Privacy Policy

ParadoxNetworks Limited is the controller for personal data used to run our business, including account administration, billing, support, website operation, network security, and handling abuse reports.

• 1.1 Company: ParadoxNetworks Limited
• 1.2 Company number: 14831279 (registered in England and Wales)
• 1.3 Registered office: 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom
• 1.4 Data protection contact: legal@pdxnet.co.uk

For personal data that customers place in their hosted services, we normally act as a processor on their instructions, or as a sub-processor if the customer is itself a processor. The customer determines the purposes of that processing and is responsible for its own privacy information. Our processing terms are in Terms of Service Section 15.1 and any separately agreed data processing agreement. Contact the relevant customer about their use of your hosted data; we assist them with requests as required by law.

Send data protection questions and complaints to the contact above.

2.1 Data Protection Law#

We handle personal data under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025. Other mandatory privacy laws may also apply depending on the people, activities, and locations involved. This notice does not remove rights under those laws or imply that every country's rules are identical.

2.2 Cookies and Communications#

The Privacy and Electronic Communications Regulations 2003 (PECR), as amended, govern relevant cookies, similar technologies, and electronic marketing. Our use of these technologies is explained in Sections 12 and 13.

2.3 International Services#

We offer hosting services in the United Kingdom, Singapore, Australia, the United States, Canada, the Netherlands, and Germany. We provide broadband services only in the United Kingdom. Hosting location, the location of an individual, and the location of a supplier are separate considerations. See Section 15 for hosting locations, overseas access, and transfer safeguards.

For processing where we act as controller, our lawful basis depends on the purpose:

• 3.1 Contract: Setting up and delivering services requested by an individual customer, administering their account, taking payment, and providing support, where necessary for that contract or requested pre-contract steps.
• 3.2 Legal obligation: Keeping required tax and accounting records, meeting applicable communications duties, and complying with binding legal requirements such as a valid disclosure order. Identity checks rely on this basis only where a specific legal requirement applies.
• 3.3 Legitimate interests: Managing business customer and supplier relationships, answering enquiries, securing our systems, preventing fraud, proportionate verification, handling abuse, maintaining IP reputation, recovering valid debts, resolving disputes, and operating and improving the service. These interests must be balanced against your rights and reasonable expectations. Business contact details generally use this basis where the contract is with your employer rather than with you personally.
• 3.4 Consent: Optional Google Analytics and any marketing or other activity for which consent is required. Refusing or withdrawing analytics consent does not prevent ordinary use of the website.

We limit processing to what is necessary for its purpose. You may object to legitimate-interest processing and withdraw consent as explained in Section 10. We do not describe routine hosting verification or all fraud prevention as a statutory KYC or anti-money-laundering obligation. Additional legal conditions apply to sensitive and criminal-offence information (Section 4).

Depending on the service and your interaction with us, we process:

• 4.1 Contact and account details: Name, email, telephone number, postal and billing address, company details, and account identifiers.
• 4.2 Authentication information: Usernames, password hashes, credentials or tokens needed for API access or multi-factor authentication, and authentication records from a login provider you choose.
• 4.3 Payment and transaction records: Invoices, payment status, tokenised payment references, and bank or Direct Debit information needed for the chosen payment method. Card details are handled by the payment provider; we do not store full card numbers. Using a payment provider does not remove our own applicable security and payment-compliance responsibilities.
• 4.4 Verification information: Identity, business, payment, or address evidence reasonably needed to verify an order, prevent fraud, or meet a specific legal obligation. We do not request more than is necessary for the check.
• 4.5 Service and network records: Assigned addresses, service configuration, BGP session metadata, traffic and connection records, server or API logs, and account-access events.
• 4.6 Communications: Enquiries, support tickets, emails, complaints, abuse reports, evidence, and our responses.
• 4.7 Website and device information: IP address, browser and operating system details, request metadata, and, with consent, analytics identifiers and page interactions.
• 4.8 Bot-check information: Cloudflare Turnstile processes technical signals, including IP address and browser or device information, to check contact-form requests. The form sends your name, email, enquiry, and source IP address to our contact mailbox.

We receive information directly from you and your use of our services. We may also receive it from your organisation or authorised account users, payment and optional login providers, an abuse complainant, a relevant network operator, or public business and internet number registries when needed for a stated purpose. We provide any further notice required when information comes from another source.

