1. Who we are
Strange Duck Ltd trading as Strange Duck Hosting is the controller responsible for personal information used to operate customer accounts, sell services, provide support and manage the business.
Contact details:
- Address: Suite A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE
- Privacy email: support@strangeduck.co.uk
- Billing email: accounts@strangeduck.co.uk
- Telephone: 01379 430418
This notice concerns account holders, authorised users, prospective customers, website visitors, support contacts and people who communicate with us.
2. Information we collect
Depending on how you interact with us, we may collect:
- name, organisation, postal address, email address and telephone number;
- account usernames, authentication records and security preferences;
- orders, services, invoices, transactions and payment-provider references;
- support tickets, messages, call notes and complaints;
- domains, DNS details, server account identifiers and service configuration;
- IP addresses, device/browser information, login records and security logs;
- fraud-prevention and abuse information;
- consent and policy-acceptance records; and
- information you choose to provide in enquiries or tickets.
We do not intend to store complete payment-card numbers. Card information is collected and processed by the payment provider through its secure payment interface.
Customer website files, databases and email may contain personal data controlled by the customer. For that hosted data, we normally act as a processor rather than deciding its purposes.
3. Why we use information and our lawful bases
We use personal information:
| Purpose | Typical lawful basis |
|---|---|
| Create and administer accounts; supply hosting; bill and support customers | Contract |
| Process payments and maintain transaction records | Contract and legal obligation |
| Keep tax, accounting and business records | Legal obligation |
| Prevent fraud, spam, abuse and security incidents | Legitimate interests and, where applicable, legal obligation |
| Protect systems, investigate incidents and enforce policies | Legitimate interests |
| Respond to enquiries and complaints | Contract steps or legitimate interests |
| Send essential service, security and billing messages | Contract and legitimate interests |
| Send optional marketing | Consent or another lawful basis permitted by direct-marketing law |
| Comply with courts, regulators and law enforcement | Legal obligation or legitimate interests |
Our legitimate interests include operating a secure and sustainable hosting business, preventing misuse, recovering money owed, supporting customers and improving reliability. We balance those interests against people’s rights.
4. Who receives information
We may share relevant information with service providers that help us supply and secure the service, including:
- Krystal Hosting Ltd for UK hosting infrastructure, cPanel accounts, offsite backups and platform support;
- PayPal and any other payment provider shown at checkout;
- WHMCS and associated support/licensing services for billing and client-management software;
- domain registrars and registries where you order, transfer or manage a domain through us;
- cPanel/WebPros, CloudLinux and Imunify360 providers where their software or security services process technical data;
- email, DNS, monitoring, professional-advice and fraud-prevention providers used by us; and
- courts, regulators, law-enforcement bodies, rights holders or other parties where disclosure is required or reasonably necessary to establish, exercise or defend legal rights.
We do not sell personal information.
Some providers act as independent controllers for their own legal, fraud-prevention or payment obligations. Their own privacy notices also apply.
5. International transfers
Our primary hosting service is supplied from UK infrastructure. Some software, payment, security or support providers may process information outside the UK.
Where UK data-protection law requires safeguards for an international transfer, we will rely on an adequacy regulation, approved contractual safeguards or another lawful transfer mechanism. You may contact us for more information about relevant safeguards.
6. Retention
We retain information only for as long as reasonably necessary for the relevant purpose, including legal, accounting, security and dispute requirements. Our intended baseline schedule is:
- account, order, invoice and transaction records: up to seven years after the relevant financial year or relationship ends;
- support tickets and routine account correspondence: normally up to three years after closure, longer where required for a dispute or security matter;
- unsuccessful or abandoned order records: normally up to 12 months unless needed for fraud prevention;
- security, access and technical logs: normally up to 12 months, though individual infrastructure logs may have shorter or longer operational cycles;
- marketing consent or objection records: while relevant and afterwards as needed to honour the preference; and
- hosted customer content: for the active service and then deleted from live systems at or after termination, with residual copies expiring through backup rotation.
We may retain less information or keep it for longer where law, litigation, fraud prevention, safeguarding or a regulator requires it. The customer remains responsible for removing hosted personal data it no longer needs.
7. Security
We use proportionate technical and organisational measures including encrypted connections, access controls, strong authentication, security monitoring, malware scanning, software patching and backups.
No internet service can guarantee absolute security. Customers must secure their own applications, credentials, users and content and notify us promptly of suspected incidents.
8. Your rights
Depending on the circumstances, UK data-protection law may give you rights to:
- access your personal information;
- correct inaccurate information;
- request deletion;
- restrict or object to processing;
- receive certain information in a portable format;
- withdraw consent where processing relies on consent; and
- complain to the Information Commissioner’s Office.
Rights are not absolute and exemptions may apply. To exercise a right, email support@strangeduck.co.uk. We may need to verify your identity.
You can contact the Information Commissioner’s Office through https://ico.org.uk/ or by calling 0303 123 1113.
9. Essential service communications and marketing
We will send messages necessary to operate your account, including invoices, renewal notices, password/security messages, incident notices and support responses. These are not optional marketing communications.
We will not add you to general marketing merely because you bought hosting. Where consent is required, marketing consent will use a separate unticked choice. You can unsubscribe from marketing without affecting service messages.
10. Cookies
The website and client area use strictly necessary cookies and similar storage for functions such as:
- session and login management;
- shopping-cart contents;
- security and anti-forgery protection;
- language, currency and display preferences; and
- payment and fraud-prevention functions.
Strictly necessary cookies do not require optional consent, but this notice explains their use.
If we introduce analytics, advertising or other non-essential cookies, we will update this notice and obtain consent before setting them where required. Non-essential cookies must not be activated merely because a visitor ignores or closes a banner.
11. Children
The service is not directed at children and customer accounts are limited to people aged 18 or over. Contact us if you believe a child has provided account information without appropriate authority.
12. Changes to this notice
We may update this notice when our services, providers or legal duties change. We will publish the current version and notify affected customers of material changes where appropriate.