Privacy Policy

Last Updated: 04.11.2026

This Privacy Policy explains how VirtuaHost (“we”, “us”, “our”) collects, uses, discloses, and protects your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

VirtuaHost is a trading name of VirtuaHost Ltd, a company registered in England and Wales (company number 17553293), whose registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. For the purposes of data protection law, VirtuaHost Ltd is the “data controller” of your personal information. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC288949.

2. Data We Collect

We may collect the following categories of personal data:

2.1 Information You Provide

• Full name
• Email address
• Billing address
• Account login credentials (your password is stored only in a securely hashed form) and, if you turn it on, your two-factor authentication settings
• SSH public keys you add to your account, and a profile photo if you upload one
• Support communications & submitted materials
• Abuse reports: if you send us an abuse report, we store the report and the details you give (your name and email are optional) and the IP address you sent it from, so that we can investigate and respond
• Job applications: if you apply for a role through our careers page, the details you give us, such as your name, email address, cover letter and CV
• Affiliate partners: if you promote VirtuaHost as a partner, your name, contact email, the discount code we give you, and records of the commission we owe and pay you

Your card details are entered on our payment provider's secure payment page and are never sent to or stored by us. We only receive confirmation that the payment was made.

2.2 Information Collected Automatically

• IP address
• Device and browser information
• Access timestamps
• Service usage logs, including actions taken in your client area (for example logins, payments and server power or reinstall actions)
• A session cookie (see our Cookie Policy)
• Your server's network traffic volumes (how much data it sends and receives, never what it contains), used for bandwidth billing, fair use and abuse detection

2.3 Third-Party Data

• Payment confirmations from payment processors
• Fraud-prevention signals
• Discord (only if you choose to connect your account): your Discord user ID and username, which we use to give you the Customer role in our Discord server while you have an active service. We do not receive your email address, your servers or your messages, and you can disconnect at any time in your account settings

2.4 The Contents of Your Server

We store whatever you or your users put on your server, but we do not look at it. As set out in our Terms of Service and Acceptable Use Policy, we only access a server's contents when you ask us to (for example when helping with console or rescue access) or when we need to investigate a suspected breach of the Acceptable Use Policy or the law. If your server holds other people's personal data, you are responsible for that data under data protection law, and if you are a business customer we handle it as your processor under our Data Processing Addendum.

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and manage your VirtuaHost account
• To provide and maintain hosting services
• To issue invoices and process payments
• To send you service emails, such as account confirmation, password resets, invoices, payment reminders and important notices about your service
• To respond to support requests and technical issues
• To maintain infrastructure security and detect abuse
• To consider job applications
• To comply with legal and regulatory obligations

We do not send marketing emails.

4. Legal Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contractual necessity – providing services you requested
• Legitimate interests – security, fraud prevention, service improvement
• Legal obligation – tax, accounting, compliance
• Consent – when you choose optional features, such as connecting your Discord account; you can withdraw consent at any time

5. Cookies & Tracking Technologies

We use a single, strictly necessary session cookie to keep you logged in and to protect our forms. We do not use analytics, advertising or tracking cookies. Details are in our Cookie Policy.

6. Data Sharing

We do not sell personal data. We share only what each service provider needs to do its job for us:

• Our payment processor, to take payments
• Our data centre and infrastructure providers, which host our servers, website and backups
• Our email providers, to send service emails and receive messages you send us
• Discord, only if you choose to connect your Discord account
• Our professional advisers (such as accountants) where needed
• The police, courts and regulators where the law requires it, and as described in section 6 of our Acceptable Use Policy

If you order using a partner's discount code, we do not tell the partner who you are. We only keep count of how many new customers used their code, so that we can pay them.

7. International Transfers

Some of our servers and service providers are located outside the UK, including in the European Economic Area and the United States. When data is transferred outside the UK, we rely on:

• UK adequacy regulations, which cover the European Economic Area and US companies certified under the UK Extension to the EU-US Data Privacy Framework
• Otherwise, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses

8. Data Retention

We keep personal data only as long as necessary to provide services, comply with legal obligations, and resolve disputes. Typical retention periods are:

• Billing and invoice records: 6 years from the end of the relevant tax year, as required by UK tax law
• Affiliate partner and commission records: 6 years from the end of the tax year in which the commission was paid, as required by UK tax law
• Account data: for as long as your account is active. When an account is closed, it is blocked straight away, but the details linked to its invoices (such as your name, email and address) are kept with the billing records for 6 years, as tax law requires, and then permanently anonymised
• Unconfirmed accounts: accounts whose email address is never confirmed, and that have no services or invoices, are deleted after 7 days
• Job applications: up to 12 months after the role is filled, unless you ask us to delete your application sooner
• Support tickets and communications: up to 24 months after the ticket is closed
• Server/access logs: up to 12 months, for security and abuse investigation purposes
• Abuse reports: 12 months after the report is closed
• Discord connection: until you disconnect it or your account is closed
• Backups (Daily Backup Pack): the last 7 days while the add-on is active, and for up to 30 days after a service is deleted

Data is securely deleted or anonymised when no longer required.

9. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct incorrect or incomplete data
• Request deletion (“right to be forgotten”)
• Restrict or object to processing
• Request data portability
• Withdraw consent for optional processing

To exercise these rights, contact us at: info@virtuahost.uk. We will respond within one month. Some rights have limits, for example we must keep billing records for as long as tax law requires.

10. Security Measures

VirtuaHost implements technical and organisational measures such as:

• Encrypted communications (HTTPS)
• Securely hashed passwords and optional two-factor authentication
• Access controls & authentication protections
• Firewalling & network-level DDoS filtering
• Server monitoring
• Regular system patching
• Encrypted backups

However, no online service can guarantee absolute security.

11. Children

Our services are only for people aged 18 or over, as set out in our Terms of Service. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If a change significantly affects how we use your personal data, we will email you before it takes effect.

13. Contact & Complaints

For privacy-related questions, contact:
Email: info@virtuahost.uk

You may also lodge a complaint with the UK’s regulator:
Information Commissioner’s Office (ICO)
Website: https://ico.org.uk