Information needed to fulfil an order or meet a legal requirement must be provided for us to supply the affected service. We explain essential verification requests and the consequences of not providing the information. Optional analytics and marketing choices are separate.

Sensitive information: We do not request special category data for routine account administration. Support, accessibility requests, abuse reports, or evidence may nevertheless include sensitive information or criminal allegations. We use such information only with an applicable lawful basis and any additional condition required by data protection law, restrict access, and apply the retention rules in Section 9. Customers remain responsible for the lawful content of their hosted services.

We use the information described in Section 4 to:

• 5.1 Provision and operate hosting, network, broadband, and colocation services.
• 5.2 Administer accounts, process payments, and send invoices and service notices.
• 5.3 Answer enquiries, support customers, and resolve complaints.
• 5.4 Prevent and investigate fraud, abuse, and security incidents, including proportionate network monitoring under AUP Section 3.2.
• 5.5 Meet applicable legal and regulatory obligations and establish or defend legal claims.
• 5.6 Understand website use through consented analytics and improve service operation through necessary technical diagnostics.

The lawful bases are explained in Section 3. Automated controls and review rights are described in Section 16. We do not treat acceptance of our Terms as consent to every use of personal data.

We do not sell personal data. Where necessary for a stated purpose and lawful, recipients may include:

• 6.1 Service providers: Hosting and facility providers with relevant access, email delivery, security, analytics, authentication, payment, and connectivity providers described in Section 7. A provider may act as our processor or as a separate controller depending on the activity.
• 6.2 Group companies and advisers: Including ParadoxNetworks, Inc. where relevant to group services or internet number resources, and professional advisers, auditors, insurers, or debt collection providers where needed for the specific matter. Group membership does not remove transfer or confidentiality requirements.
• 6.3 Authorities and reporting bodies: Law enforcement, courts, competent authorities, and appropriate child-protection bodies where disclosure is required by law or a valid order, or is otherwise necessary, proportionate, and lawful to investigate crime or protect a child. We disclose only relevant information with the safeguards required for sensitive or criminal-offence data. Where lawful and safe, we notify the affected customer before disclosure and seek to challenge unlawful or overbroad requests. Child-exploitation reports follow AUP Section 2.
• 6.4 Business purchasers: A prospective or actual acquirer and its advisers where necessary for a transaction, subject to confidentiality, data minimisation, and continuing data protection obligations.
• 6.5 Internet number registries: Relevant registries such as RIPE NCC or ARIN, resource holders, and routing databases where necessary to provide address or routing services. Required registration and abuse-contact details may be publicly accessible. We limit submitted information to what the applicable process requires.

We do not automatically disclose a customer's identity to someone who submits an abuse allegation. Any disclosure must meet an appropriate legal basis and the safeguards above.

This list describes providers and systems used for particular functions. It is not a statement that every provider receives every customer's data or that all are sub-processors for customer-hosted content. Processor contracts and the service-specific requirements in Terms Section 15.1 apply where a provider processes data on our or your behalf. Providers acting as independent controllers have their own responsibilities and privacy notices.

• 7.1 Cloudflare (Turnstile): Contact-form bot and abuse checks using technical request signals. Cloudflare is a US-based provider with international operations. Turnstile privacy information.
• 7.2 Postal, operated by us in Toronto, Canada: Self-hosted mail software used for contact-form and transactional email delivery. Postal is software, not a separate company receiving data merely because we use it. Email content and delivery metadata are processed on our mail infrastructure and by relevant delivery or receiving mail providers; self-hosting does not mean email never passes through another provider.
• 7.3 Amazon Web Services (Amazon SES): Email delivery for selected transactional messages, processing message content, addresses, and delivery metadata. The processing location and applicable AWS entity depend on the configured service and contract. AWS privacy information.
• 7.4 Google (Google Analytics): Website usage analytics, including visit and device information, loaded only after you accept analytics. Advertising personalisation and Google signals are disabled in our website configuration. Google is a US-based provider with international processing. Google privacy information.
• 7.5 Sign in with Google: Optional account authentication. Google receives the login request and associated connection information; we receive the identity and profile information authorised through the login flow. The permission screen identifies what is requested. Google also acts as controller for its own account and security activities.
• 7.6 PeeringDB: Optional account authentication through the US-based PeeringDB organisation. PeeringDB receives an authentication request and associated technical information; we receive the identity and profile fields permitted through the authorisation flow. PeeringDB privacy information.
• 7.7 Stripe: Card payment processing, payment tokens, transaction status, and related fraud checks. Its role and relevant contracting entity depend on the processing activity; it also processes information for its own legal and fraud-prevention purposes. Stripe privacy information.
• 7.8 PayPal: Payment processing where chosen, including its own account, fraud-prevention, and regulatory activities as an independent controller. PayPal privacy information.
• 7.9 GoCardless: Direct Debit mandate and payment processing, including the payer and bank information needed for collection. GoCardless privacy information.
• 7.10 Exascale and relevant infrastructure providers: Broadband provisioning and connectivity, or hosting and facility operations for the service you order. Broadband provisioning may require service address, contact details, and line or order information. Only the information needed for the relevant service is shared.

