rollout.

15. Your Rights

The ICO's guide to individual rights explains that people may have rights including the right to be informed, access, rectification, erasure, restriction, portability, and objection, subject to exemptions and conditions.

Subject to applicable law, you may have the right to:

• be informed about how your personal data is used
• request access to the personal data we hold about you
• request correction of inaccurate or incomplete personal data
• request erasure of personal data in certain circumstances
• request restriction of processing in certain circumstances
• object to certain processing
• request portability of certain personal data where applicable
• withdraw consent where processing is based on consent.

These rights are not absolute and may be limited by legal, regulatory, security, or contractual obligations.

16. Third-Party Checkout and Payment Data

Where a third-party merchant of record, reseller, or payment provider is used at checkout, including Paddle where applicable, that provider may collect and process buyer, payment, tax, invoice, fraud-prevention, and transaction data. The provider may share relevant transaction and account data with ANOMONIX so ANOMONIX can activate, administer, secure, support, and manage the service.

17. Complaints

If you have concerns about how we handle personal data, please contact us first so we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO), which is the UK supervisory authority for data protection matters.

18. Contact

For privacy enquiries, data requests, or data protection concerns, please contact:

• Privacy Team
• ANOMONIX LTD
• Trading as ANOMONIX:Stack
• privacy@anomonixstack.com

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, services, technology, or business operations.

The latest version published on our website will apply from its stated effective date.

20. Company Information

• ANOMONIX LTD
• Trading as ANOMONIX:Stack
• Registered in England and Wales
• Company No. 17171765
• Registered Office: 128 City Road, London, EC1V 2NX

Plain HTML version of this policy