We update this notice when our use of providers changes materially. Contact legal@pdxnet.co.uk for the providers, roles, and processing locations relevant to your service and copies or summaries of applicable transfer safeguards. International transfers and the conditions for using a particular safeguard are addressed in Section 15.

Network Carriers, Exchanges, and Telemetry

Internet traffic passes through upstream carriers, internet exchanges, and other network operators. Operators carrying traffic under interconnection arrangements may act independently; the role for a particular service depends on its actual activity and contract.

Operators may collect traffic records or packet samples for network operation, capacity, and security. These can contain source and destination IP addresses, ports, protocol, timing, and other header information. Some packet sampling can include portions of unencrypted payload, so telemetry is not necessarily anonymous or limited to aggregate statistics. Encryption protects content in transit when properly used but does not hide all routing or connection metadata. Customers should secure the applications and traffic they control.

We apply technical and organisational measures appropriate to the data and risks, including access controls, confidentiality requirements, secure configuration, patching, monitoring, and appropriate encryption.

Our public website, customer portal, and API connections use HTTPS. Security of customer-managed websites, operating systems, and applications also depends on the customer's configuration; this notice is not a claim that all traffic carried by our network is encrypted. Access to personal data is limited to authorised people with an operational need. We assess relevant suppliers and use processor agreements where required.

No system can guarantee absolute security. This does not remove our duty to use appropriate safeguards, investigate incidents, or provide legally required notifications.

We keep personal data only for the relevant purpose and applicable legal requirements:

• 9.1 Billing and account records: Tax and accounting records are normally retained for 6 years from the end of the last company financial year they relate to, or longer where law requires. Essential contract and account-history records may be retained for up to 6 years after the relationship ends where needed to establish or defend claims. This does not mean that all credentials, verification documents, or hosted content are retained for 6 years. Verification evidence is kept only as long as needed for the check, a specific legal obligation, or a justified fraud investigation.
• 9.2 Customer service data: Service termination ends access and initiates secure deletion of the relevant VMs, virtual disks, stored files, and configurations. Storage is securely erased or otherwise made unrecoverable before reassignment to another customer. The method and completion time depend on the storage system; we do not promise instantaneous physical overwriting of every shared device. Temporary operational copies follow Terms Section 15.3. We do not provide managed backups for VPS or other compute services; maintain your own independent backups and retrieve data before termination.
• 9.3 Logs and abuse cases: Network traffic logs, including NetFlow and connection logs, and abuse case records are retained for 6 months, then deleted. Other server and account-access logs are retained only as needed for security and diagnostics, for up to 12 months. Relevant extracts required for billing accuracy, a formal complaint, or another legal obligation follow that specific retention requirement rather than requiring retention of unrelated raw traffic.
• 9.4 Support and complaints: Support communications are retained while needed for the service or unresolved matter, with relevant records retained afterwards where necessary for a legal claim, normally up to 6 years. Formal complaints about regulated communications services are retained for at least 12 months after resolution or closure where Ofcom rules require. Abuse investigation records ordinarily follow Section 9.3; relevant evidence forming part of a formal complaint or legal claim follows the applicable exception.
• 9.5 Evidence holds: Relevant data may be held beyond its normal deletion point where required by law or a valid order, or where necessary and lawful for an active abuse investigation or legal claim. We preserve only what is needed, restrict access, review the need, and delete the evidence when the lawful reason ends, subject to any mandatory period. These safeguards also apply to child-exploitation evidence under AUP Section 2. An evidence hold is not a backup service.

For customer data processed on instructions, deletion or return also follows Terms Section 15.1 and any agreed data processing agreement. Website browser storage is described in Section 12. These retention rules are read with Terms Section 15.3 and AUP Section 3.2.

Depending on the legal conditions, you may:

• 10.1 Access your personal data and information about its use.
• 10.2 Correct inaccurate or incomplete personal data.
• 10.3 Request erasure where there is no lawful reason to continue holding it.
• 10.4 Restrict processing in the circumstances provided by law.
• 10.5 Object to legitimate-interest processing. We must stop unless we can demonstrate the applicable overriding grounds or need it for legal claims. An objection to direct marketing must be honoured.
• 10.6 Request portability of data you provided where processing is automated and based on consent or a contract, subject to the applicable conditions and others' rights.
• 10.7 Withdraw consent at any time, without affecting the lawfulness of earlier processing. Use the footer's Cookie settings to withdraw analytics consent, or contact us for other consent-based processing.

Exercising Your Rights

Email legal@pdxnet.co.uk or write to our registered office in Section 1. You do not have to use legal wording or a particular form. We respond without undue delay and normally within one calendar month, subject to the rules on reasonable identity checks and any clarification the law allows us to request. Where law permits an extension for a complex or numerous request, we explain it within the initial response period; the extension is no more than two further months.

Requests are normally free. Any refusal, fee, or limitation must have a lawful basis, which we explain together with your complaint rights. We request only proportionate information needed to verify identity. A right to erasure is not an unconditional right to remove records that must lawfully be retained.

10.2 Data Protection Complaints#

You can complain to us by emailing legal@pdxnet.co.uk, using our contact form, or writing to our registered office. Explain what happened and the outcome you seek. No fee or special wording is required. We acknowledge complaints within 2 business days under Terms Section 17, and in any event within the statutory 30-day limit. We investigate without undue delay, keep you informed, and communicate the outcome. Our usual target for a substantive response is 14 calendar days; if more time is needed, we explain why.

You can also complain to the Information Commissioner's Office or call 0303 123 1113. The ICO normally asks you to raise the matter with us first. Where another country's privacy law applies, you may also have rights to complain to its relevant authority. This process does not prevent court action or other mandatory remedies.

Where we act as controller, we notify the Information Commissioner's Office of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware, unless it is unlikely to result in a risk to individuals' rights and freedoms. We explain any delay and may provide further details in phases where permitted.

Where a breach is likely to result in a high risk to individuals, we notify them without undue delay unless a lawful exception applies. We explain the nature of the breach, likely consequences, protective measures, and a contact for further information. Other applicable laws may require additional notifications.

Where we act as a processor for customer-hosted data, we notify the relevant customer without undue delay after becoming aware of a personal data breach and assist with their notification duties. That duty does not wait for a finding of high risk.

Report a suspected breach affecting our services to legal@pdxnet.co.uk and noc@pdxnet.co.uk.

Cookies and similar storage can recognise a browser or remember choices. This website uses:

• 12.1 Preferences and essential functions: Browser local storage remembers your selected theme (theme) and cookie choice (cookieConsent). These remain until you clear site storage or change the choice. They support the preferences you request, rather than advertising. Account services may also use session or security storage needed for authentication.
• 12.2 Google Analytics: The analytics script loads only after you choose Accept in the cookie banner. It does not load if you have not chosen or if you choose Reject. Analytics uses first-party cookies such as _ga and _ga_G96LLXS070 to distinguish visits and sessions; our configuration allows up to 2 years, refreshed with use while consent remains in place. Google processes visit, device, and connection information. Advertising personalisation and Google signals are disabled.
• 12.3 Cloudflare Turnstile: The contact form loads a bot check and exchanges technical signals with Cloudflare for security. This is separate from optional analytics and is described in Section 7.1.

Select Cookie settings in the footer, then Reject, to withdraw analytics consent. The website stops analytics, clears its accessible Google Analytics cookies, and reloads to unload the analytics code. This does not undo processing that occurred before withdrawal. You can reopen settings and choose Accept later. If your browser prevents storage of the choice, it may be requested again on your next visit.

Browser controls can also clear cookies and local storage. Clearing only cookies may not remove a preference held in local storage. Blocking essential storage or scripts may affect site or account functions. Non-essential storage requiring consent is not enabled simply because you continue browsing.

We send account and service messages such as invoices, fault updates, and security notices where necessary to provide the service, meet legal obligations, or administer a business relationship. These are separate from marketing preferences and do not justify adding unrelated promotions.

We do not currently send unsolicited electronic marketing. Any future marketing must satisfy the applicable data protection and electronic marketing rules. Where consent is required, we obtain it before sending. If relying on the existing-customer soft opt-in, we must meet all its conditions, including a clear opportunity to refuse at collection and in every message, and limiting messages to our own similar services. You may object to direct marketing at any time using the message's opt-out or legal@pdxnet.co.uk.

Our account services are intended for businesses and adult individuals. We do not seek children's information for routine account administration. If you believe a child has supplied information directly to us, contact legal@pdxnet.co.uk so we can assess and address it, including deletion where appropriate.

Customers may lawfully host information relating to children; that does not make us the controller of their content. We assist the responsible customer with applicable data rights. Relevant evidence of exploitation or other unlawful activity may need to be preserved under Section 9.5 and AUP Section 2.

15.1 Hosting and Access Locations#

Hosting locations include the United Kingdom, Singapore, Australia, the United States, Canada, the Netherlands, and Germany. Your order identifies the selected hosting location. Choosing a location identifies where that service is provisioned; it is not a promise that all billing, support, security, email, or supplier processing stays in that country. Those activities use the relevant systems and recipients described in this notice.

Overseas access by a separate supplier or group company can constitute an international transfer even if the server remains in the UK. Operating our own server abroad does not by itself establish a transfer to a separate organisation, but UK data protection and security duties still apply. We assess the actual legal entities, access, and processing involved. We do not treat a customer's choice of region as blanket consent to bypass transfer protections.

15.2 Transfer Mechanisms#

A restricted transfer requires a valid mechanism before it takes place:

• Adequacy regulations may cover the destination and recipient. The Netherlands and Germany are within the EEA, covered by UK adequacy regulations. Canadian coverage is limited to information within the scope of PIPEDA; a Toronto server address alone is insufficient. US coverage under the UK Extension to the EU-US Data Privacy Framework depends on the recipient's current participation and the scope of its certification.
• Appropriate safeguards are needed where adequacy does not cover a routine restricted transfer, including relevant transfers to Singapore or Australia. These may include the UK International Data Transfer Agreement or EU Standard Contractual Clauses with the UK Addendum, together with the required transfer assessment and any additional protections. A supplier being part of our corporate group does not exempt the transfer.
• Narrow statutory exceptions can apply in specific circumstances. They are not a substitute for safeguards for ordinary, repeated outsourced processing.

Where EU GDPR or another applicable law also imposes transfer requirements, those requirements must also be met. The applicable mechanism depends on the actual recipient, service, and scope of processing, rather than its country alone.

15.3 Finding Out More#

Contact legal@pdxnet.co.uk for the recipients, destinations, and safeguards relevant to your service, including a copy of applicable transfer clauses with unrelated confidential information redacted. Service-specific processing instructions and any agreed location restrictions remain subject to Terms Section 15.1 and the applicable data processing agreement.

Automated systems support bot checks, payment and security screening, monitoring, and technical protections such as traffic filtering or rate limits. These controls can reject a contact-form submission or restrict traffic when configured checks are triggered. A technical control is not necessarily a legally significant decision about an individual.

You can contact legal@pdxnet.co.uk to question an account or service restriction and request human review. Abuse appeals also follow AUP Section 3.4. If a decision about you is made solely by automated processing and has legal or similarly significant effects, we must provide the information and safeguards required by applicable law, including meaningful information about the relevant logic and consequences, an opportunity to make representations and contest it, and human intervention. Additional restrictions apply to decisions using special category data. We do not claim that every operational action is taken manually.

We update this notice when our processing changes. The current version carries the effective date shown above. We give appropriate notice of material changes, and explain a new use before it starts where required by law. A policy update or your continued use of a service does not itself provide consent where consent is required, authorise incompatible processing, or remove existing rights.

For any questions, requests, or concerns regarding this Privacy Policy or your personal data:

• 18.1 Email: legal@pdxnet.co.uk
• 18.2 Postal: ParadoxNetworks Limited, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom
• 18.3 Suspected data breach affecting our services: legal@pdxnet.co.uk and noc@pdxnet.co.uk

To complain to the supervisory authority, contact the Information Commissioner's Office at ico.org.uk.